Privacy Policy

1. Controller

ResearchCast GmbH, Angerstrasse 12, 85354 Freising, Germany, is the controller for ResearchCast personal data unless a separate notice says otherwise.

Privacy contact: support@research-cast.com. We have not appointed a Data Protection Officer.

You may lodge a complaint with a supervisory authority. The likely competent authority for our private-sector operations in Bavaria is Bayerisches Landesamt fuer Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

2. Data Categories

• Account and authentication data: email, provider, profile metadata, account timestamps, password hash where password auth is used, and session data.
• Product data: playlists, library, follows, preferences, audio settings, notifications, Research Profiles, source preferences, feedback, learning state, and generated content metadata.
• Content data: uploaded PDFs, submitted source URLs, prompts, generation requests, scripts, generated audio, titles, summaries, and source attribution.
• Billing data: Paddle customer and subscription IDs, plan, status, transactions, invoices, credit lots, refunds, tax/VAT metadata, and checkout legal acceptance metadata.
• Consent and legal records: cookie consent, marketing/email opt-ins, Terms/Privacy/withdrawal acceptance records, versions, timestamps, and evidence metadata.
• Contract-action data: cancellation and withdrawal declarations, name, account email, contract or transaction reference, requested date, receipt, processing status, and delivery metadata.
• Analytics and logs: optional PostHog analytics after consent, security logs, request metadata, rate-limit data, playback token events, email delivery events, and abuse-prevention signals.
• Notification data: email preferences and suppressions, in-app messages, Web Push endpoints and public encryption keys, delivery outcomes, and revocation timestamps.
• Reports and support: report forms, DSA notices, support emails, ticket IDs, reporter contact data, and moderation outcome records.

3. Purposes and Legal Bases

• Contract performance (Article 6(1)(b) GDPR): account creation and authentication, generation and playback, user-requested Research Profiles, libraries and playlists, subscription or credit access, customer support, cancellation, withdrawal, and other requested product features. Email, authentication credentials, and the content or source needed for a requested generation are required for those functions; without them we cannot provide the relevant function.
• Consent (Article 6(1)(a)): optional analytics storage and optional digest or marketing emails. These fields and choices are optional and can be withdrawn at any time. An early-performance request at checkout administers the service contract and statutory withdrawal rules; it is not GDPR consent.
• Legal obligation (Article 6(1)(c)): tax and accounting records, consumer-law information and confirmations, binding authority requests, sanctions checks where required, and legally required content-report handling.
• Legitimate interests (Article 6(1)(f)): security, fraud and abuse prevention, debugging, service reliability, product quality, source matching, pseudonymous legal-version evidence, moderation, and establishing or defending legal claims. We minimize identifiers, restrict access, apply retention limits, and honour a valid objection unless compelling grounds or legal claims require continued processing.

4. AI Processing

We use a billing-enabled Google Gemini API project to analyze papers, draft scripts, generate summaries, extract metadata, run grounded research discovery where enabled, and produce text-to-speech. We send only the content needed for the requested task and do not use your content to train ResearchCast models.

Under Google paid-service terms, Google does not use prompts or responses to improve its products. Google may retain limited prompts, responses, and technical data for abuse monitoring, safety, legal obligations, and optional developer logging. ResearchCast must not opt into sharing logs or datasets for model improvement without updating this notice and obtaining any required permission.

AI processing may involve source text, uploaded PDFs, research queries, prompts, and generated outputs. You can avoid this processing by not using generation and AI-assisted Research Profile features.

Visible AI-generated labels and origin metadata in supported M4A/WAV outputs provide a minimum provenance layer. They do not by themselves establish full compliance with the robust, machine-readable marking and detectability requirements of Article 50(2) of the EU AI Act. Additional technical compliance remains a separate, deadline-sensitive workstream.

5. Cookies and Analytics

Essential cookies and similar technologies are used for login, security, session continuity, consent storage, and service operation. Optional analytics is off by default and runs only after consent.

Server-side PostHog analytics is also consent-gated. Operational logs needed for security and reliability remain first-party and are minimized by retention controls.

6. Recipients and Transfers

We use processors for hosting, database/auth/storage, error monitoring, distributed abuse prevention, email, consented analytics, and model inference. Paddle acts primarily as an independent controller and merchant of record for purchases. Google OAuth, browser push providers, and parts of Google, Cloudflare, and payment processing may act under their own purposes and legal duties. See Service providers & data recipients for the purpose-specific classification.

Research discovery may also send a topic or search query and technical request metadata to scholarly/source services such as arXiv, OpenAlex, Crossref, Semantic Scholar, NCBI/PubMed, Europe PMC, bioRxiv, medRxiv, AlphaXiv, Hugging Face, and Google Search grounding when the relevant adapter is enabled. We do not intentionally send account names or email addresses with those queries.

Some providers may process data outside the EEA. Where required, we rely on EU Standard Contractual Clauses, data processing agreements, provider safeguards, and supplementary technical and organizational measures.

7. Retention

• Account/profile data: retained while the account exists, then deleted or minimized when the account is deleted unless a legal retention duty applies.
• Uploaded PDFs and private generated audio from uploads: deleted on account deletion and by upload retention jobs when no longer needed.
• Generated arXiv-derived metadata/audio: may be retained in anonymized or system-owned form when needed for service integrity, shared references, or other users who generated the same source.
• Billing and invoice data: retained as required by tax, accounting, chargeback, and merchant-of-record obligations.
• Consent and legal acceptance records: linked to the account while it exists; after account deletion the user link is removed and the minimized evidence record is retained for up to 2,190 days by default.
• Cancellation and withdrawal declarations, delivery receipts, processing status, and associated contact data: retained while unresolved and then for up to 2,190 days by default to perform the request and establish, exercise, or defend legal claims.
• Non-personal legal document archives containing the exact published text and cryptographic hash may be retained indefinitely so accepted versions remain provable.
• Operational defaults: cron logs 7 days; audio access-token and playback-token events 30 days; email webhook events 30 days; revoked push subscriptions 30 days; inactive email suppressions 365 days.
• Billing webhook events and closed legal/content reports: 730 days by default. Open reports remain until they are resolved and become eligible for cleanup.
• Completed or failed generation requests: 90 days by default. Research Profile creation traces, when explicitly enabled, are retained for 14 days by default.
• Provider-side retention also applies. In particular, paid Gemini API prompts and responses may be logged for limited abuse-monitoring, safety, and legal purposes under Google terms; optional developer logging or data sharing must remain disabled unless this notice is updated.

8. Export and Account Deletion

Authenticated users can export the account, profile, generation, Research Profile, billing-reference, notification, report, suppression, and legal-acceptance data currently linked to them from Settings. Cancellation and withdrawal receipts are supplied directly when submitted; contact us to request associated records. Provider-held payment documents may also need to be requested from Paddle.

Account deletion removes the Supabase Auth account, profile-owned records, uploads, private upload-derived audio, and owned private storage on a best-effort basis. Shared arXiv-derived metadata or audio may be reassigned to a system account so other users and shared references continue to work.

Billing evidence and legal acceptance records may be retained in hashed or minimized form when required for tax, accounting, chargebacks, consumer-law evidence, legal defense, or statutory limitation periods. Contact the privacy address if an export or deletion result appears incomplete.

9. Your GDPR Rights

• Access, rectification, deletion, restriction, portability, and objection.
• Withdraw consent at any time without affecting prior lawful processing.
• Object to processing based on legitimate interests on grounds relating to your situation.
• Complain to a data protection supervisory authority.
• Use in-product export/delete tools where available or contact us for requests.

10. Automated Decisions and Profiling

ResearchCast may use preferences, follows, Research Profile settings, recency, source metadata, and aggregate product signals to recommend papers or lists. We do not make automated decisions that produce legal or similarly significant effects about you.

11. Data Obtained from Public Scholarly Sources

ResearchCast obtains bibliographic and scholarly metadata from public or licensed sources such as arXiv, Crossref, OpenAlex, PubMed, Europe PMC, Semantic Scholar, bioRxiv, medRxiv, AlphaXiv, and source pages. This may include author names, affiliations, identifiers, abstracts, licences, links, and publication history. We use it to identify and describe research, create citations, avoid duplicates, and provide source-linked discovery and generation.

Where this information relates to an identifiable author, the source, categories, purposes, recipients, retention, and rights described in this Policy apply. ResearchCast does not use public scholarly authorship data to make legal or similarly significant decisions about an author.

12. Children

ResearchCast is not directed to minors. You must be at least 18 years old to create an account or use the Service.

13. Changes and Contact

We will publish a new version and effective date when this notice changes materially. Where a change meaningfully affects registered users, we provide a clear in-product or email notice before or when the change takes effect as required.

Privacy requests: support@research-cast.com. General support: support@research-cast.com.