Your chemistry stays on your device.

The short version

• Your structures, drawings, projects and results stay in your browser. The prediction models run there too. Our servers never receive a structure or a result.
• A structure leaves your device only when you choose a PubChem lookup, or when you send it to us yourself, for example in an email about a problem.
• To run your licence we keep your name, email address, organisation and country, a short label ("Chrome on Mac") for each browser you register, and logs of model deliveries: times and identifiers, never molecules. If the app sees signs that a program rather than a person is operating it, it also tells our licence server: the kinds of sign and a score, never your work; the server may then ask you to confirm you are a person through a Cloudflare check, and may pause the models in that browser until our staff have looked.
• Payments are handled by Razorpay (India) or Paddle (elsewhere). We never see your card number, UPI ID or bank details.
• No advertising trackers, no fingerprinting, no social-media pixels, and we do not sell personal data.
• You can ask for a copy, a correction or deletion at hello@molkraft.com. Our Grievance Officer is named in section 12.

1. Who is responsible

This policy is issued by Mehra Holdings, a partnership firm, of Mehra Compound, 402 Pitamber Lane, Mahim West, Mumbai 400 016, Maharashtra, India ("Mehra Holdings", "we", "us"), which operates MolKraft. We are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023, the "controller" under the EU and UK General Data Protection Regulation (GDPR), and the "business" under California's privacy law, for the data described here.

It covers the website at molkraft.com, the application at app.molkraft.com, MolKraft accounts and the licence server behind the app, payments, and our correspondence with you. It does not cover other websites we link to.

2. The website, molkraft.com

Visiting. The website sets no cookies and writes nothing to your browser's storage. It is hosted by Cloudflare, which processes the technical data every website needs (your IP address, browser type, the pages requested) to deliver the pages and protect the site, and keeps those logs for a short time. The pricing page shows rupee prices to visitors whose connection comes from India and dollar prices to everyone else; the country is read from the connection and is not stored. Every script, font, image and video comes from molkraft.com itself. At the date of this policy the site runs no analytics; if we switch on Cloudflare Web Analytics, a visit counter that sets no cookies and does not identify visitors, we will say so here.

Requesting access. When you fill in the request form we collect your name, email address, role, organisation (optional), what you would use MolKraft for (optional), your confirmation that you are 18 or older, and the country your connection comes from. A Cloudflare check that a person, not a program, is sending the form receives your IP address; we also use your IP address to refuse repeated submissions, and do not store it with your request. The request is saved in our database and emailed to us; we use it to answer you and to send an invitation, and we keep it until the beta programme ends or you ask us to delete it, whichever is sooner. To have it deleted, email hello@molkraft.com from the address you used.

The payment page. molkraft.com/pay completes a Paddle checkout that Paddle sends there; it loads Paddle's checkout script only then. Paddle's handling of your details is in section 5.

The contact page only opens your email application. See section 4.

3. The application, app.molkraft.com

What stays in your browser. The app keeps your work in your browser's own storage and sends none of it to us: your drawings and their autosaved drafts, reactions and schemes, favourites, recent searches, collections, the last files you opened (with their contents), and your settings (editor choice, NMR engine and solvent, pH, export quality, drawing style, drawing aids, sidebar, what's-new and first-run flags, the "Keep my structures on this device" choice). It also keeps cached PubChem answers so a repeat search does not ask again; the licensed models and what this browser needs to run them; the hourly and daily counts of model predictions and picture readings (never the structures or the pictures); whether the picture reader has been downloaded here; a note that the models are paused here, while a pause lasts; and, when the step is shown, your agreement to the Terms. Projects are saved as files you keep. Clearing site data in your browser removes all of this; "Export my work" in the app writes it to a file. While you sign in to your account, the app keeps a copy of your work in that browser tab and the file you were saving, for up to 30 minutes; nothing is uploaded.

Lookups you choose: PubChem. When you search by name, formula, CAS number, SMILES, InChI or CID, open a compound, turn a drawing into 3D or look up its name, the app sends your query, or that structure's SMILES or InChIKey, directly from your browser to PubChem, a service of the United States National Library of Medicine, and shows you the answer. PubChem sees your IP address and your query under its own terms and privacy policy; we do not receive or log it. If you switch on "Keep my structures on this device" in the app's About dialog, typed names, drawings and their SMILES are never sent to PubChem (names are read on your device instead); formulas, CAS numbers, SMILES, InChIs, InChIKeys and CIDs typed into Search still go to PubChem, and so does short text that also reads as SMILES. The app also offers links to other public databases for a structure; nothing is requested until you click one, and each link carries one public identifier.

Everything else runs on your device. The NMR models, IUPAC names, calculated properties, the picture reader (pictures never leave your device), spectrum files, the Reaction tab's calculations, orbitals and surfaces all run in your browser. The app talks only to app.molkraft.com and PubChem, and, when our licence server asks you to confirm that a person is using it, to Cloudflare's check (section 3b); it loads no fonts or analytics from anyone else, and it has no analytics or error reporting of its own.

Signing in to the app. You open the app by signing in to your MolKraft account (section 3a). The account needs beta access, which we give when we invite or approve you; sign in with the email address your invitation or approval was for. On each visit the app reads the email address of the signed-in account to show it to you and to match you to your seat. Until 25 October 2026 the app was reached through Cloudflare's sign-in, which emailed a one-time code to an invited address; that sign-in is no longer used, and Cloudflare keeps its own records of it for a short time under its policy.

3a. Your MolKraft account

During the private beta, a MolKraft account with beta access is how you open the app at app.molkraft.com, and the same account is used for exports, project files and the NMR models. Anyone may create an account; only an account to which we have given beta access opens the app. This section describes accounts as built.

What we store. Your email address, a display name if you give one, whether the address is verified, your sign-in methods, and the times the account was created and changed. If you sign in with a password, we never keep the password itself in readable form. When that service is available, a new password is checked against the Have I Been Pwned breached-password service (section 7), which does not receive the password.

Emailed codes. A password sign-in is followed by a code emailed to your address. We keep the code only until it is used, or shortly after, and never in readable form. The email holds the code and nothing else: no images, no tracking, no links. Password-reset links work once and are kept the same way.

Signing in with Google. If you choose Google, we ask Google only for the openid, email and profile scopes. Google tells us your Google account identifier, your email address, whether Google has verified it, your name and, if your account belongs to a Google Workspace organisation, its domain. We store the identifier, your email address, your name and, if your Google account belongs to an organisation, that organisation's domain; we do not store your picture, and we never store Google's access or refresh tokens, and we use nothing from your Google account beyond what is listed here. We do not update your name or address from Google afterwards. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

Sessions and cookies. Signing in sets a sign-in cookie that lasts 7 days and is renewed while you use the app; the session record holds the connection address and browser string seen at sign-in, for as long as that session lives. A "remember this browser" cookie lasts 180 days and holds only a random identifier; it is cancelled when you sign out everywhere, reset your password or delete your account. A short-lived cookie carries the code step while you sign in. When free trials are offered, signing in also sets a trial cookie that holds a random value for about 400 days, so that each browser gets one free trial. All of these are strictly necessary for signing in and for the one-trial rule; none is used for tracking, and no other cookie is set.

Security records. We keep a record of sign-ins, failures, password changes and other account events (the time and the kind of event; never a code, a password or your email address in readable form), and short-lived security records of sign-in attempts, including your IP address, deleted after a day. A Cloudflare check that a person, not a program, is signing up, asking for a code, resetting a password or, after repeated failures, signing in receives your IP address.

Your controls. From your account page you can see your sessions and registered browsers and end them, sign out everywhere, change your display name, and delete your account; deletion is refused while the account holds an active licence other than the free trial (the trial ends with the account), and some records survive it (see section 9). For a copy of your account data, write to hello@molkraft.com from your account's email address (section 11). Marketing email is sent only if you opt in, and every such email has a one-click unsubscribe. A forgotten password is reset from the sign-in page ("Forgot your password?"). There is no self-service change of password or email address yet; write to us.

3b. Your licence and the licence server

To deliver the models and run your licence, our licence server keeps:

The delivery log shows the hours during which a browser had a model open; it cannot show what you did with it. From the automation report the licence server can also tell that a program, rather than a person, seems to be operating a browser; nothing more than the check and the pause in section 6 follows from that without a person looking. The licence server stores no IP address and no raw browser string, and receives your signed-in email address and never a structure.

Academic eligibility. To check that an Academic buyer has a university email address we look at the domain of the address on the account; .edu, .edu.xx and .ac.xx addresses pass by themselves. For another domain we keep your request to approve it, and our decision.

4. Writing to us

hello@molkraft.com. Mail to this address, and to grievance@molkraft.com, reaches our mailbox; other @molkraft.com addresses are not read. We keep your message and our reply to answer you and for our records. If you report a problem with the app, include only what you are happy for us to keep: the description, the version, your browser and device, and a screenshot if it helps. Problem reports are kept as correspondence (section 9).

Mail we send. Sign-in codes and account notices come from an @molkraft.com address that does not read replies; write to hello@molkraft.com.

5. Paying

Nothing is charged during the private beta. When paid plans open:

In India (Razorpay). When you buy a plan we create an order with your name, your state (for the GST split) and, if you give one, your GSTIN, plus the plan, amount, tax and the country your connection comes from. Razorpay collects your payment details on its own pages under its own privacy policy and tells us the payment identifier, its status, the method (for example UPI or card) and whether the instrument is international. We do not receive your card number, UPI ID or bank details, and we never keep Razorpay's full event data. Razorpay issues the GST invoice with our GSTIN. Payment and invoice records are kept as long as Indian tax law requires.

By bank transfer (India). We keep the invoice we issue you and your remittance details for the same period.

Outside India (Paddle). Paddle sells MolKraft as our reseller and merchant of record. It collects your billing details and payment information on its checkout under its own privacy policy, as an independent controller. Paddle tells us your Paddle customer and subscription identifiers, the plan, the status of the subscription, and events such as renewals, cancellations, refunds and chargebacks. We store those identifiers and outcomes; we never store Paddle's full event data, your billing address or your payment details.

6. Why we use personal data, and the legal basis

India. When the DPDP Act's consent rules apply, we will ask for it with a notice when you first accept the Terms or submit a form, and you may withdraw it at any time by writing to us. Withdrawing consent stops the related processing from then on; because a licence cannot run without the data in section 3b, withdrawing consent for that data ends the licence. Data you give us voluntarily for a purpose, such as a request for access, is used for that purpose under Section 7 of the DPDP Act.

No automated decisions with legal effect. Usage limits are applied automatically: the licence server stops unlocking the NMR models when a limit, including a seat's daily limit, is reached, until it resets. When the app reports signs that a program is operating a browser, the licence server may automatically ask you to confirm that a person is present and, if that check fails or the signs continue, pause the models in that browser; a browser added to the seat meanwhile starts paused too. Each of these affects one browser or one day, not your licence, and a person clears a pause that was wrong. No decision that significantly affects you, such as ending a licence for misuse, is made by automation alone: a person reviews the evidence and writes to you.

No sale, no advertising. We do not sell personal data, share it for advertising, or profile you for marketing.

7. Who we share personal data with

Processors (they act on our instructions under written terms):

• Cloudflare, Inc. (United States) and its affiliates: hosting, databases, storage, security, logs, the check that a person is sending a form or using the app, and email routing and sending. Our databases are held in North America; requests are served from Cloudflare's data centres worldwide.

Independent controllers (they collect data under their own policies):

• Razorpay Software Private Limited (Bengaluru, India): payments in India.
• Paddle.com Market Limited (London, United Kingdom) and its affiliates: reseller and merchant of record for sales outside India.
• PubChem (United States National Library of Medicine): the lookups you choose (section 3).
• Google LLC (United States): if you sign in with Google.
• Have I Been Pwned (operated from Australia): the breached-password check, which does not receive the password.

Your organisation. If your seat is on a Lab, campus or class licence, we may tell the licence holder's administrator which seats are active and when the licence ends. We share delivery logs with it only to investigate misuse.

Our staff. Access to personal data is limited to the owner and the staff the owner has added to our administration tools, which record every action, including clearing a pause.

Advisers and authorities. Our lawyers, accountants and insurers under confidentiality; and courts, regulators or law enforcement where the law requires it or where we need to establish or defend a legal claim, including a claim about misuse of the models.

A successor. If the MolKraft business is transferred to a company formed to carry it on, or is sold or merged, personal data passes to the successor under this policy.

8. International transfers

We are in India. Cloudflare and Google process data in the United States and elsewhere, Paddle in the United Kingdom and the United States, PubChem in the United States, Razorpay in India and Have I Been Pwned in Australia.

• From the EU, UK and Switzerland: transfers to a country without an adequacy decision rely on the European Commission's Standard Contractual Clauses (with the UK addendum where needed) or on an adequacy decision, including the EU–US Data Privacy Framework where the recipient is certified. You can ask for a copy of the safeguards at hello@molkraft.com. We have not appointed a representative in the European Union or the United Kingdom.
• From India: the DPDP Act allows transfers outside India except to countries the Central Government restricts; none is restricted at the date of this policy.

9. How long we keep personal data

"Automatically" means a clean-up in our code deletes the data when its period ends. "By hand" means the period is our rule and we delete the data ourselves when it ends, and earlier on request where we are not required or entitled to keep it. When you delete your account, the account, its sessions and its sign-in methods go at once; the records that survive are the sign-in and account event records (which hold no email address in readable form), your marketing choice, the trial record, payment records, academic-approval records, a keyed record that an address's beta access was ended (it holds no address in readable form), so that it is not reopened by mistake, and any licence records still within their period above. When a period ends we delete the data or make it anonymous.

10. How we protect personal data

Data is encrypted in transit and at rest. Our servers and administration tools need a sign-in, and staff actions are recorded. Passwords, one-time codes and reset links are never kept in readable form. We do not describe our security measures in more detail here, on purpose.

If a personal-data breach is likely to put you at risk, we will notify the authority and, where required, you, within the time the law sets: 72 hours to the supervisory authority under the GDPR, and as the DPDP Rules prescribe in India.

11. Your rights

Everyone. You can ask us what personal data we hold about you, have it corrected or completed, have it deleted, and object to or restrict processing based on our legitimate interests, including the misuse and automation detection. Write to hello@molkraft.com from the email address on your account; we may ask for details to confirm it is you. We answer within one month (extendable for complex requests, with notice), free of charge unless a request is clearly excessive. Some data cannot be deleted at once: we keep payment records as tax law requires, and we may keep delivery logs needed to trace misuse or defend a claim. We will tell you when this applies. If you ask for a copy of your data, we send a plain summary to your account's email address: the name and email address on the account, how you sign in (password or Google), your licences, your marketing choice and the date you made it, and the dates you signed in, with the browser for each browser still signed in. If you want everything we hold about you, say so and we send the full set: your account and sign-in history, the connection addresses and browser strings recorded for the browsers still signed in, and the licence server's records about your seat (section 3b), within the same month. Account holders can delete their account from the account page (section 3a).

India (DPDP Act, 2023). You have the right to a summary of the personal data we process and how; to correction, completion, updating and erasure; to grievance redressal through our Grievance Officer (section 12); and to nominate a person to exercise your rights if you die or become incapacitated. If you are not satisfied with our response you may complain to the Data Protection Board of India.

EU and UK (GDPR). You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent where processing is based on it, and the right to complain to a supervisory authority, in particular in the country where you live or work (in the United Kingdom, the Information Commissioner's Office).

California and other US states. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (we do neither) and to limit the use of sensitive personal information (we collect none); and not to be treated differently for exercising these rights. You may use an authorised agent. We respond within 45 days, extendable once with notice. The categories we collect are those in sections 2 to 5: identifiers, commercial information (licence and payment records), internet activity (logs) and the two inferences described in section 3b (the hours a browser had a model open, and whether a program rather than a person seems to be operating the app).

Your structures. Because your structures and results exist only in your browser, use the app's export and clear functions or your browser's site-data controls; we hold no copy.

Children. MolKraft is for people aged 18 or over, and the request form asks you to confirm it. We do not knowingly collect personal data from anyone under 18; if you think a child has used MolKraft, write to us and we will delete the data. Licences for students under 18, where a school or university wants them, will be covered by a written agreement with the institution, and this policy will be updated before any such licence is offered.

12. Contact and Grievance Officer

Mehra Holdings, a partnership firm, Mehra Compound, 402 Pitamber Lane, Mahim West, Mumbai 400 016, Maharashtra, India. GSTIN 27AAAFM4270A1ZS.
Email: hello@molkraft.com · Phone: +91 22 2445 0741

Grievance Officer and data-protection contact: Mukul Mehra, grievance@molkraft.com, or call the number above. We acknowledge grievances within 48 hours and resolve them within the period the law prescribes, and in any case within one month.

Representative in the EU and UK: not appointed.

13. Changes to this policy

We may update this policy; the date at the top changes when we do. For a material change we tell you by email or in the app, and where the law requires it we ask for your consent again. The cookies page repeats what the website stores (nothing); the Terms of Service and the MolKraft Licence are the agreement for using MolKraft. These documents are written in English, as used in India (British spelling); where they are translated, the English version prevails.