Last Updated: Oct 7th, 2026
This Privacy Policy explains how SampleServe, Inc. (“SampleServe,” “we,” “us,” or “our”) collects, uses, shares, and keeps personal information when you visit sampleserve.com or use our products, services, and applications, including SampleENV, the Project Management tool, the Field App, the Lab App and SampleLOG, the Report Generator, and SampleH2O (together, the “Services”).
This Policy is written to meet U.S. state consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the EU and UK General Data Protection Regulation where they apply.
SampleServe, Inc.
12935 SW Bay Shore Dr., Suite 200
Traverse City, MI 49684
Privacy: privacy@sampleserve.com
Security: security@sampleserve.com
Phone: (231) 933-7035
Data Protection Officer: Mike Franklin, CTO, security@sampleserve.com
For our website, marketing, billing, and account management, SampleServe decides how personal information is used (we are the “controller”).
When an organization (a “Customer”) uses the Services to collect and manage sampling data, the Customer controls that data. SampleServe processes it for the Customer (we are a “processor” or “service provider”).
Requests about Customer data should go to the Customer's administrator. If we receive one, we will refer it to the Customer.
Name, email, phone, postal address, organization, job title, and account identifiers.
Subscription details, invoices, payment status, and billing contacts.
Card payments are handled by our payment processor. We do not store full card numbers.
Field records, sample data, notes, photos, videos, attachments, lab results, and related information uploaded to the Services.
When you sign a digital chain of custody (COC), the Field App records your signature, a photo of you (a selfie), the time, and your GPS location.
We use these only to record who transferred samples, when, and where.
We do not use COC photos for facial recognition, and we do not create biometric templates or identifiers from them. [Confirm.]
IP address, device identifiers, browser type, operating system, log data, access times, pages viewed, and how you use the Services.
Approximate location from your IP address, and precise GPS location only when you turn on location permission and use location features.
Support messages, chat transcripts, feedback, and related records.
We avoid collecting sensitive information unless a Customer sets up the Services to require it.
Many state laws treat precise geolocation as sensitive. We collect it only with device permission and, where required, your opt-in consent.
Our apps ask for these permissions only when a feature needs them. You can change them in your device settings; some features will not work without them.
PermissionWhat It's Used ForCameraSample and site photos, COC selfie, scanning QR labels and custody sealsLocationGPS stamp on samples and custody transfersBluetoothConnecting to label printersPhotos and filesAttaching existing images or documentsNotificationsSampling reminders, alerts, and COC status
Including account setup, sign-in, offline sync, customer support, and service messages.
Keep the Services secure through monitoring, logging, auditing, and misuse detection.
Improve the Services through debugging, performance monitoring, and product development, using usage and diagnostic data.
Handle billing and payments.
Send product updates and promotional messages, where allowed. You can opt out at any time.
Where turned on for your plan, the Services may suggest supplies, equipment, or services based only on non-personal project details, such as project type or equipment model.
We never use the contents of Customer data or personal information to choose what to show.
See Section 4.5 of our Terms of Service.
Some features of the Services use artificial intelligence (AI), such as [checking field data for errors, drafting report text, or answering support questions in chat].
We will describe AI features in the Services where they are offered.
If our website or support chat uses an AI assistant, it will say so.
Chat transcripts are handled as support communications under Section 4.7. You can always ask for a person.
If we add an AI feature that uses Customer content in a new way, we will update this Policy and notify account administrators before it becomes available.
Where GDPR applies, we process personal data because it is needed to provide the Services (contract), to meet tax and accounting duties (legal obligation), to secure and improve the Services in ways that respect your rights (legitimate interests), or because you agreed (consent), for example to non-essential cookies.
You can withdraw consent at any time. This does not affect earlier processing.
We use cookies that are strictly necessary to run and secure the website.
With your consent where required, we also use analytics cookies through [Google Tag Manager and Google Analytics].
Manage your choices at any time through “Cookie Preferences” in the footer.
We treat Global Privacy Control (GPC) and similar recognized signals as a request to opt out of sale, sharing, and targeted advertising for that browser, as required by California, Colorado, and other state laws.
Our website footer includes “Cookie Preferences,” “Privacy Choices,” and “Do Not Sell or Share My Personal Information.”
Hosting, storage, security, support, analytics, communications, AI, and payment vendors, bound by contract to use the information only to provide services to us.
See our subprocessor list.
Administrators and authorized users, based on the organization's settings.
Laboratories and integrations you or your organization direct us to share with, such as sending a digital COC to a lab.
We share information when the law requires it.
If we receive a subpoena or other legal demand for Customer data, we will refer the requester to the Customer and notify the Customer before responding, unless the law forbids notice.
To protect rights, safety, and the Services.
In a merger, acquisition, financing, reorganization, or sale of assets, with appropriate protections.
We do not share SampleServe Customer data with SampleCSI or SampleFire.
Our Services are designed for U.S. customers, and data is processed in the United States.
If you use the Services from outside the U.S., your information will be processed in the U.S.
Where GDPR applies to a transfer, we rely on safeguards such as the EU Standard Contractual Clauses and the UK Addendum, available on request.
We give the same rights to all U.S. residents, designed to meet the comprehensive state privacy laws, including those of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.
[Counsel to confirm the list at publication.]
Subject to exceptions in the law, you may:
SampleServe does not sell personal information and does not share it for targeted (cross-context behavioral) advertising.
We have not done so in the past 12 months.
We do not knowingly sell or use for targeted advertising the personal information of anyone under 18.
We do not use profiling that has legal or similarly significant effects.
If that changes, you will be able to question the result and ask for review, as Minnesota and similar laws require.
In the past 12 months, we collected the categories in Section 4 for the purposes in Section 7.
In the past 12 months, we disclosed those categories to the recipients in Section 11 for business purposes.
We use sensitive personal information only as needed to provide the Services or as the law otherwise allows.
California residents have the rights in Section 13, including to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information.
You can submit a privacy request through any of the following methods:
Include your name, email or account ID, state or country, the type of request, and enough detail for us to find your information.
We will confirm your identity before responding. We respond within the time the law requires, generally 45 days, with an extension where allowed.
You may use an authorized agent where the law allows; we will ask for proof of authorization.
Appeals. If we deny your request, you may appeal within 60 days by emailing privacy@sampleserve.com with the subject “Privacy Appeal.”
We will respond within the time the law requires.
We use administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and logging.
No system is completely secure.
Report security concerns to security@sampleserve.com.
If we learn of a breach affecting personal information, we will notify affected Customers and individuals as the law and our agreements require.
This Policy is available in other formats on request.
Contact support@sampleserve.com.
See our Accessibility page at sampleserve.com/accessibility.
The Services are for business use and are not directed to children under 13.
We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.
We may update this Policy. We will post the new version here and update the “Last Updated” date.
For material changes, we will notify account administrators in advance.
SampleServe, Inc.
12935 SW Bay Shore Dr., Suite 200
Traverse City, MI 49684
Email: privacy@sampleserve.com
Phone: (231) 933-7035
12935 S.West Bay Shore Dr., Suite 200
Traverse City, Michigan 49684