Skip to main content
Legal

Privacy Notice

Engineering review: 19 July 2026

Production publication blocker: this is an engineering transparency draft, not a legally approved privacy notice. The controller's legal identity, postal address, privacy contact, effective date, purpose-by-purpose lawful bases, processor roles, international-transfer safeguards, retention approvals, and jurisdiction-specific rights language must be completed and approved by the accountable Privacy/Legal owner (and the DPO where appointed or required) before production publication.

Who Is Responsible for Your Data

  • Controller legal name: [REQUIRED BEFORE PRODUCTION]
  • Registered or principal address: [REQUIRED BEFORE PRODUCTION]
  • Privacy contact / request channel: [REQUIRED BEFORE PRODUCTION]
  • Data Protection Officer contact, if applicable: [REQUIRES DPO DECISION]

These details are required for transparent communication under GDPR Articles 12–14. Product or brand names must not be substituted for the controller's verified legal identity.

Information the Service Handles

Depending on the features you use, the service handles:

  • account and profile data, such as name, email address, username, country, timezone, academic profile fields, and authentication/security records;
  • team membership, invitations, roles, workspace activity, research content, and support communications;
  • billing identity data, such as legal name, billing email and address, entity and tax-registration declarations, and masked Tax-ID metadata;
  • payment and invoice references used to reconcile Stripe billing. Card or bank credentials are collected and held by the payment provider, not copied into the application database;
  • consent and privacy-preference history;
  • service, device, session and security data, which can include IP address, user agent, access time, and bounded abuse-prevention signals; and
  • prompts, uploaded content and generated results when an AI feature is used.

Raw Tax-ID values are sent to Stripe from active request memory and are not stored in the application database, logs, queues, analytics, email, or ordinary export archives. A requester-specific Tax-ID access response is handled through the separate one-shot process described below.

Purposes and Lawful Bases

Engineering has identified the following processing purposes: account and service delivery, workspace collaboration, payment and tax administration, security and fraud prevention, support, optional communications, legal and financial recordkeeping, and user-requested privacy-rights handling.

The controller must approve and publish the applicable GDPR Article 6 lawful basis for each purpose, including any jurisdiction-specific legal obligation and any legitimate-interests assessment. Optional consent must be specific, recorded and as easy to withdraw as to give (GDPR Article 7). No unapproved lawful-basis mapping is asserted by this draft.

Recipients, Processors and Transfers

The implementation integrates with payment, transactional-email, database, object-storage and AI-inference providers. The customer-facing subprocessor list filters incomplete placeholder entries, but that technical filter is not a substitute for:

  • determining the controller/processor or independent-controller role for each processing purpose (GDPR Articles 4(7)–(8), 26 and 28);
  • maintaining the Record of Processing Activities (Article 30); or
  • documenting any third-country transfer mechanism and assessment (Articles 44–49).

The approved notice must identify the relevant recipient categories, roles, locations and safeguards before production publication.

Not every recipient is a processor. When you ask for an answer's sources, the public bibliographic registries described under "Conversations and Workspace Tiers" receive the cited identifiers as independent third parties: they are not our processors or sub-processors and do not appear in the sub-processor list.

Retention and Deletion

The application enforces several purpose-specific technical windows, including five-minute billing step-up evidence, ten-minute upgrade previews followed by a bounded terminal cleanup window, 24-hour portability download links, and a 30-day account-deletion restoration period. Raw Tax IDs returned through the one-shot access route have no server-retained response copy.

Other billing, invoice, audit, fraud and legal-hold records require an approved purpose-specific schedule. The engineering retention matrix identifies which windows are enforced and which remain production blockers. Data must not be kept indefinitely merely “for audit” or “for security” (GDPR Article 5(1)(e)).

Conversations and Workspace Tiers

Engineering draft for DPO review — [LEGAL REVIEW REQUIRED]. Numbers are deliberately not repeated here; the product shows the configured values next to each setting.

  • Personal workspace: the operator of this service is the controller of your conversations and uploaded files. You can export or delete them at any time.
  • Team and enterprise workspaces: the organization that owns the workspace is the controller of what its members create there; the operator of this service processes it as a processor on the organization's documented instructions (its Data Processing Agreement and the workspace's privacy settings).
  • No interactive owner, administrator or staff browsing: each member's conversations are private to that member. The service gives workspace owners and administrators, other members and our staff no way to browse or read them, and our support "sign in as user" function cannot open them.
  • Two narrowly defined exceptions: (1) when you make a verified access, portability or erasure request about your own conversations, we answer it directly — for a team workspace under the standing instruction in its Data Processing Agreement; (2) when a team or enterprise workspace closes, its owner's export contains members' conversations only if the owner enabled that option in advance, as the workspace's privacy page shows and the closure notice states.
  • Leaving a workspace: your conversations are sealed so that no one can read them in the service. If you rejoin within the window the workspace owner set, they are restored to you only; otherwise they are deleted. Nothing is transferred to another member.
  • Default inactivity retention: conversations that are not used for the retention period of the workspace are deleted. A workspace owner can choose a period within the bounds the product shows; a shorter period only applies after the notice period shown in the product.
  • Holds and pending requests: where the law or the workspace's documented instruction requires it, a legal hold suspends deletion for a stated matter until a review date; a pending data-protection request can also defer a deletion. A hold preserves data; it gives nobody access to it, and it does not change the default retention period.
  • Unsent drafts: a question you have typed but not sent stays only in your browser tab's session storage, kept separately for each conversation, member and workspace. It is removed when you send it, sign out, when your session ends or after a fixed period, and it is never sent to us until you send the question.
  • Run notifications: if you turn on browser notifications for finished research runs, your browser stores only that choice and when it expires (24 hours), for this workspace and account. A notification says only that a run has finished — never your question, a conversation title or the answer. You can turn them off at any time; the choice is also removed when you sign out or your session ends. Your browser's own permission setting is managed in the browser.
  • Files: attached files are removed from file storage shortly after their conversation is deleted, through a confirmed deletion process; until then they cannot be opened in the service.
  • Backups: deleted conversations remain in encrypted backups only until those backups expire; if a backup is ever restored, every deletion is re-applied before the data is used.
  • AI conversation titles: a short title can be generated from the first prompt of a conversation by an AI provider hosted in the European Union and listed among our sub-processors. If the provider is unavailable, the title is taken from the start of your first prompt.
  • Looking up cited sources: when you open an answer's Sources list or download its references, our servers look up the title, journal or sponsor and year of each publication or trial the answer cites. Only the public identifiers (PubMed IDs, DOIs and ClinicalTrials.gov numbers) and our own service contact address are sent — never your name, account, workspace, your question or the answer — to three public registries: NCBI PubMed and ClinicalTrials.gov (both run by the U.S. National Library of Medicine) and Crossref. They answer under their own terms and do not act for us. They are located outside the European Union; the safeguard that applies is [LEGAL REVIEW REQUIRED]. Nothing is looked up until you open the list or ask for a download, and we keep no record of which member looked up which source: our servers remember a publication's title for a few hours, unconnected to anyone. If a restriction of processing applies to your account, no lookup is made and each source still links to its record. Files you download are yours to keep or delete.
  • Sensitive information: the service is designed for research on scientific literature and is not intended for health or other special categories of data about identifiable people. Please do not enter them.

Platform Announcements and Direct Marketing

The service shows platform announcements — new features, workflows, service notices, and promotional offers — through a notification panel, a /whats-new reading page, and optionally by email.

Two distinct purposes, two distinct treatments. Each announcement carries a purpose value that determines how it is delivered:

  • Service announcements (maintenance windows, security notices, and contractual or operational changes) are operational messaging. The controller must approve and publish the applicable Article 6 basis per activity — typically 6(1)(b), 6(1)(c), or a documented 6(1)(f) assessment. They are sent as transactional email and are not suppressed by a marketing-consent check, because they are not marketing.
  • Marketing announcements (discounts, promotions, optional feature nudges) are direct marketing. In-app delivery relies on a documented Article 6(1)(f) legitimate interest, recorded in the written legitimate-interests assessment that ships with this feature. Marketing email additionally requires your Article 6(1)(a) consent, which is re-read at the moment of sending, not merely when the message was queued.

How announcements are targeted. Targeting uses three coarse axes evaluated against a single active workspace membership: the workspace kind (personal or team), your organization role (owner, admin, or member), and the workspace's plan tier. Announcements may additionally be limited to platform administrators. No announcement is targeted using the content of your research, your documents, your chats, or any behavioural profile.

What is recorded, and who sees it. When you open an announcement, the service stores a read receipt containing only the announcement identifier, your user identifier, and the time you read it (readAt). There is no click tracking, no IP address, and no user-agent in a receipt. Platform administrators see aggregate read counts per announcement — never the identity of who read what.

Retention. Read receipts are deleted 90 days after an announcement's expiry or archival, after which the administrator interface reports "retention elapsed" rather than a misleading zero. Archived announcements are retained for 24 months for accountability and then deleted together with any remaining receipts. Both periods are pending controller/DPO approval and are recorded in the Record of Processing Activities.

Recipients. Announcement email is delivered by Resend, acting as a processor under an Article 28 agreement. The reviewed processor terms, subprocessor register, actual processing locations, and — where processing occurs outside the EEA — the applicable Chapter V transfer mechanism and transfer-risk assessment are recorded in the Record of Processing Activities as deployment evidence.

Withdrawing email consent. Every marketing email carries a one-click unsubscribe (RFC 8058) and the same control is available in your account privacy settings. Withdrawal takes effect for every queued message that has not yet been sent.

Your separate, unconditional right to object (Article 21). Independently of email consent, you may object at any time to all direct-marketing processing, including targeted in-app announcements. Exercising this objection stops that processing; it is offered as a distinct control in your account privacy settings, and it is presented to you in the notification panel, on the /whats-new page, and in every marketing email. Unsubscribing from email does not create this objection, and withdrawing the objection does not re-grant email consent — they are different acts with different effects.

Records. Objection decisions are written to an append-only ledger alongside the current-state flag, so the two cannot diverge. Following the same reviewed treatment as the consent ledger, that table is protected by an append-only database trigger and data-access-layer discipline rather than row-level security; this is a recorded Articles 25/32 decision, not an omission. Your read receipts and your full objection history are included in your Article 15 access response, and both are deleted when your account is erased.

Partner and Referral Program

The service operates an affiliate partner program. This section concerns two groups of people.

If you signed up through a partner's referral link. When you arrive through a referral link and create an account or workspace, the service records a referral attribution: which partner referred you, the workspace type, and the attribution window dates. During that window, revenue derived from your qualifying paid subscription and extra usage is measured to calculate the partner's commission. The commission calculation uses aggregated financial amounts; the partner is never shown your name, email, or account contents — only coarse, aggregated signals (for example, the workspace type and joined month). The lawful basis engineering has identified for measuring this attribution is the legitimate interests of the controller and the partner in operating the referral program (GDPR Article 6(1)(f)), subject to the controller's approval and balancing assessment.

You can object at any time to further referral tracking of your account (GDPR Article 21). When you do, the service immediately stops referral processing for your account and severs the link between you and the referral record; the partner receives an automated notice that processing for the affected referral has stopped (GDPR Article 19). Retained referral rows are then held only as de-identified financial history. The objection control is available from your account privacy settings, alongside the other consent and privacy controls.

If you are a partner. To administer the program the service processes your partner display name, legal name, contact email, contract terms, status history, referral and commission ledger, and payout records. Payout destination details are stored in encrypted form and shown only in masked form in routine data exports; the full value is available only through a separate, verified, owner-only access path. Your own partner data (including the masked destination) is included when you request a data export.

If a partner invited you to their team. A partner can invite other people to view their own partner dashboard as read-only members. To send that invitation the service processes the email address the partner supplied, the invitation's partner, its timestamps, and the delivery status of the invitation email. The address comes from the partner who invited you, not from you — this section is the full version of the short notice included in that invitation email. The lawful basis engineering has identified is the legitimate interests of the controller and the partner in letting a partner delegate read-only access to their own dashboard (GDPR Article 6(1)(f)), subject to the controller's approval and balancing assessment. Accepting the invitation requires you to sign in with an account whose verified email address matches the invited address; the invitation itself never creates an account for you.

An unaccepted invitation and its link are deleted 7 days after sending. The delivery record of the invitation email is retained under the schedule in the "Retention and Deletion" section — approximately 30 days for a delivered or cancelled send, and up to 90 days where delivery failed or was indeterminate. You may object at any time (GDPR Article 21) to receiving further partner team invitations; on objection the service records a one-way pseudonym of your address — never the address itself — solely so that future invitations to it are blocked, and any invitation already queued to you is cancelled rather than sent. No decision producing legal or similarly significant effects is made about you solely by automated processing in this flow.

Recipients of partner-program personal data include the payment provider used to reconcile billing revenue and the transactional-email provider used to send program notices; the role, location and transfer safeguards for each are governed by the "Recipients, Processors and Transfers" section above.

Retention of partner-program records follows a dedicated storage-limitation schedule (PARTNER_RETENTION) that de-identifies referral rows a defined period after the attribution window closes and scrubs a terminated partner's identifying and payout data a defined period after the contract ends, subject to any active legal hold. The statutory retention periods must be approved by the accountable Privacy/Legal owner (and the DPO where appointed) before the program is enabled in production; until then no automated partner-record erasure schedule executes.

Your Rights

Subject to applicable law and any documented exception, you may have rights to:

  • access your personal data (Article 15);
  • correct inaccurate or incomplete data (Article 16);
  • request erasure (Article 17);
  • restrict processing (Article 18);
  • receive qualifying data in a portable format (Article 20);
  • object to certain processing (Article 21); and
  • receive safeguards concerning qualifying automated decisions (Article 22).

Requests must be handled transparently and normally answered within one month; the limited extension rules and notice requirements are in Article 12(3). Identity checks must be proportionate to the risk and must not collect excessive new information (Article 12(6)). The production request channel is an unresolved deployment blocker listed above.

The self-service portability archive is an Article 20-scoped package and is not represented as a complete Article 15 access response. Personal Tax-ID access is a distinct fresh-authenticated, rate-limited, one-shot download for a requester who can be mapped unambiguously to an eligible personal workspace. Team billing permission alone does not establish data-subject identity.

Security

The service uses tenant isolation, least-privilege access contexts, encryption for protected archives, pseudonymisation, redaction, action-bound step-up evidence, bounded recovery and audit controls. These measures support privacy by design and security obligations (GDPR Articles 25 and 32), but no system can guarantee absolute security.

Complaints

The approved notice must explain how to contact the controller or DPO and how to complain to the competent supervisory authority (GDPR Articles 13(2)(d) and 77). The competent authority must be selected from the controller's confirmed establishment and processing context; this draft does not guess it.