Privacy Policy
Last updated 1 October 2026
This policy explains how MeristemLab (we, us), the operator of MeristemLab, handles personal information. We are bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Words such as “personal information” have the meaning given in that Act.
1. Who we are and how to contact us
MeristemLab
Privacy officer: hello@meristemlab.com
2. What we collect
We collect only what we need to run the service:
- Account details: your name, email address and a hashed password (we never see the password itself), the lab you belong to and your role in it.
- Lab records you enter: cultures, mother plants, media, protocols, locations, equipment and inventory. Some records contain personal information about other people, for example the names of your staff recorded against a task, or the contact details of your lab’s customers.
- Usage and security logs: the IP address and browser of requests to our servers, sign-in events, and an audit trail of key changes made in your lab (who changed what, and when).
- Support correspondence: emails you send us.
- Billing details: the business name, contact and invoicing address for paid plans. We do not collect or store card numbers.
We do not collect dates of birth, government identifiers, precise location data or advertising profiles.
3. Your lab’s records about other people
When your lab enters information about its own staff, customers or suppliers, your lab decides why that information is collected and how it is used; we store and process it on your lab’s instructions. Your lab is responsible for telling those people that their details are held in MeristemLab and for handling their access or correction requests. If someone contacts us directly about information your lab holds, we will refer them to your lab.
4. Why we use personal information
- to provide, operate and support the service, including responding to your requests;
- to keep the service secure, detect misuse and investigate incidents;
- to invoice paid plans and keep business records;
- to send service notices such as maintenance, security or changes to these terms;
- to comply with the law.
We do not sell personal information, we do not use it for third-party marketing, and we will not send you promotional email unless you ask for it.
5. Who we share it with (including overseas)
We use a small number of service providers to host and run MeristemLab. They process personal information only on our instructions under contractual protections:
- Supabase Inc: Database, authentication and application hosting. Location: United States (AWS us-east-1).
- Vercel Inc: Web hosting, serverless functions and cookieless web analytics. Location: United States (iad1).
This means your data is stored and processed in the United States. Under APP 8 we take reasonable steps to ensure these providers handle personal information in a way consistent with the Australian Privacy Principles. We may also disclose information where the law requires it, or to our professional advisers under confidentiality.
6. Support access to your lab
Named MeristemLab support staff can open a lab’s account to troubleshoot a problem. We only do this to resolve a support request or a security incident, every such access is recorded in the audit log, and we do not use what we see for any other purpose.
7. How we protect it
- all connections are encrypted in transit (HTTPS/TLS), and our hosting provider encrypts data at rest;
- each lab’s data is separated from every other lab by row-level security enforced in the database;
- access within a lab is controlled by the roles your lab assigns;
- access to production systems is limited to named staff;
- regular backups are taken by our hosting provider.
No system is perfectly secure. See our security page for more detail.
8. How long we keep it
- Account and lab records: for as long as your account is active.
- When a lab is deleted, its records are removed from our live database within 30 days, and from backups within a further 30 days.
- Audit and security logs: 12 months, unless needed longer for an investigation or a legal obligation.
- Billing records: as required by Australian tax law (generally 5 years).
9. Access and correction
You can view and update your own account details in Settings. Lab admins can export the lab’s records and delete the lab from Settings. For anything else, email the privacy officer; we will respond within 30 days, and if we refuse a request we will tell you why.
10. Data breaches
If we become aware of a suspected data breach involving personal information we will assess it within 30 days. Where the breach is likely to result in serious harm we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
11. Cookies and analytics
We use only the cookies needed to keep you signed in. Our web host provides aggregated, cookieless page analytics that do not identify individual visitors. We do not use advertising trackers.
12. Complaints
If you think we have mishandled your personal information, email the privacy officer with the details. We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
13. Changes
We will post any change to this policy here and update the date at the top. For material changes we will also email account holders before the change takes effect.