Privacy Policy

1. Who operates this service

ResearchFig provides this scientific-figure web service. For questions about the service and personal data, email support@researchfig.com. For transactions offered through Waffo as merchant of record, the payment seller is identified separately at checkout and on the receipt.

We process information to authenticate accounts, deliver the features you choose, store projects, prevent misuse, process purchases when available and provide support. We do not sell your Google sign-in data or use it to target advertisements.

2. Google sign-in: data accessed and purposes

If you select Continue with Google, ResearchFig requests only the standard OpenID Connect authentication scopes (openid, email, profile). These allow us to confirm your identity and obtain your verified email address and basic profile information such as your display name. Google may provide a profile photo as part of its standard response; ResearchFig does not deliberately save a profile-photo copy in the project database.

We use this data only to sign you in, associate projects and credits with your account, display account information, prevent unauthorized access and respond to account-related support requests. We create an internal account identifier derived from the verified identity. Authorized administrators can see your email, account status and limited operational records, but admin management views do not expose your research prompts or saved images.

We do not request access to Gmail messages, Google Drive, Calendar, contacts or other Google content. We do not send your Google account profile or login information to image-generation providers for model training, and we do not sell or share Google sign-in information with data brokers or advertising networks.

Google supplies the sign-in process under its own Privacy Policy. If you later revoke ResearchFig access in your Google Account, existing ResearchFig projects are not automatically deleted; use the account deletion controls or contact us to request deletion.

3. Prompts, images, projects and local tools

When you intentionally submit a generation or edit request, the prompt, optional reference images and optional edit masks are sent to the configured third-party image-generation service (which may be APIMart or an OpenAI image service). The selected provider needs this content to create your image. Its data processing, geographic location and retention practices may differ from ours. Do not submit confidential, unpublished or patient-identifying research material unless you have reviewed the applicable provider terms and are authorized to disclose that material.

Some provider workflows require a temporary, publicly reachable reference-image URL (potentially up to 72 hours). Such a URL is used only for the provider request but may be accessible to anyone holding the link until it expires. The studio must show relevant upload information before you proceed.

When you save a linked project, we store its prompt, generated PNG, added annotations, revisions and generation metadata in the configured project database and private object storage. Our current project controls limit retained revisions and image storage, but old objects, provider copies or backups may not disappear immediately when a project is deleted. Without a linked project, a generated result may remain only in the browser until you leave or refresh.

The figure resolution checker and our browser-based statistical-chart tools process chosen files or values locally unless a specific feature states otherwise; they do not upload that input simply to calculate a result. The resolution checker clears its working data when you leave or refresh it.

AI output can contain scientific errors or invented details. ResearchFig does not verify experimental truth, publication suitability, copyright ownership or third-party permissions. You must review final material before use.

4. Service providers and sharing

• Google: third-party authentication when you choose Google sign-in.
• Supabase or configured database/storage providers: account identity mapping, private project files, credit and order ledgers, subject to access controls.
• APIMart, OpenAI or other expressly configured image providers: process only the prompt, image inputs and generation settings sent for a task. Their processing conditions apply.
• Waffo and its payment partners: if production purchases become available, handle checkout, payment method details, tax/receipt information, refunds and payment status. ResearchFig receives order and entitlement status needed to supply the service; we do not intentionally store full payment-card numbers.
• Email delivery provider, if enabled: sends requested authentication codes and essential account communications.

Providers may process data across borders. We may also disclose information when legally required, to defend rights or address security incidents. No private research files are intentionally published on the certificate verification page; that page shows limited metadata and an image fingerprint.

5. Accounts and service administration

Konto- und Dienstverwaltung

Wir speichern bestätigte E-Mail-Adresse, Kontoname, Anmeldemethode und erfasste Anmeldezeiten privat. Autorisierte Administratoren sehen Status, Credits, Zahlungen und Generierungsmetadaten und können neue Generierungen oder Käufe einschränken oder Modelle pausieren. Änderungen werden protokolliert. Forschungs-Prompts, Uploads und erzeugte Bilder werden dort nicht angezeigt. Kontolöschung entfernt Kontaktdaten; erforderliche Finanz- und Prüfprotokolle bleiben erhalten.

6. Optional first-party analytics

Optionale Website-Statistik

Mit Ihrer Einwilligung speichern wir Quellen, erlaubte UTM-Tags, sichere Seitenpfade, Zeitpunkte und grobe Gerätetypen in unserer Datenbank. Die Browser-ID gilt bis zu 30 Tage, die Sitzungs-ID bis zu 30 Minuten Inaktivität. Keine IPs, vollständigen Browserkennungen oder URLs, OAuth-Daten, Prompts, Forschungsdateien oder privaten Dateinamen. Nach Anmeldung kann eine Zuordnung zu Registrierung oder bestätigter Zahlung erfolgen. Sitzungsdaten werden nach 90 Tagen ohne Aktivität bei weiterer Erfassung gelöscht.

Die Erfassung beginnt erst nach Zustimmung. In den Analyse-Einstellungen können Sie ablehnen oder widerrufen; Kennungen werden gelöscht und die weitere Erfassung stoppt. Do Not Track und Global Privacy Control werden respektiert. Kontolöschung entfernt die Zuordnung, anonyme Besuchszahlen können verbleiben. Abgelehnte oder blockierte Besuche fehlen in den Statistiken.

7. Retention, account deletion and your choices

Account identifiers and saved projects are retained while your account is active or while needed to provide the service. You can delete saved projects and request account deletion from your account. We delete or disconnect the data covered by those controls, subject to technical cleanup periods, legally required financial records, audit/security obligations and third-party provider or backup retention. We do not promise instantaneous erasure from all external systems.

Payment and accounting records may need to be kept after account deletion for legal, fraud-prevention or dispute-resolution purposes. If a test figure-provenance record exists, its public license identifier and nonidentifying image fingerprint may remain verifiable after account contact information is detached.

You may request access, correction or deletion, or ask questions about how your personal information is used, by writing to support@researchfig.com. Applicable privacy rights vary by location. We may need to verify your request before acting.

8. Security, age, changes and contact

We use restricted database access, server-side authorization and private object storage where configured. No service is perfectly secure; please avoid uploading restricted materials before verifying the suitability of the service and provider policies. ResearchFig is intended for adults and researchers, not children under 13.

We may update this policy as functionality or providers change. If a change materially alters how Google user data is used, we will update in-product notices before applying the new use. This policy is published in English for review; localized interface text may not replace the complete English disclosures.

ResearchFig · support@researchfig.com · Contact & support · Terms of Service