Privacy notice
How mzassist handles your data.
mzassist is available only to people signed in with an mzmine account. There is no anonymous access, so everything below describes processing tied to your account.
Access requires a current mzmine COMMUNITY or PRO licence. Where that licence is held by your organisation rather than by you, your access to mzassist depends on it and ends with it. mzio GmbH is the controller for the processing described here in either case.
Please do not paste confidential or personal information into the chat. Your questions are sent to a third-party AI service to generate an answer. mzassist searches public mzmine documentation and public source code — it never needs your sample names, patient data, customer names, or unpublished research to answer a question.
1. Who is responsible
- Controller
- mzio GmbH, Altenwall 26, 28195 Bremen, Germany
- Contact for data protection
- info@mzio.io
- Data protection officer
- Not appointed. mzio GmbH is not required to appoint one under Art. 37 GDPR.
2. What we process, and why
| Data | Purpose | Legal basis |
|---|---|---|
| The questions you type and the answers returned | Producing the answer; keeping the conversation coherent across follow-ups | Art. 6(1)(b) — performance of the service you requested |
| Your email address and the mzmine account role that determines your tier, both read from your mzmine sign-in | Access control and your daily question allowance | Art. 6(1)(b) |
| A record that you accepted the terms of use: your account, the version accepted, and when | Evidence of the agreement under which the service is provided | Art. 6(1)(f) — our legitimate interest in being able to show which terms applied to you |
| Usage records: timestamp, tier, token counts, cost, response time | Cost control, capacity planning, and detecting misuse | Art. 6(1)(f) — our legitimate interest in running the service sustainably and safely |
| Server logs (IP address, request, timestamp, user agent) and sign-in records (which account, and whether access was granted) | Operating and securing the service | Art. 6(1)(f) |
Your daily allowance is applied against your account, so we do not need to identify you by network address to enforce it and we do not record one for that purpose.
We do not use your questions to train AI models, we do not profile you, and no automated decision with legal or similarly significant effect is made about you (Art. 22 GDPR).
3. Who receives your data
We use the following processors under Art. 28 GDPR. They act only on our instructions.
| Processor | Role | Location |
|---|---|---|
| Mistral AI SAS 15 rue des Halles, 75001 Paris, France |
Generates the answer from your question and the retrieved documentation | France, EU |
| Langfuse GmbH Oranienburger Straße 91, 10178 Berlin, Germany |
Quality and error monitoring of individual answers | Ireland, EU |
| Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany |
Hosting of the application and the indexes | Germany, EU |
| Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy, L-1855 Luxembourg |
Infrastructure for the mzio sign-in service, through which you sign in with your mzmine account | Ireland, EU |
Processing takes place on servers in the European Union. Where a processor's parent company is established outside the EU, the transfer is covered by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
4. How long we keep it
| Record | Retention |
|---|---|
| Question text and conversation history | 30 days, then automatically deleted |
| Usage and cost records (without question text) | 12 months |
| Server logs and sign-in records | 14 days, then automatically deleted |
| Your acceptance of the terms of use | Kept while you have access, and deleted when you ask us to erase your records |
| Records relating to a suspected misuse of the service | Retained until the matter is resolved, then deleted |
Deletion is automatic and scheduled, not on request only. After the content window elapses, the usage record survives without the question text, so we can still account for cost and volume without keeping what you wrote.
5. Cookies
mzassist sets only cookies that are strictly necessary to deliver the service you asked for. There is no advertising, no analytics, no tracking, and no third-party content of any kind — the page loads no external fonts, scripts, or images. For that reason no cookie consent banner is shown; these cookies are exempt under § 25(2) TDDDG.
| Cookie | Purpose | Lifetime |
|---|---|---|
mzassist_thread |
Keeps your conversation together so follow-up questions have context | 30 days |
mzassist_guest |
Applies a daily allowance where mzassist is offered without sign-in. Not set here: this deployment requires an mzmine account | 30 days |
_oauth2_proxy |
Keeps you signed in | Session |
All are httpOnly and contain no personal data: the conversation and
guest cookies hold a random signed identifier, not an identity.
Your browser also remembers locally that you have seen the notice shown on your first visit, so it is not shown again. That is stored on your device only and never sent to us.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest, including the usage records described above (Art. 21).
To exercise any of these, write to info@mzio.io. Because access requires an mzmine account, every record we hold can be located by your sign-in address and any of these requests can be actioned in full.
You may also complain to a supervisory authority. The one responsible for us is Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (datenschutz.bremen.de).
7. Answers are generated by an AI
mzassist composes answers automatically from retrieved documentation and source code. Answers can be incomplete or wrong, and citations should be followed before you rely on anything. mzassist is a search and explanation aid for public mzmine material. It is not a validated system, it is not qualified for use in a regulated (GxP) process, and it must not be used as the basis of a regulatory, clinical, or diagnostic decision.
8. Changes
We will update this notice when the service changes. The date at the top shows the current version.