Privacy
Privacy notice
Last updated
Missing: the controller's name, the controller's address, a privacy contact address. Until they are published, this notice describes the processing as it is, but it does not name who is responsible for it, and its legal assessments have not been reviewed by the controller or a lawyer. Account holders can already file requests about their data from Settings.
Who is responsible for your data
The data controller — the person or organisation that decides why and how your personal data is processed — has not yet been named in this notice. No data protection officer is named in this notice.
What this notice covers
This notice covers the ResearchSpace website and its accounts. It does not cover the websites of arXiv, of the papers’ publishers, or of any service you choose to connect, which have their own notices. Access to the site is currently limited to people who have been given the site-access password.
What ResearchSpace does
ResearchSpace reads openly available scientific papers, mainly from arXiv, and publishes explanations of them, with each claim linked to the passages it rests on. The explanations are prepared with AI assistance; see AI-assisted processing and the AI transparency page.
With an account you can save and like papers, keep collections and notes, follow your reading progress, ask questions about a paper (when that feature is available), and report a post.
The personal data we process
If you have an account
- Account: email address, name and picture if given, role, and when the account was created. Accounts are created by the operator; there is no public sign-up.
- Sign-in credentials: your password, protected using security measures appropriate to its sensitivity. Where multi-factor authentication is used, additional authentication data (an authenticator secret and recovery codes) is processed and protected in the same way.
- Sessions: a protected reference to your session, when it was created and when it expires. No IP address and no browser details are stored with a session.
- Sign-in attempts: the email address typed at sign-in (whether or not an account exists for it), whether the attempt succeeded, and when.
- What you keep and do: likes, saves, collections, notes in a paper workspace, preferences, and reading progress (when you opened a paper, how far you scrolled, which slide you reached, whether you finished it).
- Questions about papers: the questions you ask in the paper chat, the answers, and technical records of how each answer was produced.
- Reports and requests: reports you file about a post and what you wrote; privacy requests you file and each step taken on them; if you claim authorship of a paper, the claim, a copy of your account email, any ORCID you give, and responses you publish as an author.
- Connected services and devices: if you connect your own Zotero library, your Zotero user name and a protected access credential; if a device is registered for notifications, its platform, app version and notification address.
If you only visit
Passing the site-access gate sets one cookie (see cookies). The current application does not store IP addresses in its persistent application database or in web access logs. Network information may be processed temporarily for security and to limit repeated attempts.
If you are named in a paper
Papers carry their authors’ names and affiliations, sometimes email addresses, and occasionally other personal data in their text. We hold the paper, its metadata and the explanations derived from it; see scientific papers.
If you work on ResearchSpace
Administrative actions (reviews, publications, decisions) record the administrator’s account identifier, so that each decision has a named author.
Where the data comes from
- From you, when you use your account.
- From the service itself: sessions, sign-in attempts, reading progress, and the records of what the system did.
- From public sources: papers and their metadata from arXiv and the ACL Anthology, bibliographic metadata about cited works from OpenAlex, and public repository metadata and READMEs from GitHub.
Why we process it, and on what legal basis
Purposes and legal bases (GDPR art. 6(1)) Purpose Data Legal basis Providing your account and its features Account, sessions, what you keep and do, questions Performance of the service you asked for (art. 6(1)(b)) Showing where you left off reading Reading progress Performance of the service (art. 6(1)(b)); you can ask us to stop (see your rights) Keeping accounts secure and limiting password guessing Sign-in attempts, sessions, temporary network information Legitimate interest in security (art. 6(1)(f)) Explaining scientific papers to readers Authors’ names and affiliations, paper text Legitimate interest in making published research understandable (art. 6(1)(f)); you can object Answering privacy requests and keeping a record of them Privacy requests and their steps Legal obligation (art. 6(1)(c), with arts. 12 and 15-22) Handling reports and rights notices Reports, notices, what was done Legitimate interest in correcting content (art. 6(1)(f)) Backups and restoring after a failure Everything above Legitimate interest in not losing data (art. 6(1)(f)) No processing relies on your consent, so there is no consent to withdraw. Where we rely on legitimate interest, the interest is the one named in the table: keeping the service secure, making published research understandable, correcting content, and not losing data. We do not sell personal data, show advertising, or build profiles of readers.
Do you have to give us your data?
No law requires you to give ResearchSpace any personal data. Some data is necessary to provide the service you ask for: without it, that part of the service cannot work. Everything else is optional.
Necessary and optional data Data Necessary or optional If you do not provide it Email address Necessary for an account: it identifies the account and is used to sign in No account can be created for you. You can still read published content after passing the site-access gate. Password Necessary to sign in You cannot sign in to the account. Authenticator (second factor) Necessary for administrator accounts only The administrative pages cannot be used. The site-access and sign-in cookies Necessary to pass the gate and to stay signed in The gate, or the sign-in, asks again on every page. Sign-in attempts and sessions Recorded automatically when you sign in, for security Signing in is not possible without them. For an authorship claim: the listed author name you claim Necessary to file a claim; a statement and an ORCID are optional The claim cannot be filed. For a correction, restriction or objection: what you ask, in your own words Necessary to file the request We cannot tell what you are asking for. We may also need more information to verify your identity. Name and picture, notes, collections, likes, saves, questions in the paper chat, reports, a connected Zotero library, a device for notifications Optional Only the feature that uses them is unavailable. Reading progress Recorded as you read while signed in You can ask us to stop (see your rights); the site will then not show where you left off. AI-assisted processing
ResearchSpace may use AI-assisted services for analysing papers, answering questions about them and preparing content. AI processing is subject to governance, privacy and security controls: an external AI or text-recognition (OCR) service may receive data only under an authorisation recorded for that service, purpose and kind of data.
Some claims undergo an additional AI check against the passages cited for them (shown as “Second AI model check”). It is an automated check, not peer review and not independent scientific verification; no claim has been independently verified by ResearchSpace. Each post says whether a person reviewed it before publication.
Earlier processing by external AI services, before these controls were in place, is described under earlier processing.
Scientific papers and the people named in them
The papers we read are published openly, mostly on arXiv and some on the ACL Anthology. We hold a copy of each paper, its metadata (title, authors, affiliations, identifiers) and the explanations derived from it, and we show the authors’ names on its post with a link to the original. We do this to make published research understandable to readers, on the basis of our legitimate interest (art. 6(1)(f)); the data comes from the public paper itself.
We also explain some public GitHub repositories. From GitHub we hold each repository’s public metadata, including its owner’s account name, and the explanation derived from its README; the README itself is read when an explanation is made and is not kept. We show the repository’s name and a link to it on its post, on the same basis of legitimate interest (art. 6(1)(f)).
We do not contact the people named in each paper individually: we often hold no contact details for them, and doing so for every paper would involve disproportionate effort. This notice, which is public, is how we inform them (GDPR art. 14(5)(b)).
If you are named in a paper, you have the rights described below, including the right to object. Reader reports and rights notices can withdraw a post. An author can also claim a paper from an account and publish a response beside it; responses never change the claim checks.
Who receives the data
- Hosting: the servers are provided by Hostinger, whose terms include a data processing addendum. Which Hostinger entity is the contracting party, and the data-centre location, have not yet been confirmed for this notice.
- arXiv, the ACL Anthology, OpenAlex and GitHub receive requests for papers, repositories and bibliographic metadata. These requests carry paper and repository identifiers, not information about readers.
- AI and OCR providers receive data only under an authorisation recorded for that provider, purpose and kind of data. The authorisations in effect now are listed below.
- Zotero, only if you connect your own library and save a paper to it: the paper’s bibliographic record and abstract go to your library. This feature is not currently available.
Provider approvals in effect Provider Service Data sent Processing region Transfer basis deepseek AI language model data derived from papers, for cisa_kev_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval deepseek AI language model data derived from papers, for github_readme_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval deepseek AI language model data derived from papers, for huggingface_card_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval deepseek AI language model data derived from papers, for nvd_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval deepseek AI language model the text of papers, for cisa_kev_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval deepseek AI language model the text of papers, for github_readme_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval deepseek AI language model the text of papers, for huggingface_card_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval deepseek AI language model the text of papers, for nvd_preview People's Republic of China (DeepSeek privacy policy: personal data is collected, processed and stored in the PRC) Recorded and verified in the approval The providers that received data in the past are named under earlier processing. We do not sell or rent personal data and we share it with no one else, except where the law obliges us to.
Transfers outside the European Economic Area
Data goes to an AI or OCR provider only under an authorisation that records the processing region and the transfer basis; see the table above. Hostinger’s data processing addendum provides for the European Commission’s standard contractual clauses where its own processing involves a transfer.
Before provider authorisations were enforced, paper texts and seven chat questions were transferred to DeepSeek, which states that it processes data in the People’s Republic of China, for which no adequacy decision exists; see earlier processing. No such transfer has taken place since 28 September 2026.
Earlier processing by external AI services
Before the current provider controls were introduced, paper content and a small number of chat inputs were processed by external AI services:
- the text of papers was sent to DeepSeek, to analyse and check it, between 7 August and 26 September 2026;
- paper files were sent to Mistral, for text recognition, between 7 August and 19 September 2026;
- between 12 and 28 September 2026, seven questions asked in the paper chat were sent to DeepSeek to produce answers.
DeepSeek states that it processes data in the People’s Republic of China, for which the European Commission has adopted no adequacy decision. That processing has stopped: nothing has been sent to any AI provider since 28 September 2026, and it is not part of the current service. Whether it requires further steps under data protection law is being assessed separately.
How the data is protected
ResearchSpace applies technical and organisational measures appropriate to the risks of the processing. These include access controls, authentication with multi-factor safeguards for administrators, protection of credentials, encrypted connections, separation of each account’s data, controls on what may be sent to external services, backup and recovery procedures, monitoring, and security testing before each release.
How long the data is kept
The table shows how long each kind of data is kept, as currently decided; it is read from our records when this page is shown. Retention of the categories marked “under review” is still being decided. Until a period is established, those categories are not subject to routine scheduled deletion: data stays until it is erased on request or withdrawn, or until a period is decided and announced here.
Retention periods Data Kept for Accounts, what readers keep (saves, likes, collections, notes, preferences), privacy requests, rights notices and reports Under review: not subject to routine scheduled deletion Backup copies of the service's data 30 days Paper records (titles, authors, affiliations, identifiers) and what was derived from them Under review: not subject to routine scheduled deletion Excerpts of papers prepared for answering questions Under review: not subject to routine scheduled deletion AI-assisted explanations of papers, their checks and their publication history Under review: not subject to routine scheduled deletion Records of review, publication and privacy decisions Under review: not subject to routine scheduled deletion Questions asked in the paper chat, the answers, and what was exchanged with AI services Under review: not subject to routine scheduled deletion Reading progress (when a paper was opened, how far it was read) and notification records Under review: not subject to routine scheduled deletion Sign-in attempts (the email typed, the outcome and the time), expired sessions and sign-in steps Under review: not subject to routine scheduled deletion Copies of papers and the text and images read from them Under review: not subject to routine scheduled deletion Technical records of how the service ran Under review: not subject to routine scheduled deletion In addition:
- a session stops working when it expires (see the lifetimes under cookies);
- when an erasure is carried out, the account’s data is removed at once, and the erasure is applied again if an earlier backup is ever restored;
- failed sign-in attempts for an email address are deleted when that account next signs in successfully;
- backups older than 30 days are deleted, unless a legal hold requires keeping them.
Your right to object
Where we process your personal data on the basis of our legitimate interests (GDPR art. 6(1)(f)), you have the right to object at any time, on grounds relating to your particular situation (art. 21). This concerns:
- keeping accounts secure (sign-in attempts and sessions);
- explaining scientific papers, including the names of the people who wrote them;
- handling reports and rights notices;
- backups.
When you object, we stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. ResearchSpace does not use personal data for direct marketing.
How to object. If you have an account, go to Settings, “Your data”, “Other requests about your data”, choose “Object to a use of my data”, and say which use you object to and why. We tell you the outcome within one month; Settings shows the due date.
If you do not have an account — for example if you are named in a paper — there is not yet a published address for objections. This notice will name one as soon as the controller’s contact details are published.
Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (art. 15);
- have inaccurate data corrected (art. 16);
- have your data erased (art. 17);
- restrict its processing (art. 18);
- receive it in a portable format (portability, art. 20);
- object to processing based on legitimate interest (art. 21; see your right to object);
- not be subject to a decision based solely on automated processing that significantly affects you (art. 22).
These rights have conditions and limits set by law. For example, erasure does not apply where the data is still needed to comply with a legal obligation or to establish or defend legal claims; portability covers the data you provided to us under your account; and an objection is upheld unless there are compelling legitimate grounds that override your interests. When we cannot grant a request in full, we say why.
How to exercise your rights
If you have an account, go to Settings, “Your data”:
- Download your data gives you, at once, a machine-readable copy of the data the account holds. Passwords and other credentials are left out.
- Ask to delete my account files an erasure request.
- Other requests about your data files a correction, restriction or objection in your own words.
No privacy contact address has been published yet. If you have an account, use Settings, which records your request. If you do not have an account, there is not yet a published way to reach us; this notice will name one as soon as it exists.
Exercising your rights is free of charge.
How we check it is you
For some requests, we may need additional information to verify your identity and protect against unauthorised disclosure. A request filed from Settings comes from your signed-in account; before an erasure, restriction or correction is carried out, we confirm that it comes from the account holder.
When you will get an answer
Within one month of receiving the request. Where a request is complex or there are many, the period can be extended by up to two further months; we will tell you within the first month, with the reasons. Settings shows the due date when you file a request.
Your right to complain
You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work, or where you think the infringement happened. In Italy this is the Garante per la protezione dei dati personali, www.garanteprivacy.it.
Automated decisions and profiling
ResearchSpace makes no decision about you based solely on automated processing, and does not profile readers. Its automated checks decide whether a piece of content may be published; they do not assess people. Reading progress is used only to show you your own progress.
Children
ResearchSpace is not directed at children, and accounts are created by the operator, not by public sign-up. If you believe a child’s data is held, use the channels in how to exercise your rights so that it can be erased.
If something goes wrong
If ResearchSpace becomes aware of a personal data breach, it assesses the incident and takes the measures required by law. Where notification to a supervisory authority is required, the GDPR generally requires notification without undue delay and, where feasible, within 72 hours after the controller becomes aware of the breach (art. 33). Where a breach is likely to result in a high risk to individuals, the people affected may also need to be informed (art. 34).
Changes to this notice
When the processing changes, this notice changes with it, and the date at the top changes. The authorised providers and the retention periods are read from our records each time this page is shown.
Effective date
This version was written on . It describes the current processing but is not final until the controller is named.
Contact
No privacy contact address has been published yet. If you have an account, use Settings, which records your request. If you do not have an account, there is not yet a published way to reach us; this notice will name one as soon as it exists.