Privacy Policy

1. Identity & Contact of Controller

The data controller for Systematic Review Tools (the "Service") is Evidentia Systems.

For any privacy-related inquiries, data access requests, or to exercise your rights, please contact us on the contact page.

2. Information We Collect

We collect personal data to provide and improve our systematic review tools. The categories of data we process include:

• Account Information: Name and email address provided during sign-up or sign-in (Google, GitHub, or email/password).
• Usage Data: Information about how you use our tools, preferences, and interaction with the platform.
• Uploaded Content: Documents or research data you upload for analysis. Deduplication files are not stored. Content you enter into signed-in dashboard tools may be stored as a workspace (see Tool workspaces).
• Tool workspaces: When you are signed in and account workspace sync is enabled, drafts from Research Gap Finder, Search Builder, the PRISMA checklist, the PRISMA flowchart, and the manuscript outline are stored in Cloud Firestore on Google's servers so you can resume those tools on another device. That includes the research question and search blocks, PRISMA checklist locations and flowchart counts, manuscript section text, and Research Gap Finder citations, classifications, and gap decisions. Original bibliography files uploaded to Deduplication are still processed in memory and discarded. Research Gap Finder may store parsed citation records (including titles and abstracts) from a file you imported into that tool.
• Communications: Any information you provide when contacting us for support or inquiries.

3. Purposes and Legal Bases for Processing

We process your data for the following purposes and under the corresponding legal bases:

• To provide the Service: Managing your account and delivering tool functionality (Legal basis: Performance of a contract).
• Service Improvements: Analyzing usage to refine features and user experience (Legal basis: Legitimate interest).
• Communications: Sending service updates, technical notices, or responding to support requests (Legal basis: Performance of a contract).
• Marketing & Assets: Sending newsletters or eBook downloads, if you have opted in (Legal basis: Consent).

4. Third-Party Services and Data Sharing

We use trusted third-party processors to help operate our Service:

• Firebase (Google): Authentication; Cloud Firestore for the search-block library, daily AI usage quotas/events, and signed-in tool workspaces. The browser also keeps a local copy of the current draft for speed. Deduplication uploads are not written to Firestore.
• Google Cloud Run: Temporary processing of bibliography files you upload for deduplication. Those files are not stored by the API after the result is returned.
• OpenAI: Used by signed-in AI tools (for example Search Builder, Search Translator, and Research Gap Finder) to process the text you submit.
• Google Analytics and Microsoft Clarity: Used to understand site usage and improve performance, subject to cookie consent where required.
• MailerLite: Used for managing email subscriptions and delivery of digital assets, if you opt in.
• Resend: Used to send transactional email such as welcome messages and form notifications.
• Google reCAPTCHA: Used to reduce abuse on public forms.

5. Data Retention Policy

We adhere to the principles of data minimization and storage limitation:

• Account Data: Retained as long as your account is active. If you delete your account, your personal data will be removed from our active systems.
• Uploaded Documents: Deduplication files are processed temporarily during your session and discarded immediately after processing. We do not retain those uploaded files.
• Tool workspaces: Kept until you clear that tool's workspace, delete your account, or request erasure. Clearing a workspace deletes the Firestore document for that tool. Account deletion deletes all of your tool workspace documents, then your Firebase Auth account.
• Marketing Data: Retained until you withdraw your consent or unsubscribe.

6. Your Rights Under GDPR

If you are located in the EU/EEA, you have the following rights:

• Access & Rectification: The right to request a copy of your data and correct inaccuracies.
• Erasure: The right to be forgotten and have your data deleted.
• Restriction & Objection: The right to limit or object to certain types of processing.
• Withdraw Consent: The right to withdraw consent at any time where processing is based on consent.

7. Cookies and Analytics

We use Google Analytics to collect usage statistics via cookies. These cookies help us understand how visitors interact with our site.

For users in the EU, we obtain consent for non-essential cookies. You can manage your cookie preferences or opt-out of tracking through your browser settings or our cookie consent banner.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information. This includes encryption in transit (SSL/TLS) and at rest, and restricting access to data to authorized personnel only.