Privacy notice

Last updated 1 September 2026

This notice covers the Salpa desktop application, Salpa Compute, and the salpa.app website. It is written to be read, and every statement in it is checked against what the software actually does.

Who is responsible

BoCo Research B.V., Leiden, the Netherlands (Chamber of Commerce / KvK 89932056), of which BoundaryComputing is a registered name. For anything in this notice, write to hello@salpa.app.

The short version

  • Salpa runs on your computer. Your workflows, data and results stay on your machine unless you deliberately run a cloud node.
  • Salpa Compute needs an account (Google or email). We keep your account details and a record of each cloud job — what ran, when, for how long, at what cost — but not the contents of your inputs or results.
  • Your job data is processed on GPU infrastructure run by Google Cloud (Belgium and the USA) and Modal (USA) for the duration of the job, and not kept by us.
  • The copilot is off by default and only sends anything anywhere if you turn it on and configure a model provider.
  • No analytics, no cookies — not in the app, not on this website. (Preview builds of the app up to 0.2.3 did report anonymous usage events; see below.)
  • We do not sell data, we show no advertising, and we do not use your content to train models.

The Salpa desktop application

Salpa is a desktop application. The workflow engine, the job queue and the worker all run locally; your projects, workflows, node inputs and results are stored in files and a local database on your computer, and the application’s own log files stay there too. We have no access to any of it.

The application does connect to the internet for a few specific things:

The application does not update itself and does not send crash reports. Downloads of the application itself come from GitHub Releases, so GitHub sees the download.

Salpa Compute

Your account

Salpa Compute lets you run selected heavy nodes on managed GPUs instead of your own machine. It requires an account, which you create in the app with an email address and password or with a Google account. Sign-in is handled by Firebase Authentication, a Google service: Google stores your email address, a password hash (we never see the password), or the identity Google provides for you (name, email address and profile picture), and sends verification and password-reset emails on our behalf.

The first time you run a cloud node we create an account record: your user ID, email address and display name, when the account was created, your plan and quota (during the Technical Preview: the free tier, one GPU-hour per month), and account settings. We may email you about your account or the service; we do not send marketing.

Each cloud job

For every cloud node you run we record:

We do not store your inputs or your results. The data a node sends — sequences, structures, ligands, parameters — travels from your app to our API gateway, on to the compute service, is processed in memory for the duration of the job, and the result is returned to your app. The infrastructure providers keep ordinary operational logs of requests for a limited time under their own terms.

Where this happens

So your account records stay in the EU, but the data you submit to a cloud node passes through the United States, and for Boltz-2 and Chai-1 is processed there. Google LLC is certified under the EU-U.S. Data Privacy Framework and processes data for us under the Google Cloud Data Processing Addendum; Modal processes data for us under its Data Processing Addendum, which incorporates the EU Standard Contractual Clauses. If you would rather your data not leave the EU, run the node locally instead — every cloud node is optional.

How long we keep it

Account and job records are kept for as long as your account exists. If you ask us to delete your account, we delete it and its records within 30 days, except what we must keep for accounting. There is not yet a self-service delete button — email hello@salpa.app from the address on the account.

The copilot

The app includes an assistant. It is off by default. If you enable it in Settings, your messages to it — together with the workflow or project you are looking at, which is the context it needs to help — are sent to the language-model provider configured in the app. In the Technical Preview the copilot only works with credentials you provide yourself; the supported providers are Google (Gemini via Vertex AI), OpenAI, Anthropic, and Ollama for a model running on your own machine. With Ollama, nothing leaves your computer. Whichever provider you choose, its own terms and privacy notice apply to what you send it.

The copilot’s memory of past interactions is stored in the app’s data folder on your computer, not with us.

The salpa.app website

salpa.app is a static site hosted by Google (Firebase Hosting), which processes the technical data of each request — such as your IP address and browser type — to serve and secure it. The site sets no cookies and runs no analytics (it used Google Analytics until 1 September 2026; that is gone). The documentation search runs entirely in your browser. There are no accounts and no forms on the site; if you email us, we keep the correspondence as long as we need it to handle the conversation, and we do not add you to any list.

Who processes data for us

Nobody else. We do not sell or rent data, and we do not share it for advertising.

Why we are allowed to

Under the GDPR we process account and job data to provide the service you signed up for (performance of a contract), and quota enforcement, abuse prevention and the technical data of requests on the basis of our legitimate interest in running a working, fair and secure service. Anything you send to a language-model provider through the copilot, you send by choosing to turn it on.

Your rights

You can ask what we hold about you, have it corrected or deleted, receive a copy, or object to its use. Email hello@salpa.app and we will act on it. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Age

Salpa Compute accounts are for people aged 16 and over.

Changes

When this notice changes, the date at the top changes with it, and the app’s “what’s new” feed says so. The current version is always at salpa.app/privacy.