Privacy Policy

Last updated: 15 October 2026

This Privacy Policy explains how the Scholaris Labs group collects, uses, shares and protects personal data when you use SciNodes, including:

• the websites at *.scinodes.com and any regional mirrors;
• the SciNodes app, SciVerse, Academy, Docs and Support;
• the related APIs and services (together, the "Service").

It also explains your rights and how to exercise them.

This policy is written to meet the requirements of:

• the UK GDPR and the Data Protection Act 2018;
• the EU General Data Protection Regulation ("GDPR");
• India's Digital Personal Data Protection Act, 2023, and the rules made under it (the "DPDP Act");
• the California Consumer Privacy Act, as amended by the CPRA (the "CCPA").

Region-specific information is in Section 12.

1. Who we are

The two companies process personal data for each other as processors where necessary to run the Service. Scholaris Labs UK Limited operates the global platform. Kopili Technologies Private Limited provides operations, support and billing in India.

Organisations. If you use the Service through an Organisation that has its own agreement with us, such as a university licence, that Organisation may be the controller of some of your data. In that case we act as its processor under our Data Processing Addendum, and you should direct requests about that data to the Organisation.

2. Personal data we collect

2.1 Data you give us

• Account data:

  • name and email address;
  • password, which is stored only as a hash by our authentication provider;
  • profile photo, if any;
  • preferences and settings.

• Sign-in through Google or Microsoft: if you use this, we receive your name, email address, profile photo and a unique account identifier from that provider.

• Your Content (as defined in the Terms of Use):

  • projects, corpora and folders;
  • uploaded PDFs and reference files;
  • notes, highlights, annotations and research objects;
  • chat messages, prompts and attachments sent to the AI research assistant, and the AI responses.

  Your Content may include personal data about other people, such as authors named in papers or participants described in research material.

• Collaborator data. When you share a project, you give us the collaborator's email address or user identifier and their role (editor or viewer).

• Billing data. Your plan, billing country, tax details, payment history and transaction identifiers. Stripe or Razorpay collects your card or payment details directly. We receive only limited details from them, such as card brand, the last four digits and the expiry date.

• Communications. Support requests, feedback, survey responses and any other correspondence with us.

2.2 Data we collect automatically

• Usage and metering data:
  • which features you open and use, for example daily counts of feature visits, opens and actions, derived from server requests;
  • AI token consumption against your weekly allowance;
  • storage used;
  • credit and usage ledgers;
  • project activity history (for example undo/redo events, with the user who made each change);
  • when you last interacted with publications in your projects.
• Technical and log data:
  • IP address, browser and device type, operating system;
  • request URLs, timestamps and error data, recorded in server logs.
• Cookies and local storage. These cover authentication, session and preference data. See our Cookie Policy. We do not use advertising cookies or third-party analytics trackers.

2.3 Data we infer or receive from others

• Institutional affiliation. We infer it from your email domain by matching it to the Research Organization Registry (ROR). You can correct or remove it.
• Payment processors. Stripe and Razorpay send us payment status, renewals, refunds and disputes.
• Organisations that license the Service for you may send us your name, email and role.

2.4 Researchers in our scholarly catalog

SciVerse and the SciNodes app show public bibliographic information about scholarly works and their authors. This includes:

• author names, ORCID identifiers, institutional affiliations;
• publication and citation records;
• derived network analyses, such as co-authorship maps.

This data comes from open scholarly sources, mainly OpenAlex (CC0), Crossref, ROR and DOI registration agencies, and is processed for research, scholarship and discovery. If you are an author and want to correct or object to the processing of your information, contact privacy@scinodes.com. Corrections to the source record, for example at OpenAlex or ORCID, will also flow through to us.

2.5 Data we do not intentionally collect

We do not intentionally collect special-category or sensitive personal data, such as health, ethnicity, religion, biometrics or sexual orientation. Please do not upload it unless you have a lawful basis and appropriate safeguards (see the Acceptable Use Policy).

3. How we use personal data and our lawful bases

UK and EU users: the table below shows the lawful basis we rely on under Article 6 of the GDPR and UK GDPR. Users in India: we process personal data based on your consent, given when you sign up and withdrawable at any time, or for a legitimate use permitted by Section 7 of the DPDP Act.

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for more information about that balancing, and you can object (see Section 11).

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. AI processing

4.1 Third-party model providers. When you use AI features, we send the relevant text to the model provider selected for the task, which is currently Anthropic, OpenAI, Google (Gemini) or Amazon Bedrock. That text may include your prompt, chat history, selected project context and extracted document text. The full list is in the Sub-processor List.

4.2 No training by providers. We use these providers under commercial API terms that prohibit them from using our customers' data to train their models. Providers may keep inputs and outputs for a limited time, typically up to 30 days, for abuse monitoring, as their terms allow.

4.3 Our own improvement and model development. We may use de-identified and aggregated data from your usage and content to improve and evaluate the Service and to develop our own models, including the Scholaris Labs "Chester" model. Before we use your data this way, we:

• remove direct identifiers, such as names, emails and account IDs;
• apply measures designed to stop the data being linked back to you or to an identifiable person.

Your choices:

• Opt out: you can switch this off at any time under Settings → Privacy → "Help improve SciNodes". Opting out applies to data collected after you change the setting.
• Under-18s: we never use content from users we know to be under 18 for this purpose.
• India: for users in India, we use data for this purpose only with consent, which you can withdraw in the same setting.

4.4 Shared caches. To avoid repeating work, we cache some derived outputs and may reuse them to serve other users. These include:

• text extracted from an identical file, recognised by a cryptographic hash of its contents;
• AI-generated definitions of scientific terms;
• translations of published works.

Cached entries are linked to the content, not to you. Other users cannot find out who uploaded a file, and your private notes, chats, annotations and projects are never cached for other users.

5. How we share personal data

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share personal data only:

• With our group companies. Scholaris Labs UK Limited and Kopili Technologies Private Limited share data to operate, support and bill the Service.
• With sub-processors that provide hosting, databases, storage, authentication, AI models, payments, backups and email delivery for us, under written contracts that require confidentiality and security. See the current Sub-processor List.
• With your collaborators. When you share a project, its members see its content and your name, email and profile photo. Activity history shows who made changes.
• With your Organisation, where it licenses the Service for you, as its agreement with us describes.
• For legal reasons. We share data to comply with law, regulation, legal process or an enforceable government request, or to protect the rights, property or safety of users, the public or the Scholaris Labs group.
• In a business transfer. We may share data as part of a merger, acquisition, financing or sale of assets. If that happens, this Policy, or a policy at least as protective, continues to apply to your data.
• With your consent or at your direction.

6. International transfers

Our primary infrastructure is in the European Union (AWS eu-north-1, Stockholm, Sweden). Our document database is in India (MongoDB Atlas on AWS ap-south-1, Mumbai). Some sub-processors, including our authentication, front-end hosting, payment and AI model providers, process data in the United States and other countries. See the Sub-processor List for locations.

When we transfer personal data out of the UK or EEA, we use the following safeguards:

• adequacy decisions, including between the UK and the EU, and for US recipients certified under the EU-US Data Privacy Framework and its UK Extension;
• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Addendum.

You can request a copy of the relevant safeguards from privacy@scinodes.com.

For users in India, we transfer personal data outside India in line with Section 16 of the DPDP Act, and not to any country or territory the Government of India has restricted.

7. How long we keep personal data

We keep personal data only as long as necessary for the purposes described in this Policy:

India. Where processing is based on consent, we erase personal data when you withdraw consent, or once the purpose is no longer being served, whichever comes first, unless the law requires us to keep it. If you have not engaged with the Service for the period prescribed under the DPDP Rules, we will notify you at least 48 hours before erasure.

8. Security

We protect personal data with technical and organisational measures, including:

• encryption in transit (TLS) and encryption at rest;
• authentication through an industry-standard identity provider;
• HTTP-only session cookies;
• role-based access controls with least-privilege access for staff;
• network isolation of databases;
• monitoring;
• regular backups.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant regulators as the law requires. Under the DPDP Act, we will notify the Data Protection Board of India and affected users of any breach.

9. Children

You must be at least 13 to use the Service.

• Under 18, or under the local age of digital consent: you need a parent or guardian's consent to use the Service.
• India: we obtain verifiable parental consent before processing personal data of anyone under 18.
• What we never do with children's data: for users we know to be under 18, we do not carry out tracking, behavioural monitoring or targeted advertising, and we do not use their content for model improvement.

If you believe a child under 13 has given us personal data, or that a minor is using the Service without the required consent, contact privacy@scinodes.com and we will delete the data.

10. Your choices

• Access, export and correction. You can view and correct your account data, and export your projects and content, from your account settings.
• Deletion. You can delete individual items, whole projects, or your entire account in your account settings.
• Model improvement. You can opt out of the use of de-identified data for model improvement (Section 4.3).
• Marketing. You can unsubscribe from optional emails using the link in each email. Service communications, such as security and billing notices, are not optional.
• Cookies. You can manage cookies and local storage through your browser. See the Cookie Policy.

11. Your rights

Depending on where you live, you may have the right to:

• access your personal data and get a copy;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to processing, including processing based on legitimate interests;
• data portability: receive your data in a structured, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out;
• complain to a regulator (see Section 12).

How to exercise your rights:

• Requests: use the in-product tools or email privacy@scinodes.com. Users in India can also contact the Grievance Officer.
• Verification: we may need to verify your identity before acting on a request.
• Response time: we respond within one month under the UK/EU GDPR (extendable by two months for complex requests), within 45 days under the CCPA, and within the period the DPDP Rules prescribe in India.
• Cost: exercising your rights is free, except where a request is manifestly unfounded or excessive.

12. Region-specific information

12.1 United Kingdom and European Economic Area

• Controller: Scholaris Labs UK Limited (Section 1).

• Supervisory authorities:

  • in the UK, the Information Commissioner's Office (ico.org.uk, 0303 123 1113);
  • in the EEA, the data protection authority of your member state of residence, work or alleged infringement.

  We would appreciate the chance to resolve your concern first.

12.2 India (DPDP Act, 2023)

• Data Fiduciary: Kopili Technologies Private Limited.
• Your rights as a Data Principal:
  • (a) obtain a summary of the personal data we process and the processing activities, and the identities of the other Data Fiduciaries and Data Processors we have shared it with;
  • (b) correct, complete, update and erase your personal data;
  • (c) grievance redressal;
  • (d) nominate another individual to exercise your rights if you die or become incapacitated.
• Consent: you may withdraw consent at any time, as easily as you gave it, through account settings or by contacting us. Withdrawing consent does not affect processing done before withdrawal, but we may no longer be able to provide some or all of the Service. Where available, you may also manage consent through a registered Consent Manager.
• Grievance Officer: grievance@scinodes.com, 179, Nahar Path, Saurav Nagar, Guwahati, Kamrup, Assam 781028, India. We will resolve grievances within the period prescribed under the DPDP Rules.
• Escalation: if your grievance is not resolved satisfactorily, you may complain to the Data Protection Board of India.
• Language: this notice is available in English. On request, we will provide it in any language listed in the Eighth Schedule to the Constitution of India.

12.3 United States: California (CCPA/CPRA)

This section applies to California residents to the extent the CCPA applies to us.

• Categories of personal information collected in the last 12 months:

  • identifiers (name, email, account ID, IP address);
  • customer records (billing information);
  • commercial information (plan and purchase history);
  • internet or network activity (usage and log data);
  • professional or education information (inferred institutional affiliation);
  • inferences (affiliation);
  • user content.

  The sources, purposes and recipients are described in Sections 2, 3 and 5. The retention periods are in Section 7.

• Sensitive personal information: we collect only account login credentials, and use them only to authenticate you. We do not use or disclose sensitive personal information for purposes that would trigger the right to limit.

• Sale and sharing: we have not sold or shared personal information, as those terms are defined in the CCPA, in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.

• Your rights:

  • to know or access, delete and correct personal information;
  • to know the categories of personal information disclosed for a business purpose (service providers, Section 5);
  • to non-discrimination for exercising your rights.

  You may use an authorised agent, and we may ask the agent for proof of authorisation. To exercise your rights, email privacy@scinodes.com.

• Global Privacy Control (GPC): we honour GPC signals as a valid opt-out request. Because we do not sell or share personal information, no further action is needed.

13. Changes to this Policy

We may update this Policy from time to time. If changes are material, we will notify you by email or in the Service at least 30 days before they take effect, and ask for fresh consent where the law requires it. The "Last updated" date at the top shows when this Policy last changed.

14. Contact us

• Privacy questions and requests: privacy@scinodes.com
• India Grievance Officer: grievance@scinodes.com
• Post:
  • Scholaris Labs UK Limited, 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE
  • Kopili Technologies Private Limited, 179, Nahar Path, Saurav Nagar, Guwahati, Kamrup, Assam 781028, India