Privacy Policy

1. Information we collect

Information you provide

• Account information. When you register, we collect your name, email address, and (where applicable) organization. Authentication is handled by our identity provider, which manages your credentials.
• Content. The projects, lists, comments, grants, notes, and other information you create or upload to the Service.
• Member Data. Information you add about other people — researchers, group members, and collaborators — such as their names, email addresses, and affiliations. See “Member Data and other people’s information” below.
• Communications. If you contact us for support or otherwise, we keep a record of that correspondence.

Information we collect automatically

• Usage and log data. When you use the Service, we automatically collect information such as your IP address, browser and device type, pages and features accessed, and timestamps. We use this to operate, secure, and improve the Service.
• Cookies. We use cookies and similar technologies as described in “Cookies and tracking” below.

Information from other sources

• Researcher Data. The Service retrieves publication, citation, and grant records from third-party databases and publicly available sources, and matches them to the members you track.

2. How we use information

We use the information we collect to:

• provide, operate, maintain, and secure the Service, and authenticate you;
• retrieve and match publication and citation data to the members you track;
• send transactional messages — such as confirmations, citation notifications, and important notices — through our email provider;
• respond to your requests and provide support;
• monitor for, prevent, and address fraud, abuse, security incidents, and technical issues;
• understand how the Service is used so we can improve it; and
• comply with legal obligations and enforce our Terms of Service.

3. Member Data and other people’s information

When you add other people to the Service and enrich them with publication and citation data, you provide information about individuals who may not be users of MyResearchFocus. With respect to that Member Data, you (or your organization) are the controller and MyResearchFocus acts as a processor that handles Member Data on your instructions to provide the Service.

If you are an individual whose information appears in the Service because someone is tracking your research, the organization or user who added you is responsible for that data. Please direct access or deletion requests to them. You may also contact us at support [at] myresearchfocus [dot] com and we will forward your request to the relevant account or assist as appropriate.

4. How we share information

We share information only in the following circumstances:

• Service providers (subprocessors). With vendors that help us run the Service, under contracts that limit their use of the information to providing services to us. See the list below.
• At your direction. When you connect a third-party integration or otherwise ask us to share information.
• Legal and safety. When we believe disclosure is required by law or legal process, or is necessary to protect the rights, safety, or property of MyResearchFocus, our users, or the public. Our policy is not to respond to government requests for user data unless compelled by valid legal process.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you of any such change in control.
• Aggregated or de-identified data. We may share information that can no longer reasonably be used to identify you.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Subprocessors

We engage the service providers below to process personal information on our behalf, under contracts that limit their use of it to providing services to us. All of them process information in the United States.

We will update this list before engaging a new subprocessor, and customers with a data processing agreement will receive advance notice.

How we use AI providers. Every AI request we make is routed through the Vercel AI Gateway to a third-party model provider — for the AI assistant, for the extraction of researcher details from web search results, and for the narrative summaries on report pages. We send a provider only what is needed to answer the request in front of it, and every request carries an instruction not to retain the content once it has been answered and not to train on it. Those are routing conditions, not preferences: a provider that does not meet them is not used, and the request fails rather than being served on weaker terms. The providers reachable through the Gateway are listed at vercel.com/ai-gateway/models. We may change which model or provider we use, subject to the same conditions.

Our own use of AI assistant conversations is separate from this and is described in the AI Assistant Terms.

Not subprocessors. Stripe processes payments for us but acts as an independent controller of the payment information it collects, under its own privacy policy; we never receive or store your full card details. Public data sources we retrieve records from — such as PubMed and NIH RePORTER — are sources, not processors: we send them no personal information about you.

6. Cookies and tracking

We use cookies and similar technologies that are necessary to operate the Service — for example, to keep you signed in and to maintain your session and security. We also use analytics cookies from PostHog and Google Analytics to understand aggregate usage and improve the Service. We do not use cookies for third-party advertising. You can control or block cookies through your browser settings, though some features may not work without essential cookies.

7. Data retention

We retain your information for as long as your Account is active or as needed to provide the Service. When you delete Content or Member Data, it is removed from active systems within a reasonable period and purged from encrypted backups within 90 days. After you close your Account, we delete or de-identify your personal information within 90 days, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

8. How we secure your information

We take reasonable and appropriate measures to protect your information. Data is encrypted in transit using TLS, access to production systems is restricted, and we host with established infrastructure providers. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If you believe your Account has been compromised, contact us at support [at] myresearchfocus [dot] com.

9. Your rights and choices

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, or export it, and to object to or restrict certain processing. You can update much of your information directly in the Service, or contact us at support [at] myresearchfocus [dot] com to make a request. We may need to verify your identity before acting, and we will not discriminate against you for exercising your rights.

California residents. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). Where you provide Member Data, we act as a “service provider” and process it only on your behalf. You may exercise your California privacy rights using the contact details above.

Marketing. Any non-essential or marketing emails include an unsubscribe link; transactional messages necessary to operate the Service are not optional while you have an Account.

10. Children’s privacy

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at support [at] myresearchfocus [dot] com and we will delete it.

11. Where your information is stored

MyResearchFocus is operated from the United States, and the information we collect is stored and processed in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

12. Third-party links

The Service may contain links to third-party websites or services that we do not control. This Privacy Policy does not apply to them, and we encourage you to review their privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

14. Contact

Questions or requests about your privacy? Contact us at support [at] myresearchfocus [dot] com.