Research Bin Privacy Policy
Last updated: [date]
1. Summary
- We collect what we need to run your account and the Service, and nothing else.
- Your research content belongs to you. We process it only to provide the Service, and we do not sell it or use it to train AI.
- AI features are off by default; when you turn them on, selected excerpts go to the AI provider listed below.
- You can export or delete your data at any time.
2. Who we are
Research Bin is operated by [legal entity name], [address] ("we", "us"). Contact: [privacy email]. [EU representative: name and address, if appointed.] [UK representative: name and address, if appointed.] [Data Protection Officer, if appointed.]
3. Two kinds of data, two roles
- Account data (your name, email, institution, settings, usage, support messages). We decide how this is used, so we are its controller.
- Research content (files, transcripts, excerpts, codes, memos, and any personal data about research participants inside them). You, or your institution, decide what this contains and why it is processed, so you are the controller and we act as your processor, following your instructions as set out in our Terms and [Data Processing Agreement]. If you are a researcher, you are responsible for having a lawful basis and any ethics approvals for participant data.
4. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, institution, role, password hash (held by our authentication provider), MFA settings | You |
| Research content | Uploaded files, extracted text, codes, memos, pseudonym tables, AI questions and your responses | You |
| Usage and device | Pages and features used, storage and AI usage counts, IP address, browser type, timestamps | Automatically |
| Security logs | Sign-ins, permission changes, exports, deletions (who and when, not content) | Automatically |
| Communications | Feedback, bug reports, support emails | You |
| Billing (future) | Plan, billing contact; card details are handled by our payment processor and never stored by us | You, payment processor |
We do not knowingly collect data from anyone under 18.
5. Why we use account data, and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Create and run your account, provide the Service | Performance of a contract |
| Keep the Service secure, prevent abuse, keep audit logs | Legitimate interests (security) |
| Enforce usage limits and plan the beta | Legitimate interests (operating the Service) |
| Send service and security emails | Performance of a contract |
| Send product news or surveys | Consent (you can opt out any time) |
| Comply with law, respond to lawful requests | Legal obligation |
6. AI processing
AI features are disabled for each project until the project owner turns them on and confirms a consent notice. When enabled, only the excerpts, codes and memos within the scope you select are sent, after replacing names in your project's pseudonym table. Requests go to [OpenAI, L.L.C.] via its API. [Confirm before publishing: the provider's current API terms state that API data is not used for training by default and is retained for up to 30 days for abuse monitoring unless Zero Data Retention applies; state the setting we actually have.] Generated questions are stored in your project. We do not store the full prompt unless you turn on debugging for a request.
7. Who we share data with
We share data only with service providers ("subprocessors") that help us run the Service, under contracts that limit their use of it, or when required by law. We do not sell personal data or share it for cross-context advertising.
| Subprocessor | Purpose | Location |
|---|---|---|
| [Supabase] | Database, authentication, file storage | [United States region] |
| [Vercel] | Website and application hosting | [Global edge; functions in United States] |
| [AI provider — OpenAI] | AI reflexive questions (only for opted-in projects) | [United States] |
| [Email provider — TBD] | Account and security emails | [TBD] |
| [Error monitoring — TBD] | Error reports, configured to exclude research content | [TBD] |
| [Job worker host — TBD] | Document text extraction and exports | [TBD] |
| [Stripe — future] | Payments | [United States] |
We will keep a current list at [researchbin.com/subprocessors] and notify account holders [30] days before adding a subprocessor that processes research content.
8. International transfers
We are based in [country] and store data in the [United States]. If you are in the EEA, UK or Switzerland, your data is transferred outside your region. We rely on [the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU-U.S. Data Privacy Framework where a recipient is certified — counsel to confirm]. You can request a copy of the relevant safeguards at [privacy email].
9. How long we keep data
| Data | Retention |
|---|---|
| Research content | Until you delete it; then removed from active systems after [30] days and from backups as they expire (currently [7] days) |
| Account data | While your account exists; deleted [14] days after account deletion, then from backups as they expire |
| Security and audit logs | [12 months] |
| Feedback and support messages | [24 months] or until you ask us to delete them |
| Billing records (future) | As long as tax law requires |
10. Security
We use encryption in transit (TLS) and our providers encrypt stored data at rest. Access to data is restricted by per-project permissions enforced in the database. Staff do not access research content except when you ask for support and grant access, or when required to investigate abuse or comply with law. No system is perfectly secure; if a breach affects your data we will notify you and, where required, regulators, without undue delay.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data; to object to or restrict certain processing; to withdraw consent; and to complain to your data-protection authority. Many of these are self-serve in Settings. Otherwise, email [privacy email]; we aim to respond within one month. If your personal data appears in a researcher's project (for example, as an interview participant), we will refer your request to that researcher, who controls that data, and assist them as their processor.
California residents: we do not sell or share personal information as those terms are defined in California law. [Counsel to add any required state-law disclosures.]
12. Cookies
The application uses only essential cookies needed to sign you in and keep your session secure. Our marketing site [uses no cookies / uses cookieless analytics — confirm]. If this changes we will ask for consent where required.
13. Changes to this policy
We will post updates here and, for material changes, notify you by email or in the app before they take effect.
14. Contact
[Legal entity name], [address] · [privacy email]