Privacy Policy
Draft for legal review. Not yet in force.
This policy says what Research Mate collects, why, who else handles it, and how long it is kept. Square brackets mark details the operator still has to fill in or check.
Who we are
Research Mate is run by [Operator legal name and ABN] ("we", "us"). You can reach us at [contact email].
What we collect
- Your account: your email address and password (the password is held by our sign-in service, Supabase Auth, not by us in readable form), and the name and nickname you add to your profile. If you choose a collaborator colour or an AI model, we keep that too.
- Your work: the organisations, projects, interview transcripts and other documents you add, the files you upload, and everything you make from them: highlights, themes, insights and boards.
- Your AI conversations: the messages you send to the AI assistant, its replies, and any images or files you attach.
- A record of each AI request: which feature ran and how many tokens it used. It is used to apply limits and to keep costs in check.
- Error reports: when something fails, we keep the error message, the page or action involved and, where known, your user ID. A message can quote a row of your work.
- Usage counts: hourly totals by page and feature. They carry no user, no organisation and no free text.
- Page-view analytics: [verify: Vercel Web Analytics is enabled on the project] If it is, it counts page views.
- Cookies and local storage: a sign-in session cookie, a cookie that remembers the organisation you last used, and, in your browser's local storage, your theme, which panes are open, which tree branches are expanded, and where each board was last scrolled.
Interview transcripts can contain personal information about the people interviewed. You are responsible for having their consent to put it in Research Mate.
- Usability-test participants: a person who opens a usability test link needs no account. Once they agree, we record the screens they see, where they click, how long each task takes, when they agreed, and the size of their window and whether they use touch or a mouse. We do not ask for their name or email, and we do not store their IP address, user agent, voice, camera or screen with their answers. A researcher may add a label to a session. [verify: wording for the owner's review]
- Consent for a test: the researcher who runs a test is responsible for having the participants' consent and for what the consent text says. [verify: wording for the owner's review]
Why we use it
To run the service: sign you in, store and show your work, let your team work together, apply limits, fix faults and keep the service secure. We do not sell your information and we do not use it for advertising.
The AI assistant
When you ask for suggestions, a draft or a chat answer, the text it needs is sent to an AI provider. Today that is one of two:
- Anthropic (Claude) is the default.
- Google (Gemini) is used if you choose it under AI model on your profile or in a conversation's Model menu.
What is sent depends on what you ask. It can include the transcripts and documents in the project, highlights, themes, insights, the content of the board you have open, your chat messages (up to the last 20 in a conversation), and images or files you attach.
[verify: Anthropic's terms on using API data to train models.]
[verify: which Google Gemini API tier is in use, and Google's terms on using prompts to improve its products. Our own records note that the free tier may allow it.]
Who else handles your information
We use the providers listed on the Subprocessors page. In short: Supabase (database, sign-in and file storage, Sydney), Vercel (hosting, Sydney, and page-view analytics), Anthropic and Google (AI), Cloudflare (a check that sign-up, log-in and password reset are not automated; it also loads with the sign-up and log-in form on the home page, so it runs when that page is opened) [verify: wording on the check loading on the home page], and [email provider: to be chosen] and [uptime monitor: to be chosen].
A share link shows a frozen copy of a presentation, quotes included, to anyone who has the link until it expires or you revoke it.
Some providers may handle data outside Australia, for example for support or AI processing. [verify: where each AI provider processes requests.]
How long we keep it
| What | How long |
|---|---|
| Transcripts, documents and uploaded files | Until you delete them |
| A deleted board, document, highlight, theme or insight | 30 days in the Deleted folder, then removed |
| Automatic board history | 30 days, unless you name a version, which keeps it |
| Versions you save or name | Until you delete them |
| An AI conversation | Until you delete it; a deleted one is removed after 30 days |
| An image attached to an AI chat message | 30 days (the daily media clean-up removes it once nothing references it) |
| Media that no board uses any more | Swept daily, once it is over 30 days old |
| Share-link copies (the frozen presentation a link shows, quotes included) | [verify: kept after the link expires; no purge job today] |
| A record of each AI request | [verify: no limit today] |
| Invitations (the invitee's email) | Expire after 14 days [verify: rows are not purged today] |
| A usability test and its sessions (a participant's recorded clicks and screens) | Until the researcher deletes the test or the session; a deleted one is removed after 30 days [verify: wording for the owner's review] |
| Error reports | 400 days |
| Usage counts and alerts | 90 days |
Backups: [verify: backup arrangements and how long backups are kept].
Your choices and your rights
You can see and change your profile in the app. You can delete your documents, boards and conversations yourself.
To get a copy of your information, or to have your account and data deleted, email [contact email]. Export and deletion are done by hand for now; self-serve tools will come later. [verify: response time we commit to.]
If you are in Australia, you can also ask us to correct your information and complain to us about how we handled it. If we do not resolve it, you can complain to the Office of the Australian Information Commissioner. [verify: whether the GDPR applies, and any extra rights and complaint routes for people in the EU or UK.]
Security
Each organisation's data is separated by database access rules, and connections use HTTPS. No system is perfectly secure. [verify: data breach notification process.]
Children
Research Mate is for people 18 and over. [verify: minimum age.]
Changes
If we change this policy in a way that matters, we will tell account holders before it takes effect. [verify: notice period.]