Privacy Policy.

MySpawn Inc. ("MySpawn", "we", "us", "our") operates the digital legacy preservation platform at myspawn.me. We are incorporated in Delaware, USA, with our registered office at 8 The Green, Dover, DE 19901, USA.

We are a preservation service only. We collect and store DNA samples and personal data for long-term preservation purposes. We do not perform genetic engineering, cloning, reproductive services, or any biological procedures of any kind.

For privacy matters, contact us at: myspawn@myspawnapp.com

We collect the following categories of data when you use MySpawn:

We use your data strictly for the following purposes:

• ·To fulfil your DNA kit order and deliver the preservation service;
• ·To operate, maintain, and secure your Legacy Vault;
• ·To send order confirmations, shipping updates, and service notifications;
• ·To respond to your support requests and enquiries;
• ·To process payments via Stripe and PayPal (your card details go directly to them);
• ·To improve our platform through anonymised analytics (only with your cookie consent);
• ·To comply with our legal obligations and respond to lawful requests.

We do not use your data for advertising, profiling for third-party purposes, or any automated decision-making that produces legal effects.

Your DNA is the most sensitive data we hold. Under GDPR Article 9, genetic and biometric data is "special category" data requiring the highest level of protection. We treat it accordingly.

• ·Your DNA sample is stored in a controlled, access-restricted, accredited facility for long-term preservation;
• ·We do not analyse, sequence, genotype, or genetically process your sample in any way;
• ·Your sample is never used for research, sold, licensed, or shared without your explicit, separate, written consent;
• ·You retain full legal ownership of your DNA sample at all times;
• ·Any future use of your biological material is entirely contingent on applicable laws at that future time and your explicit consent;
• ·Access to stored samples is restricted to authorised facility personnel only and is logged at all times.

We do not sell, rent, or trade your personal data. We share it only in the following limited circumstances:

Our key service providers include: Stripe (payments), PayPal (payments), Supabase (database and storage), Vercel (hosting), Resend (email), and the Storage Partner — our ISO-certified biobanking partner for physical DNA sample receipt and long-term storage. Each operates under a formal data processing agreement.

The Storage Partner operates under a formal Data Processing Agreement (DPA) with MySpawn consistent with GDPR Article 28, CCPA, and applicable state genetic privacy laws. Within this arrangement, the Storage Partner acts as an independent processor with no rights to use, analyse, or disclose your sample or its associated metadata for any purpose other than the secure storage directed by MySpawn on your behalf. The Storage Partner is also named as a third-party beneficiary of your indemnification obligations under the Terms & Conditions and Storage Services Agreement.

Depending on your location, you have the following rights over your personal data. To exercise any of them, email myspawn@myspawnapp.com.

We will respond to all requests within 30 days. For complex requests, we may extend this to 60 days with notice. Identity verification will be required before processing sensitive requests.

We use the following types of cookies on myspawn.me:

You can manage your cookie preferences at any time via the cookie settings in your account or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

We retain your data for as long as your account is active and for the duration of your chosen plan:

After the retention period, data is permanently and securely deleted. DNA samples are destroyed using certified laboratory disposal methods by the Storage Partner in accordance with applicable regulatory requirements.

We implement industry-standard security measures to protect your data:

• ·All data in transit is encrypted using TLS 1.3;
• ·All data at rest is encrypted using AES-256;
• ·Biological samples are stored by the Storage Partner in access-restricted, monitored, controlled-environment facilities;
• ·Access to user data is limited to authorised personnel only, and all access is logged;
• ·We conduct regular security reviews and penetration testing;
• ·We do not store raw card payment data — all payments are processed by PCI-DSS compliant providers.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

MySpawn is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will delete it immediately. If you believe we may have collected data from a child, please contact us at myspawn@myspawnapp.com.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Your continued use of MySpawn after the effective date of any changes constitutes your acceptance of the updated policy.

For any privacy-related questions, requests, or concerns:

Governed by the laws of the State of Delaware, except where mandatory consumer protections apply.

If you are an EU resident and believe your rights have not been respected, you have the right to lodge a complaint with your local data protection supervisory authority.

Read together with: Terms & Conditions, Informed Consent, and Storage Services Agreement.