Privacy and data protection

What happens to your manuscript, step by step

1. You upload a .docx or .txt file. We extract the text and delete the original file as soon as the extraction finishes: the document as you uploaded it is never stored, only the text.
2. The extracted text is stored in our database, which is in Frankfurt, in the European Union. The database provider encrypts everything it holds, in transit (TLS) and at rest (AES-256). On top of that, we encrypt the text of your manuscript and the reports ourselves before saving them, with a key that is not kept in the database. Someone who got hold of the database alone, through a backup or a leaked credential, would find them unreadable. It does not protect against a compromise of our own servers, which need the key to read your text and diagnose it.
3. That text is sent to the OpenAI API to generate the diagnosis. We only call the standard chat completions endpoint, with no additional tools that persist data on their own, and asking explicitly that the call is not stored.
4. The diagnosis produced is stored against your project, protected by the same access controls: only you and the members of your group can see it.

What OpenAI guarantees about what it processes

The diagnosis is generated by an OpenAI model. What follows does not depend on any special agreement we negotiated. These are the default terms of their API:

• No model is trained on your data. This has been the API default since 1 March 2023: what is sent «is not used to train or improve OpenAI models», unless the customer expressly asks to share it, and we have not asked (OpenAI documentation).
• The call leaves no stored copy. On the endpoint we use, and because every call asks for it, OpenAI does not retain the request or the response as application state. The text only remains in their abuse monitoring logs, which are deleted within 30 days at most.
• Encrypted in transit and at rest (TLS 1.2+ and AES-256), with strict access controls (security and privacy at OpenAI).
• International transfer. OpenAI’s servers are in the United States. Their Data Processing Addendum establishes OpenAI as the data processor and covers transfers from the EEA under Standard Contractual Clauses.

What we keep, and for how long

• The text of your manuscript is deleted automatically 30 days after upload, whether or not the diagnosis ever completed. You do not have to ask. If you want it deleted sooner, write to us at [email protected] and we will remove it by hand.
• The diagnosis (the report and its points) stays for as long as the project exists: it is the product you are using. Deleting the project, or your account, deletes it. Each point keeps a short quote from your text and a comment. Those are stored without our extra layer of encryption, because the task list searches them; the database’s own encryption and the access controls cover them.
• Your account (your email address, your name if you gave one, and the group you belong to) stays until you delete it.
• Counters against abuse. To stop someone flooding a mailbox or the service, we count sign-in and upload attempts per email address and per IP address. Those counters are deleted within two days.
• Server logs never contain the text of a manuscript or an email address. Where a line has to refer to a person it uses an internal identifier or a short fingerprint of the address. That is a pseudonym, not anonymous data: someone who already knows an address could recognise its fingerprint.

Deleting your account removes our copy at once. It cannot remove what has already reached our providers: OpenAI keeps what it was sent for up to 30 days in its abuse logs, Resend keeps a record of the emails it delivered, and Stripe keeps the billing records the law requires of it.

Who else processes your data, and where

We do not sell your data and we do not share it for advertising. These are the companies that process it on our behalf, each under its own data processing agreement:

• SupabaseFrankfurt, European Union

  The database and the sign-in system.

• RailwayAmsterdam, European Union

  Runs the application and the process that produces the diagnosis.

• CloudflareGlobal network

  The network in front of the site. Every request passes through it, so it sees your IP address.

• OpenAIUnited States

  Generates the diagnosis from the text of your manuscript.

• ResendUnited States

  Sends our emails: sign-in codes, invitations and notices.

• StripeEuropean Union and United States

  Takes payments.

• Google AnalyticsUnited States

  Usage statistics, only if you accept them.

The providers in the United States receive data from the European Economic Area under Standard Contractual Clauses or an equivalent mechanism, as their agreements set out. Our emails carry your email address and, depending on the email, the name of your project or group. They never carry the content of the manuscript or of the report.

Payments

Payments are handled by Stripe. Your card details go straight from your browser to Stripe and never reach our servers. From Stripe we receive, and keep, which plan your group has, its billing period and whether the last payment went through, together with the identifiers Stripe uses for the customer and the subscription.

What you should not upload

Upload the manuscript only. If your study includes raw participant data (names, identifiers, transcripts with personal information), leave it out of the file. The diagnosis does not need it, and this keeps third parties’ personal data out of the system.

Analytics and cookies

We use Google Analytics to understand how the app is used, but only if you accept it explicitly in the notice you see the first time you visit the site. Without your acceptance, no Google script is loaded and no analytics cookie is set. You can change your mind at any time by deleting the ga-consent cookie from your browser, which makes the notice appear again.

The only other cookie is the one that keeps you signed in. The site does not work without it, so it does not ask.

Group invitations

If a principal investigator invites you to their group, we process your email to send you the invitation and, if you accept it, to manage your access to the group’s projects. If you do not accept it, we keep only the record of the invitation: the address it was sent to, who sent it and when. The invitation stops working after 14 days.

Why we are allowed to process your data

• To give you the service you ask for: your account, your manuscripts and their reports, the invitations and the emails that are part of it (Art. 6(1)(b) GDPR).
• With your consent: analytics, and nothing else (Art. 6(1)(a)). You can withdraw it whenever you want.
• Because the law requires it: the records of what has been billed (Art. 6(1)(c)).
• To keep the service safe: the counters against abuse and the server logs, which is a legitimate interest of ours (Art. 6(1)(f)).

Your rights, and how to reach us

You can delete your account and all associated data yourself, at any time, from Account inside the app.

You also have the right to see the data we hold about you, to have it corrected or deleted, to receive it in a portable format, to restrict how we use it and to object to that use. Write to [email protected] and we will answer within one month.

If you think we have handled your data wrongly, you can complain to the Spanish data protection authority, the AEPD.