Privacy Policy

This explains what personal data PaperVantage (operated by Daniel Furness) collects, why, and who it is shared with. We are the controller of this data under UK GDPR.

What we collect

• Account data: your email address and name, received from our sign-in provider (Amazon Cognito, including Google sign-in if you choose it).
• Content you provide: papers you upload or import, your library, projects, ratings and interests, and the questions you ask.
• Usage data: counts of MCP tool calls (to apply plan limits) and standard server logs needed to operate and secure the service. We also collect product analytics (page views and key actions such as searching or asking a question, tied to an opaque account identifier, never your email, questions or search terms). Our server separately records account events under the same identifier: signing up and how (Google or email), starting checkout, starting, cancelling (or undoing a cancellation) or ending a subscription, a failed or recovered payment, creating an API key, reaching a plan limit, and whether you used the site, an AI tool or the command line on a given day. Your plan and subscription status are stored with that identifier.
• Billing data: if you subscribe, Stripe collects your payment details and gives us a customer reference and subscription status. We do not receive or store your card number.

Why we use it

• To provide the service you asked for (contract).
• To take payment and manage your subscription (contract).
• To keep the service secure, prevent abuse and fix problems (legitimate interests).
• To understand how the product is used so we can improve it (legitimate interests).

Who processes it

• Amazon Web Services: hosting, storage, database and sign-in (Cognito); data is held in the UK (London) region.
• Amazon Bedrock: AI models that generate summaries and answers. Text from papers and your questions is sent to them for that purpose.
• Stripe: payment processing.
• OpenRouter (United States), which routes requests to AI model providers such as Anthropic: the AI assistant on a paper page (members only). The text of the paper, the passages you highlight, your messages to the assistant and what the assistant retrieves while answering are sent for that purpose. We ask providers not to retain or train on this data. Your name and email are not sent.
• The AI provider you choose, if you run the AI assistant on your own API key (members, optional): Anthropic, OpenAI, OpenRouter, Amazon Bedrock or OpenCode Go. Your answers then come from that provider instead of OpenRouter, and the same content (the paper text, highlighted passages, your messages and what the assistant retrieves) is sent to it under your own agreement with that provider, which governs how it handles the data. Our request not to retain or train on the data is only sent when your key is an OpenRouter key. Your name and email are not sent. We store the key encrypted with AWS Key Management Service; only the assistant service can decrypt it, and only while answering you. We keep its last four characters, the model you chose and an estimate of your spend to apply the limit you set. Removing the key in your account settings deletes it.
• OpenRouter, running a ranking model from TypeSafe (United States): ordering search results by relevance. When an AI assistant connected through MCP searches the paper library, the search query and the public-library passages being ranked are sent to that model. The text of your private uploads, your name and your email are not sent, but a search query is written by the assistant and can paraphrase what you have asked it about, including your own documents.
• PostHog: product analytics (see below). Analytics data is processed by PostHog in the European Union (PostHog EU Cloud).
• Public scholarly indexes (arXiv, Semantic Scholar): we look up paper metadata and citations; we do not send them your personal data.

We do not sell your personal data or use it for advertising.

Cookies and storage

We use only what is needed to keep you signed in (a secure authentication cookie) and to remember your theme preference. We do not use advertising cookies.

Product analytics (PostHog) stores an identifier in your browser's local storage or a first-party cookie. You can turn analytics off at any time below, or from your account page when signed in; the choice is remembered on that device. The account events listed above are recorded by our server to run the business (legitimate interest), so the switch below does not cover them.

Retention and your rights

We keep your data while your account exists. Billing records may be kept longer where the law requires. The AI assistant's conversations (your messages, its answers and what it looked up while answering) are kept for 30 days so it can follow a conversation, then deleted. Each project keeps a log of the changes made to it, by you or by AI tools, which you can see and export from the project page; it is deleted with the project. You can ask us to access, correct, export or delete your data, to restrict or object to processing, and to complain to the UK Information Commissioner's Office (ico.org.uk).

Contact

For any privacy request: danfurness@papervantage.com. See also our Terms of Service.