Legal · Privacy
Privacy Policy
How Ligand-X Inc. handles personal data on this website and in the Ligand-X application. Effective 11 August 2026.
The short version
This website has no analytics, no advertising, no tracking pixels, and no tracking cookies. We do not build a profile of you, and we do not sell or share personal data. The only personal data we collect is what you type into the license request form. The Ligand-X application itself sends us nothing: your structures, jobs, and results stay on hardware you control. The sections below say the same thing precisely, and describe your rights.
Who is responsible
Ligand-X Inc. (“Ligand-X”, “we”, “us”) is a New York corporation and is the controller of personal data described in this policy. Ligand-X Inc., a New York corporation. Registered office address available on request at support@ligand-x.com. For any privacy question or request, contact support@ligand-x.com.
What we collect
We collect personal data in one place only: the license request form at /contact/. When you submit it, we receive: your first and last name your work email address your organization (lab, university, or company) the request type you selected anything you write in the message field We also receive standard server logs from our hosting provider, which include IP addresses, as an unavoidable part of serving a web page. We do not use those logs to identify or profile visitors. If you email us directly, we hold that correspondence for as long as it takes to answer you and to keep a record of any licensing agreement.
Why we are allowed to hold it
Under the EU and UK GDPR, we rely on the following lawful bases: Steps taken at your request before entering into a contract (Art. 6(1)(b)) — where you ask us for an academic or commercial licence. Our legitimate interests (Art. 6(1)(f)) — answering general enquiries about the software, and keeping our own records of who we have licensed. We have weighed this against your interests; the data involved is business contact data you chose to send us. Compliance with a legal obligation (Art. 6(1)(c)) — where tax, accounting, or export-control rules require us to keep records of a transaction. We do not rely on consent for any of the above, and we do not use your data for automated decision-making or profiling.
Who else sees it
We keep the list of third parties as short as we can. Today it is: FormSubmit — delivers the license request form to our inbox. Your form contents pass through their servers (United States). We do not use their analytics or tracking features. Our email provider — receives and stores the resulting message. GitHub — hosts this website and the application downloads. GitHub records standard server and download logs, including IP addresses, under its own privacy statement. That is the complete list. This site loads no fonts, scripts, or other assets from third-party servers, so simply reading these pages does not disclose your IP address to anyone but our host. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not disclose it to anyone else except where the law requires it.
Cookies, storage, and tracking
This website sets no cookies of any kind. The only thing stored in your browser is a single localStorage entry, ligandx-theme, which remembers whether you chose light or dark mode. It is strictly functional, contains no identifier, is never transmitted to us, and disappears when you clear site data. Because it is strictly necessary to provide the feature you asked for, it does not require consent under the ePrivacy Directive or the UK PECR — which is why this site has no cookie banner. Its absence is deliberate, not an oversight. We run no analytics product, no heat-mapping, no session recording, no advertising or retargeting tags, and no social media pixels.
The Ligand-X application
Ligand-X is self-hosted software that runs on your own machine or infrastructure. This is the core of the product and it is also the core of its privacy posture. Your protein structures, compounds, projects, job inputs, calculation results, and trajectories are written to storage you control. They are never transmitted to us. We have no ability to read them, and there is no account system, no cloud sync, and no usage telemetry in the application. Licensed features are unlocked by a cryptographically signed licence file stored on your own machine and verified locally against a public key that ships with the software. Verification is entirely offline: running a licensed Ligand-X installation involves no contact with our servers. The application does make a small number of clearly bounded outbound connections, all to third parties rather than to us: GitHub — to check for launcher updates and to download the runtime package. Container registries — to pull the software images your installation runs. Zenodo — only when you fetch a public dataset record through the application. Cloudflare — only if you deliberately enable the optional remote-access tunnel. Doing so exposes your installation over the network; consider carefully who can reach it. Each of those parties will see your IP address in the course of serving the request, under their own privacy terms. None of them tells us anything about you.
Future licence activation service
We are building a hosted licence activation service. It is not in operation today: no version of Ligand-X currently contacts it, and no data has been collected through it. We are telling you about it now so the change is not a surprise. When it is activated, and only for installations that use it, it will process a machine identifier, hostname, and platform name to bind a licence to the machines it was issued for, together with periodic check-ins recording that the licence is still in use and which version is installed. The lawful basis will be performance of the licence contract, the purpose will be limited to licence enforcement and support, and the data will be deleted when the licence ends. We will update this policy and the effective date before that service processes any data, and we will not repurpose it for analytics.
How long we keep it
Licence enquiries that do not lead to an agreement: up to 24 months, so we can pick up a conversation you return to, then deleted. Records relating to an issued licence: for the life of the licence and for as long afterwards as tax, accounting, and export-control record-keeping rules require. Server and download logs: for the retention period of our hosting provider; we do not maintain our own copy.
Your rights
If the EU or UK GDPR applies to you, you have the right to ask us for a copy of your personal data, to correct it, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds not to. Write to support@ligand-x.com and we will respond within one month. We will not charge you or make you justify the request. You also have the right to complain to your national data protection authority — in the UK, the Information Commissioner's Office. We would appreciate the chance to put things right first.
International transfers
Ligand-X Inc. is based in New York, USA, and the service providers listed above are US-based. If you contact us from the EU, the UK, or elsewhere, your enquiry will be transferred to and stored in the United States. Where such a transfer requires a safeguard under the GDPR, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the providers concerned. You can ask us for details of the safeguards that apply.
Security
We apply administrative, technical, and physical safeguards appropriate to the small amount of personal data we hold, as required of a New York business under the SHIELD Act, including access control on the mailbox that receives licence requests and encryption in transit. No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authorities as the law requires. If you believe you have found a security problem in this website or in Ligand-X, please report it to support@ligand-x.com before disclosing it publicly. We will not pursue good-faith security research.
Children
Ligand-X is a professional and academic research tool. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.
California and other US state rights
If you are a California resident, you may request access to, correction of, or deletion of the personal information we hold about you, and you may ask what categories we have collected and disclosed. The only category we collect is identifiers and professional information you provide in the licence request form, collected for the business purpose of responding to it. We have not sold personal information and have not shared it for cross-context behavioural advertising in the preceding twelve months, and we do not do so now. We will not discriminate against you for exercising any of these rights. Residents of other US states with comparable privacy laws may exercise equivalent rights. Use the same address: support@ligand-x.com.
Changes to this policy
If we change how we handle personal data, we will update this page and the effective date at the top. For a material change — in particular, activating the licence service described above — we will make the change clear rather than relying on you to re-read the page.