1. Introduction

This EU Data Act Addendum ("Addendum") supplements and forms part of the Terms of Service between VerCan ApS ("we", "us", "the Company", "Vercan"), the operator of the Stranded platform ("the Service"), and the registered user ("you", "the User"). Capitalised terms not defined herein have the meaning given in the Terms of Service.

This Addendum applies to the extent the EU Data Act (Regulation (EU) 2023/2854) is applicable to the services provided by VerCan. Where this Addendum conflicts with the Terms of Service, this Addendum prevails only to the extent required by the EU Data Act; otherwise, the Terms of Service control.

2. Purpose

This Addendum implements the requirements of the EU Data Act regarding data portability, transparency, and data deletion. It clarifies your rights to access, export, and remove the scientific data you create or upload within Stranded, as well as our obligations in supporting those rights.

Note: This Addendum covers non-personal data — specifically scientific and biological datasets. Personal data is governed separately by our Privacy Policy (and, where applicable for organisation accounts, by our Data Processing Agreement).

3. Scope — What Data This Addendum Covers

The data subject to this Addendum is all user-generated scientific content stored within your Stranded account, including but not limited to:

This data is generally non-personal in nature and is subject to the data portability and access rights established by the EU Data Act.

Stranded is not intended for storing identifiable personal data inside scientific datasets, and our Use Restrictions prohibit uploading it. If you upload scientific content that constitutes personal data, GDPR obligations may apply in parallel.

4. Your Right to Export Data

4.1 Self-Service Export

Stranded provides built-in export functionality that allows you to download your scientific data at any time, without prior notice, directly from within the platform. You may export data in commonly used, machine-readable, and interoperable formats, including:

• FASTA (.fasta, .fa) — sequences
• FASTQ (.fasta, .fa) — sequences
• Newick (.nwk) — phylogenetic trees
• CSV — tabular data, metadata, and analysis results
• MarkDown — tabular data, metadata, and analysis results

4.2 No Switching Process Required

Unlike services that require advance notice or transitional periods before data can be retrieved, Stranded enables immediate, self-service export. You do not need to request a switching process, provide advance notice, or wait for a transitional period. Export is available as long as your account is active.

4.3 No Export Fees

No fees are charged for exporting your data, regardless of volume or frequency (within acceptable use).

5. Data Deletion

5.1 Instant Account Deletion

You may delete your account at any time through your account settings. Account deletion results in removal of:

• All personal data (as described in the Privacy Policy and, where applicable, the Data Processing Agreement).
• All scientific data, documents, projects, and associated files stored within your account.

5.2 Selective Deletion

You may also delete individual documents, folders, or projects at any time without deleting your entire account. Deleted items are removed from active systems promptly. Residual copies may persist in backups for a limited period as part of routine backup rotation.

5.3 Export Before Deletion

We strongly recommend exporting any data you wish to retain before deleting your account or individual items. Once deleted, data cannot be recovered.

For clarity: we do not provide a restoration service after deletion. Residual copies may persist in backups for a limited period as part of routine backup rotation.

6. Data Exclusions

The following categories of data are not included in user exports, as they are internal to the operation of the platform and may constitute trade secrets:

• Platform source code, algorithms, and proprietary analysis pipelines.
• Internal system logs and infrastructure telemetry.
• Aggregated, anonymised usage statistics.

These exclusions do not affect your ability to export the scientific data described in Section 3.

7. Your Obligations

• You are responsible for downloading and storing exported data in your own systems or those of a destination provider.
• You are responsible for ensuring that any data you upload or export complies with applicable laws, including any third-party intellectual property rights or data-sharing agreements.
• If data you upload incidentally contains personal information (e.g., patient identifiers in sequence headers), you remain the Data Controller for that content. See the Data Processing Agreement, Section 6.

8. Service Discontinuation

In the event that VerCan discontinues the Service or any material part of it, we will:

1. Notify all users at least 60 days in advance.
2. Maintain export functionality throughout the notice period.
3. Permanently delete all remaining user data after the notice period expires, unless applicable law requires otherwise.

9. Changes to This Addendum

We may update this Addendum to reflect changes in law or in our data handling practices. We will notify registered users of material changes by email or in-platform notification at least 14 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated Addendum.

This document should be read alongside the Terms of Service and Privacy Policy.

Stranded — Privacy Policy

1. Who We Are

Stranded is a web-based molecular biology platform operated by VerCan ApS ("we", "us", "the Company"). This Privacy Policy explains what information we collect, why we collect it, how we use it, and what choices you have.

When we say "Services", we mean app.strandedapp.eu and any product created and maintained by VerCan.

This Privacy Policy should be read alongside our Terms of Service, Data Processing Agreement, and EU Data Act Addendum.

2. What This Policy Covers (and What It Does Not)

This Privacy Policy covers the handling of personal data — information that relates to an identified or identifiable natural person, as defined by Article 4(1) GDPR.

Scientific data (sequences, alignments, assemblies, annotations, chromatograms, phylogenetic trees, and other biological datasets) is generally non-personal and is not the focus of this Privacy Policy.

However, whether data is personal data under GDPR depends on context and identifiability. Stranded is not intended for storing or processing identifiable personal data inside scientific datasets, and our Use Restrictions prohibit uploading it. If you upload scientific content that contains personal data (for example, names or identifiers in file metadata or headers), it may be treated as personal data.

Your rights regarding non-personal scientific data — including export, portability, and deletion — are described in our EU Data Act Addendum.

3. What Personal Data We Collect

We collect a minimal amount of personal data:

Log files may include your IP address, session identifiers, browser type, timestamps, and records of actions performed within the platform.

We do not collect:

• Payment or financial data (payments are handled by our Merchant of Record — see Section 8 and our Terms of Service.
• Special categories of personal data under Article 9 GDPR.
• Tracking cookies for advertising or third-party analytics.

4. How We Use Your Data

We do not send marketing, promotional, or newsletter emails. All email communications from Stranded are strictly transactional (for example: login verification, password resets, onboarding, and critical service notices).

We will never sell, rent, or trade your personal data to third parties for marketing or advertising.

5. How Long We Keep Your Data

You can delete your account at any time through your account settings. We delete data from active systems promptly. Residual copies may persist in backups for a limited period as part of routine backup rotation.

6. Where Your Data Is Stored

All personal data is stored and processed exclusively within data centres located in the European Union. We do not transfer personal data outside the European Economic Area. Should this ever change, we will update this policy.

7. Who Has Access to Your Data

Access to personal data is restricted to:

• You — through your account settings and profile.
• VerCan staff — only when strictly necessary, specifically:
  • To respond to a support request you have made (with your express consent).
  • To resolve a technical error that cannot be fixed without inspecting minimal account data.
  • To investigate a security incident or abuse report.

We do not provide any third party with direct access to your personal data except as described in Section 8.

8. Third-Party Service Providers

We use third-party vendors only for infrastructure (hosting, storage, and related compute). These providers process data solely on our instructions and are bound by data processing agreements that meet or exceed the protections described in our Data Processing Agreement.

A current list of sub-processors is available upon request.

8A. Merchant of Record (Payments)

Payments, invoicing, taxes (including VAT), and refunds are handled by our Merchant of Record (MoR) as described in our Terms of Service. The MoR will process personal data related to billing and payment as an independent controller under its own privacy policy. Stranded does not receive your full payment card details.

8B. Sharing and Public Links

Stranded may allow you to create share links (optionally protected with a password) to make specific content available to people you choose.

If you create a share link, you are instructing us to disclose the linked content to anyone who has the link (and password, if enabled). You are responsible for ensuring you have the rights and legal basis to share that content.

9. Cookies

Stranded uses only strictly necessary cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access (Art. 15) — Request a copy of the personal data we hold about you.
• Rectification (Art. 16) — Correct inaccurate data via your account settings.
• Erasure (Art. 17) — Delete your account and all personal data instantly via your account settings.
• Restriction (Art. 18) — Request restricted processing in certain circumstances.
• Portability (Art. 20) — Receive your personal data in a structured, machine-readable format.
• Objection (Art. 21) — Object to processing based on legitimate interests.
• Withdraw consent — Remove your avatar at any time; withdrawal does not affect prior lawful processing.

To exercise any right not available through your account settings, contact us at the address in Section 13.

11. Children

You must be at least 16 years of age to use Stranded. We do not knowingly collect personal data from anyone under 16. If we learn that we have collected data from a child under 16, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. We will notify you of material changes by email or in-platform notification at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.

13. Contact

For privacy-related questions or to exercise your data subject rights:

VerCan — Data Protection Contact Email: compliance@strandedapp.eu

If you believe we have not adequately addressed your concern, you have the right to lodge a complaint with the supervisory authority in your EU member state of residence.

This document should be read alongside the Terms of Service and EU Data Act Addendum.

Acknowledgment

VerCan policies are open source, licensed under CC BY 4.0. Adapted from the Basecamp open-source policies / CC BY 4.0.

Stranded - Terms of Service

From everyone at VerCan, thank you for using our products! We build them to help you do your best work. Because we don’t know every one of our customers personally, we have to put in place some Terms of Service to help keep the ship afloat.

When we say “Vercan”, “VerCan”, “Company”, “we”, “our”, or “us” in this document, we are referring to VerCan ApS (CVR: 46484509, Njalsgade 21F, 2. sal, 2300 København S).

When we say “Services”, we mean our websites, including app.strandedapp.eu, and any product created and maintained by VerCan. That includes Stranded (all versions) whether delivered within a web browser, desktop application, mobile application, or another format.

When we say “You” or “your”, we are referring to the people or organizations that own an account with one or more of our Services.

We may update these Terms of Service ("Terms") in the future. Typically these changes have been to clarify some of these terms by linking to an expanded related policy. Whenever we make a significant change to our policies, we will refresh the date at the top of this page and take any other appropriate steps to notify account holders.

When you use our Services, now or in the future, you are agreeing to the latest Terms. There may be times where we do not exercise or enforce a right or provision of the Terms; however, that does not mean we are waiving that right or provision. These Terms do contain a limitation of our liability.

If you violate any of the Terms, we may terminate your account.

Account Terms

1. You are responsible for maintaining the security of your account and password. The Company cannot and will not be liable for any loss or damage from your failure to comply with this security obligation. We recommend all users set up two-factor authentication for added security. In some of our Services, we may require it.
2. You may not use the Services for any purpose outlined in our Use Restrictions policy.
3. You are responsible for all data submitted to our Services.
4. You must be a human. Accounts registered by “bots” or other automated methods are not permitted.

Payment, Refunds, and Plan Changes

1. For paid Services that offer a free trial, we explain the length of trial when you sign up. After the trial period, you need to pay in advance to keep using the Service. If you do not pay, we will freeze your account and it will be inaccessible until you make payment. If your account has been frozen for a while, we may cancel it after providing reasonable notice.

2. All payments are processed by Paddle (https://www.paddle.com/), our Merchant of Record. Paddle acts as the authorized reseller of our paid Services and handles payment processing, invoicing, applicable taxes, chargebacks, and refunds. By purchasing our paid Services, you agree to Paddle's applicable checkout terms in addition to these Terms. Your payment relationship is with Paddle; your service relationship remains with VerCan.

3. Paid subscriptions are billed monthly and renew automatically each month until cancelled.

4. Account cancellation (ending your subscription) can be initiated at any time from within the Service. Cancelling stops future renewals but does not automatically refund past charges.

5. Refunds are handled under our Refund Policy and processed by Paddle where approved. If you experience any billing, cancellation, invoice, VAT, or refund issue, please contact us at compliance@strandedapp.eu.

Modifications to the Service and Prices

1. We reserve the right at any time to modify or discontinue, temporarily or permanently, any part of our Services with or without notice.
2. Sometimes we change the pricing structure for our products. When we do that, we tend to exempt existing customers from those changes. However, we may choose to change the prices for existing customers. If we do so, we will give at least 30 days notice and will notify you via the email address on record. We may also post a notice about changes on our websites or the affected Services themselves.

Uptime, Security, and Privacy

1. Your use of the Services is at your sole risk. We provide these Services on an “as is” and “as available” basis with all faults and defects. We do not offer service-level agreements

2. We reserve the right to temporarily disable your account if your usage significantly exceeds the average usage of other customers of the Services. Of course, we’ll reach out to the account owner before taking any action except in rare cases where the level of use may negatively impact the performance of the Service for other customers.

3. We take many measures to protect and secure your data through backups, redundancies, and encryption. We enforce encryption for data transmission from the public Internet.

4. When you use our Services, you entrust us with your data. You agree that VerCan may process your data as described in our Privacy Policy and for no other purpose. We as humans can access your data for the following reasons:

   1. To help you with support requests you make. We’ll ask for express consent before accessing your account.

   2. On the rare occasions when an error occurs that stops an automated process partway through. When we can fix the issue and restart automated processing without looking at any personal data, we do. In rare cases, we have to look at a minimum amount of personal data to fix the issue. In these rare cases, we aim to fix the root cause to prevent the errors from recurring.

   3. As part of safeguarding we’ll look at logs and metadata as part of our work to ensure the security of your data and the Services as a whole. If necessary, we may also access accounts as part of an abuse report investigation.

5. We use third party vendors and hosting partners to provide the necessary hardware, software, networking, storage, and related technology required to run the Services.

6. Some Services may allow you to create share links (optionally protected with a password) to content you choose. If you create a share link, you are responsible for deciding what to share and with whom. Treat share links and passwords as confidential; anyone who has them may be able to access the shared content.

Data Protection and Privacy

1. VerCan is a European company and processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national data protection laws. Our Privacy Policy explains what personal data we collect, how we use it, and your rights regarding that data.
2. Where you use our Services on behalf of an organization and that use involves the processing of personal data for which you are the data controller, VerCan acts as a data processor on your behalf. In such cases, our Data Processing Agreement ("DPA") applies and forms part of these Terms. By using the Services, you agree to the terms of the DPA where applicable.
3. You have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing activities, as described in our Privacy Policy. To exercise any of these rights, contact us at [support email].
4. We do not transfer personal data outside the European Economic Area unless adequate safeguards are in place as required by the GDPR, such as Standard Contractual Clauses. Details of any such transfers are described in our Privacy Policy.
5. You must be at least 16 years of age to use our Services. By using the Services, you represent that you meet this age requirement.

Copyright and Content Ownership

1. All data posted on the Services must be either your own property or data that you have the legal right to use. You may not upload sequence data, research materials, or other content that is subject to copyright, patent, or other intellectual property restrictions without obtaining appropriate permissions from the rights holder. You are solely responsible for ensuring you have the necessary rights to upload and use any data you submit.
2. You give us a limited license to use the data posted by you in order to provide the Services to you, but we claim no ownership rights over those materials. All materials you submit to the Services remain yours.
3. We do not pre-screen data, but we reserve the right (but not the obligation) in our sole discretion to refuse or remove any content that is available via the Service.
4. The Company or its licensors own all right, title, and interest in and to the Services, including all intellectual property rights therein, and you obtain no ownership rights in the Services as a result of your use. You may not duplicate, copy, or reuse any portion of the HTML, CSS, JavaScript, or visual design elements without express written permission from the Company. You must request permission to use the Company’s logos or any Service logos for promotional purposes.
5. You agree not to reproduce, duplicate, copy, sell, resell or exploit any portion of the Services, use of the Services, or access to the Services without the express written permission of the Company.

Features and Bugs

We design our Services with care, based on our own experience and the experiences of customers who share their time and feedback. However, there is no such thing as a service that pleases everybody. We make no guarantees that our Services will meet your specific requirements or expectations.

We also test all of our features extensively before shipping them. As with any software, our Services inevitably have some bugs. We track the bugs reported to us and work through priority ones, especially any related to security or privacy. Not all reported bugs will get fixed and we don’t guarantee completely error-free Services.

Liability

You expressly understand and agree that the Company shall not be liable, in law or in equity, to you or to any third party for any direct, indirect, incidental, lost profits, special, consequential, punitive or exemplary damages, including, but not limited to, damages for loss of profits, goodwill, use, data or other intangible losses (even if the Company has been advised of the possibility of such damages), resulting from: (i) the use or the inability to use the Services; (ii) the cost of procurement of substitute goods and services resulting from any goods, data, information or services purchased or obtained or messages received or transactions entered into through or from the Services; (iii) unauthorized access to or alteration of your transmissions or data; (iv) statements or conduct of any third party on the service; (v) or any other matter relating to these Terms or the Services, whether as a breach of contract, tort (including negligence whether active or passive), or any other theory of liability.

Nothing in these Terms excludes or limits liability to the extent such limitation is not permitted by applicable law (for example, liability for fraud, wilful misconduct, or mandatory statutory consumer rights).

Severability

If any provision of these Terms is found to be void or unenforceable because it violates mandatory law, VerCan may elect to amend that provision to the minimum extent necessary to make it valid and enforceable while maintaining the original intent and balance of these Terms as closely as possible. Such amendment shall take effect immediately when the original provision becomes void. If VerCan chooses not to amend the provision, it shall be severed, and the remainder of these Terms shall remain in effect.

Open Source Software

The Services may include or depend on open source software. Where applicable, the relevant open source licences apply to those components.

Governing Law

These Terms are governed by the laws of Denmark. Any disputes arising from these Terms or your use of the Services shall be submitted to the exclusive jurisdiction of the courts of Denmark. Nothing in these Terms affects your rights as a consumer under mandatory applicable law.

Acknowledgment

VerCan policies are open source, licensed under CC BY 4.0. Adapted from the Basecamp open-source policies / CC BY 4.0.

Use Restrictions

Restricted purposes

When you use any of VerCans’ Services, you acknowledge that you may not:

1. Collect or extract information and/or user data from accounts which do not belong to you.

2. Circumvent, disable, or otherwise interfere with security-related features of the Services.

3. Trick, defraud, or mislead us or other users, including but not limited to making false reports or impersonating another user.

4. Upload or transmit (or attempt to upload or to transmit) viruses or any type of malware, or information collection mechanism, including 1×1 pixels, web bugs, cookies, or other similar devices.

5. Interfere with, disrupt, or create an undue burden on the Services or the networks or the Services connected.

6. Harass, annoy, intimidate, or threaten others, or any of our employees engaged in providing any portion of the Services to you.

7. Disparage, tarnish, or otherwise harm, in our opinion, us and/or the Services.

8. Use the Services in a manner inconsistent with any applicable laws or regulations.

9. Process or upload sensitive personal information. Sensitive information includes, but is not limited to: Protected Health Information governed by privacy laws like HIPAA, personal identifiers such as Social Security Numbers or national ID numbers, financial account information, biometric data, human genetic data that relates to an identified or identifiable person, or other information subject to enhanced legal protection under regulations like the GDPR.

   For clarity: Stranded is intended for non-identifiable scientific data. Do not upload any personal data into scientific datasets (e.g., names, patient/sample identifiers that relate to people, or identifiable human genetic data).

Accounts found to be in violation of any of the above are subject to cancellation without prior notice.

Acknowledgment

VerCan policies are open source, licensed under CC BY 4.0. Adapted from the Basecamp open-source policies / CC BY 4.0.

Stranded - Refund Policy

Last updated: 15 June 2026

When we say "VerCan", "we", "our", or "us", we mean VerCan ApS. When we say "Services", we mean Stranded and the related services provided by VerCan.

This Refund Policy explains how cancellations and refunds work for paid Stranded subscriptions and purchases.

Merchant of Record

Payments for paid Services are processed by Paddle, our Merchant of Record. Paddle acts as the authorized reseller of our paid Services and handles payment processing, invoicing, applicable taxes, chargebacks, and the issuing of approved refunds.

Your service relationship remains with VerCan, but your payment relationship is with Paddle. Paddle may contact you about payment, tax, invoice, refund, or chargeback matters related to your purchase.

14-Day Refund Right

You may request a refund within 14 days of your first paid transaction for a new Stranded subscription or paid Service, you do not need to provide a reason for such a refund. We make this 14-day refund period available to all customers, regardless of where you live. For EU consumers, this reflects the usual 14-day withdrawal period for distance purchases.

If you started with a free trial, the 14-day refund period starts when your first paid charge is made, not when the free trial begins.

This 14-day refund right applies to the first paid transaction for a new subscription or paid Service.

Subscription Cancellations

You may cancel a subscription at any time from within the Service or by contacting us at compliance@strandedapp.eu.

Cancelling a subscription stops future renewals. If you cancel during the 14-day refund period and request a refund, we will approve a refund for the relevant first paid transaction. Outside that period, cancellation does not automatically refund charges that have already been paid.

How to Request a Refund

You can request a refund directly from your Stranded profile page, or through Paddle's self-service portal at paddle.com/help using your order details.

Alternatively, if you need help, contact us at compliance@strandedapp.eu with:

1. The email address used for the purchase.
2. The Paddle transaction or invoice reference, if available.
3. The type of refund request, for example a 14-day refund request, billing error, cancellation issue, or service access issue.

You do not need to give a reason when requesting a refund under the 14-day refund right. Including the transaction details helps us find the payment quickly.

We may ask for additional information if needed to verify the charge or understand a technical or billing issue. If we approve a refund, Paddle will process it back to the original payment method where possible. We aim to review refund requests within 5 business days. After Paddle processes a refund, the time it takes for funds to appear depends on Paddle, your payment provider, and your bank.

Mandatory Rights

Nothing in this Refund Policy limits any mandatory rights you may have under applicable law, including mandatory consumer rights.