Privacy Policy

Account details. When you sign in (with Google or an email code) our sign-in provider, Clerk, gives us your name, email address and profile picture, plus a user ID. If you use Google sign-in we only request the basic openid, email and profile permissions. We do not get your Google password, contacts, Drive, Gmail or calendar.

Your research content. Papers and references you save, drafts, books, manuscripts and text you upload or paste, comments, War Room debates, and the results we generate for you. For uploaded documents we store extracted text, not the original files. If you connect Zotero, your PDFs stay in your own Zotero storage; we store citation details and extracted text so search can work.

Connection keys you give us. Keys for Zotero, AI providers you bring yourself (for example OpenRouter or Perplexity) and agent tokens. These are stored encrypted and used only to act for you.

Usage and billing records. Which features you use, AI usage and cost per request (to enforce fair-use limits), and basic server logs. If you subscribe, Stripe handles your card; we only receive your subscription status and a customer reference, never your card number.

To run ScholarFlow for you: sign you in, store and search your library, generate and citation-check drafts, run the features you ask for, apply plan limits, take payment, keep the service secure, and contact you about your account. We do not sell your data, we do not use it for advertising, and we do not use your content to train AI models.

We share only what each service needs to do its job for us:

• Clerk: sign-in and account management.
• Vercel, Railway and Neon: website hosting, app servers and database (United States).
• AI providers (DeepSeek by default, or the provider you choose with your own key, such as OpenRouter): the text of the request being processed, for example a section you asked us to draft or check.
• Nomic: text passages, to build search embeddings.
• Scholarly databases (Semantic Scholar, OpenAlex, Crossref, arXiv, PubMed, Europe PMC) and Perplexity: search queries and citation details, to find and verify sources.
• Zotero and Obsidian: only if you connect them, and only to sync your own items.
• AI assistants you connect yourself (for example Claude by Anthropic or ChatGPT by OpenAI): only if you connect one, and only the results of the actions you ask it to take. That provider handles this data under its own privacy policy, not ours.
• ElevenLabs: spoken text, only if you use voice features.
• Stripe: payments, only if you subscribe.

Our AI-writing detector runs on our own servers; your text is not sent to a detection vendor. We may also disclose information if the law requires it.

We keep your data while your account is active. You can delete individual papers, drafts and projects at any time. If you ask us to close your account, we delete your content within 30 days, except records we must keep for legal or accounting reasons.

You can access, export, correct or delete your data, disconnect integrations and revoke agent tokens in Settings. Email dr.m.weyers@bcinnovationlabs.comfor anything you cannot do yourself, including a full copy or deletion of your account. Depending on where you live (for example under GDPR, UK GDPR or Canada's PIPEDA) you may have further rights, including complaining to your data protection authority.

Data is encrypted in transit (HTTPS), stored keys are encrypted at rest, and every request is checked so you can only reach your own data. No system is perfectly secure; if a breach affects you, we will tell you.

ScholarFlow is for adults and is not directed at children under 16.

If we change this policy we will update the date above, and for significant changes we will tell you by email or in the app.