What happens to an application.
Version 2026-09-06. Application handling at /join. The authored site adds no analytics and uses no browser storage. Cloudflare Turnstile may use security cookies and browser signals when the application channel is open.
Who is responsible
I run Novel Biotech as an individual. There is no company. My full legal identity as the data controller has not yet been published. A postal contact address is also outstanding.
Privacy questions: anon5376@proton.me. Do not email applications while sending is closed.
What the form collects
- When sending is enabled, required fields are your email address, your answer, and confirmations that you are 18 or older, have read the Privacy Notice, and accept the Application Terms.
- Your name is optional.
- The application includes the notice version, a random application ID and a short-lived Turnstile token. Cloudflare checks the token, network address and browser signals to prevent abuse. The server also derives a temporary, one-way key from the network address to limit repeated attempts; the authored handler does not log the address or key or put either in the email.
No file upload, phone number, date of birth, advertising profile, browser storage, or automated scoring is part of the application. Draft text is not saved when the tab closes.
Why
The intended uses are to deliver an application to me, read it, reply if I choose to, prevent abuse, and meet legal duties. The application is not for advertising, model training, publication, or mailing lists. No decision about you is automated.
The legal basis has not been determined for the relevant operator and applicant jurisdictions. Sending opens only after that review.
Where it goes
Cloudflare operates the site’s DNS, proxy and hosting, so it necessarily receives ordinary request metadata such as network address, requested URL, headers and timing to deliver and protect each page. The authored site adds no visitor analytics or tracking script.
When enabled, your browser sends the form and anti-spam token to the site’s Cloudflare-hosted endpoint. After Cloudflare verifies the token, the endpoint asks Resend to send one plain-text email to my Proton Mail inbox. Cloudflare, Resend, Proton, and I may therefore process the data in our operating locations. A web form is not end-to-end encrypted mail.
The processor and cross-border arrangements have not been reviewed. No transfer safeguard or complete country list is claimed.
How long it is kept
A retention period and a working deletion procedure have not been agreed. Sending stays closed until responsibility, timing, mailbox deletion, provider backups, and any legal retention duties are settled.
Requests about access, correction, restriction, deletion, portability, or objection where applicable can go to anon5376@proton.me. I may need to confirm who is asking. Deletion cannot undo processing already completed lawfully.
The applicable supervisory authority and complaint route remain unresolved.
Do not send sensitive material
You must be at least 18. Do not include patient, medical, genetic, biometric, disability, family-history, identity-document, financial, third-party, trade-secret, export-controlled, or other confidential information. No attachments are accepted. A procedure for isolating and deleting unexpected sensitive material is required before sending opens.
Security and changes
The handler uses strict validation, a fixed recipient, same-origin checks, server-verified Turnstile, a temporary rate limit, provider idempotency, and server-only credentials. Production also needs transport encryption, reviewed access, and confirmed delivery. No system is perfectly secure.
An incident response and notification procedure has not been finalized. It must be reviewed before sending opens.
Material changes receive a new notice version, which must be acknowledged before sending. I have written this draft as the founder. It is not a claim of legal compliance.