Privacy policy

This Privacy policy describes how InklyResearch (“we”, “us”, or “our”) collects, uses, shares, and protects personal information when you use our research writing Service at inklyresearch.com and related sites, apps, and communications (collectively, the “Service”).

By using the Service, you agree to this Privacy policy. If you do not agree, do not use the Service. This policy should be read together with our Terms of use and Cookie policy.

This policy applies to visitors, account holders, collaborators invited into projects or Labs, and anyone who contacts us about the Service. If you use the Service on behalf of an institution or lab, personal information about you and other users may also be subject to that organization’s policies.

We collect information in the following categories.

Account and profile information you provide when you sign up or manage your account: name, email address, hashed password, email verification status, and the time you accepted our Terms and this Privacy policy. We also store password-reset and email-verification tokens (hashed) until they expire or are used.

Customer content you create or upload in the Service: manuscripts, datasets, analyses, figures, equations, citations, variables, uploaded files, comments, version history, export outputs, and similar research materials (“Your Content”).

Collaboration and sharing data: project and Lab membership, roles, invite emails and tokens, and access-request details when you share a project or Lab.

Billing and subscription data: plan selection, subscription status, billing interval, and Stripe customer or subscription identifiers. Payment card numbers and full payment credentials are processed by Stripe and are not stored on our servers.

Communications: if you email us or use the contact form, your message is sent via email to our support address. We do not store contact-form submissions in the Service database, but email providers may retain messages in the normal course of email delivery.

Technical and usage data: our hosting and infrastructure providers may automatically process request metadata such as IP address, browser or device type (user agent), approximate location derived from IP, timestamps, and diagnostic logs needed to secure and operate the Service.

Preferences and cookies: theme and cookie-consent choices stored in your browser (typically local storage), plus the authentication session cookie that keeps you signed in. See our Cookie policy for details.

We use personal information to:

• Provide, operate, and maintain the Service, including accounts, projects, the manuscript editor, data tools, citations, exports, and related features.
• Store and process Your Content so linked tables, figures, statistics, and citations can update as you work.
• Enable collaboration when you invite others into a project or Lab, including sending invite and access-request emails.
• Send transactional email such as verification, password reset, invites, and billing notices.
• Process subscriptions, renewals, plan changes, invoices, and cancellations through Stripe when you purchase a paid plan.
• Secure the Service, prevent fraud and abuse, diagnose outages, and improve reliability.
• Respond to support requests and other communications you send.
• Comply with legal obligations and enforce our Terms of use.

We do not sell your personal information. We do not use Your Content to train public AI models, and we do not send Your Content to third-party AI providers for model training.

Where applicable law requires a legal basis (for example, the GDPR), we process personal information on one or more of the following bases:

• Contract: to provide the Service you requested and perform our agreement with you.
• Legitimate interests: to secure, maintain, and improve the Service, prevent abuse, and communicate about product operations, in ways that do not override your rights.
• Consent: where we ask for it (for example, optional cookies), and you may withdraw consent at any time.
• Legal obligation: when we must retain or disclose information to comply with law.

We do not sell personal information. We share information only as described below.

Service providers (processors)

We use vendors that process data on our behalf to run the Service. These providers are authorized to use personal information only as needed to perform services for us, subject to contractual and security obligations. Categories include:

• Cloud hosting and application infrastructure (currently Vercel) for hosting, scheduled jobs, and related platform services.
• Database hosting (currently Neon) for production Postgres storage of account and project data.
• File / object storage (currently Vercel Blob or another S3-compatible provider, depending on environment) for uploaded files.
• Payment processing (Stripe) for subscriptions, invoices, and the customer billing portal. Stripe processes payment details under its own terms and privacy policy.
• Transactional email delivery (currently Resend) for verification, password reset, invites, and billing notices.
• Real-time collaboration infrastructure (currently Fly.io) for the optional live collaboration server (Hocuspocus / Yjs) when real-time co-editing is enabled. Live editing state may transit that server in memory; saved manuscript data remains in our database.

We may change providers over time. When we do, we will update this policy if material changes affect how personal information is handled.

Collaborators you invite

If you invite others into a project or Lab, they can access project content according to the role you grant. You are responsible for inviting only people who are allowed to see that research material under your institutional or ethical rules.

Legal and safety

We may disclose information if required by law, legal process, or government request, or to protect the rights, safety, and security of InklyResearch, our users, or others, including investigating fraud or abuse.

Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction, subject to customary confidentiality and this policy’s protections where applicable.

We use cookies and similar browser storage as described in our Cookie policy. Essential session cookies support sign-in. Theme and consent preferences are stored in your browser. Optional analytics cookies are used only if we enable them and you allow them.

We keep account and project data while your account is active. You may delete individual projects and research items in the product. Some uploaded files may be soft-deleted briefly before permanent removal.

You may request deletion of your account and associated project data by contacting shachakr@gmail.com. We will process reasonable requests within a commercially reasonable time, subject to backups, legal holds, and records we must keep (for example billing identifiers needed for accounting or tax).

Billing records retained by Stripe follow Stripe’s retention practices and applicable tax or accounting rules. Security and platform logs may be kept for a limited period needed for security, debugging, and operations.

We use administrative, technical, and organizational measures designed to protect personal information, including encrypted transport (HTTPS), hashed passwords, private file access controls, and authenticated APIs. No method of transmission or storage is completely secure. Protect your login credentials and any sensitive research data accordingly.

We may process and store personal information in the United States and other countries where we or our service providers operate. Those countries may have data-protection laws different from those in your jurisdiction. Where required, we rely on appropriate transfer mechanisms offered by our providers (such as standard contractual clauses) or other lawful bases.

If international processing is not acceptable for particular research data, do not upload that data to the Service.

Depending on where you live, you may have rights regarding your personal information, which may include the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Delete personal information, subject to legal exceptions
• Export or receive a copy of certain personal information
• Object to or restrict certain processing, or withdraw consent where processing is based on consent
• Opt out of “sale” or “sharing” of personal information if those concepts apply under your local law (we do not sell personal information)

To exercise these rights, contact shachakr@gmail.com. We may need to verify your identity before fulfilling a request. You may also have the right to lodge a complaint with a data-protection authority in your country or region.

If you are a resident of California or another U.S. state with a comprehensive privacy law, this section provides additional disclosures.

We collect the categories of personal information described in Section 3, including identifiers (such as name and email), commercial information (such as subscription status), internet or network activity (such as logs and device metadata), and customer content you choose to upload. We use this information for the business purposes described in Section 4.

We disclose personal information to service providers for business purposes as described in Section 6. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not knowingly process sensitive personal information for the purpose of inferring characteristics about you beyond what is needed to provide the Service.

Subject to legal limitations, you may request access, deletion, and correction, and you will not be discriminated against for exercising your privacy rights. Submit requests to shachakr@gmail.com.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child provided personal information, contact us so we can delete it.

The Service may link to third-party sites or services (for example, Stripe’s customer portal). Their privacy practices are governed by their own policies, not ours. We encourage you to review those policies before providing personal information to them.

We may update this Privacy policy from time to time. The “Last updated” date at the top of this page will change when we do. If we make material changes, we may provide additional notice (for example, by email or in-product notice). Continued use of the Service after an update means you accept the revised policy, except where applicable law requires a different form of consent.

Privacy questions and requests: shachakr@gmail.com or Contact.