Privacy Policy

Last updated: June 2026

Overview

CDMO Signal is a free intelligence platform for biopharma manufacturing. You can search without creating an account. In exchange for offering the service for free, we analyze how the platform is used and surface aggregated demand signals to the CDMOs profiled on the platform — for example, that interest in a given manufacturing capability is rising in a particular region. This is the same value exchange that powers most free professional services. We are committed to handling data responsibly under applicable privacy laws including GDPR (EU/UK) and CCPA (California).

This policy describes what we collect, why, our legal basis for processing, how long we keep it, and your rights. Our primary legal basis under GDPR is legitimate interest (Article 6(1)(f)) for operating, securing, and improving the service and for business-to-business demand analytics.

Data We Collect

IP addresses — We store the IP address associated with a search for up to 90 days to identify the organization behind business traffic (for example, mapping a corporate network to a company) and to power geographic insights. After 90 days the raw IP address is automatically deleted; only the derived, non-identifying signals (organization, network/ASN, and country/region/city) and an anonymized hash are retained for longer-term analytics. IP addresses are also used in-memory for rate limiting and abuse prevention.

Organization identity — For business visitors, we may resolve the organization behind a search using the network it originates from (corporate IP ranges / reverse DNS) and, where you provide it, your work email domain. This lets us recognize, for example, that a company is actively researching manufacturing partners. We do not identify individual people from IP data, and we exclude traffic that comes through data-center, cloud, or VPN networks from this analysis.

Search behavior & demand intelligence — We log search queries, timestamps, AI-classified intent categories, time spent on results, and which results were clicked, to improve search quality and to produce demand intelligence. Aggregated and de-identified versions of this behavior — grouped by organization, geography, and manufacturing interest — may be surfaced to the CDMOs profiled on the platform so they can understand demand for their capabilities. When you use the AI search, your query is sent to Anthropic's Claude API alongside our CDMO database context; Anthropic does not use API inputs to train their models. See Anthropic's privacy policy.

Persistent visitor ID — A random token stored in a first-party cookie (cdmo_vid, up to 12 months) and in your browser's local storage, used to recognize returning visits and stitch a visit history together even when we can't name you. We may link this ID to an organization or to a contact record we hold about you (for example, if you provide your work email) for engagement analytics and follow-up purposes.

Email addresses — When you export a PDF report, subscribe to search alerts, or are asked to continue searching after several searches (see below), we ask for your work email so we can deliver the file or notification and save your search history. We link the email to your visitor ID and organization so we can recognize returning visits from the same person or company.

Continued Use & Sign-In

The platform is free and the first searches are fully open. After several searches we may invite you to enter your work email to save your search history and, eventually, to continue searching. We only accept business email addresses for this. You can always reach our team at hello@cdmosignal.com if you have questions about this.

Data Retention

Engagement events (searches, clicks, time on results) that can be linked to an identifiable contact are retained for 24 months from the date the event occurred. After 24 months, the link to the contact is automatically removed; the aggregate event itself is preserved for product analytics.

Contact records (name, email, company, title) uploaded to our internal CRM are retained as long as you remain in our contact database. You can request earlier deletion at any time (see Your Rights below).

Anonymized search analytics (aggregate counts, top queries, etc.) are retained indefinitely.

Cookies & Local Storage

We use the following browser storage:

  • First-party cookie — A persistent visitor ID (cdmo_vid, up to 12 months) used to recognize returning visits. This is set by us only, not a third party.
  • localStorage — Anonymous visitor ID (cdmo_visitor_id, kept in sync with the cookie) and your previously-entered work email (cdmo_export_email) for convenience.
  • sessionStorage — Search referrer tracking and marketing attribution parameters. These are cleared when you close your browser tab.
  • Session cookies — Flask login session for authenticated admin/CDMO claim access only.

We do not use third-party tracking cookies, advertising cookies, or behavioral analytics scripts that share your activity with advertisers. You can clear all browser data for cdmosignal.com at any time in your browser settings.

Your Rights

Under GDPR (EU/UK), CCPA (California), and similar laws, you have the right to:

  • Access — Request a copy of all data we have about you
  • Erasure — Request that we delete your data
  • Rectification — Correct inaccurate data
  • Object — Object to processing based on legitimate interests
  • Restriction — Limit how we process your data
  • Portability — Receive your data in a structured format

To opt out of marketing analytics: Use the opt-out link at the bottom of any email we send you, or contact us at hello@cdmosignal.com. Opting out permanently removes your data from our engagement analytics.

To exercise any other right or ask a question: Email hello@cdmosignal.com. We will respond within 30 days as required by law.

Data Sharing

We do not sell, rent, or share your data with third parties for their own purposes. We use the following processors to operate the service:

  • Anthropic (Claude AI) — Powers the AI search. Your search queries and CDMO database context are sent to Anthropic for processing. Anthropic does not train on API inputs.
  • Render — Hosting infrastructure for the platform.
  • SendGrid / SMTP provider — Email delivery for PDF exports, alerts, and notifications.

We surface aggregated and de-identified demand intelligence — search activity grouped by organization, geography, and manufacturing interest — to the CDMOs profiled on the platform, so they can understand demand for their capabilities. We do not sell your individual personal data, and we do not share your name, email, or individual contact record with CDMOs.

Third-Party Services

Anthropic (Claude AI) — Powers the AI search. Your search queries and CDMO database context are sent to Anthropic for processing. Anthropic does not train on API inputs.

Web search — The AI search may perform web searches to supplement database results. When this happens, search terms related to CDMOs may be processed by web search infrastructure. No personal data is included in these searches.

CDMO Intelligence Data

All CDMO data displayed on this platform comes from publicly available sources: the FDA Data Dashboard, ClinicalTrials.gov, SEC EDGAR, and public press monitoring. No personally identifiable information is collected from these sources. This data is aggregated and scored to provide manufacturing intelligence.

Children

CDMO Signal is a B2B service intended for adult professionals in the biopharma industry. We do not knowingly collect data from children under 16.

Changes to This Policy

We may update this privacy policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Your continued use of CDMO Signal after changes constitutes acceptance of the updated policy.

Contact

Questions about this privacy policy, or to exercise your rights? Contact us at hello@cdmosignal.com.