Privacy Policy

1. Who operates this service

ResearchFig provides this scientific-figure web service. For questions about the service and personal data, email support@researchfig.com. For transactions offered through Waffo as merchant of record, the payment seller is identified separately at checkout and on the receipt.

We process information to authenticate accounts, deliver the features you choose, store projects, prevent misuse, process purchases when available and provide support. We do not sell your Google sign-in data or use it to target advertisements.

2. Google sign-in: data accessed and purposes

If you select Continue with Google, ResearchFig requests only the standard OpenID Connect authentication scopes (openid, email, profile). These allow us to confirm your identity and obtain your verified email address and basic profile information such as your display name. Google may provide a profile photo as part of its standard response; ResearchFig does not deliberately save a profile-photo copy in the project database.

We use this data only to sign you in, associate projects and credits with your account, display account information, prevent unauthorized access and respond to account-related support requests. We create an internal account identifier derived from the verified identity. Authorized administrators can see your email, account status and limited operational records, but admin management views do not expose your research prompts or saved images.

We do not request access to Gmail messages, Google Drive, Calendar, contacts or other Google content. We do not send your Google account profile or login information to image-generation providers for model training, and we do not sell or share Google sign-in information with data brokers or advertising networks.

Google supplies the sign-in process under its own Privacy Policy. If you later revoke ResearchFig access in your Google Account, existing ResearchFig projects are not automatically deleted; use the account deletion controls or contact us to request deletion.

3. Prompts, images, projects and local tools

When you intentionally submit a generation or edit request, the prompt, optional reference images and optional edit masks are sent to the configured third-party image-generation service (which may be APIMart or an OpenAI image service). The selected provider needs this content to create your image. Its data processing, geographic location and retention practices may differ from ours. Do not submit confidential, unpublished or patient-identifying research material unless you have reviewed the applicable provider terms and are authorized to disclose that material.

Some provider workflows require a temporary, publicly reachable reference-image URL (potentially up to 72 hours). Such a URL is used only for the provider request but may be accessible to anyone holding the link until it expires. The studio must show relevant upload information before you proceed.

When you save a linked project, we store its prompt, generated PNG, added annotations, revisions and generation metadata in the configured project database and private object storage. Our current project controls limit retained revisions and image storage, but old objects, provider copies or backups may not disappear immediately when a project is deleted. Without a linked project, a generated result may remain only in the browser until you leave or refresh.

The figure resolution checker and our browser-based statistical-chart tools process chosen files or values locally unless a specific feature states otherwise; they do not upload that input simply to calculate a result. The resolution checker clears its working data when you leave or refresh it.

AI output can contain scientific errors or invented details. ResearchFig does not verify experimental truth, publication suitability, copyright ownership or third-party permissions. You must review final material before use.

4. Service providers and sharing

• Google: third-party authentication when you choose Google sign-in.
• Supabase or configured database/storage providers: account identity mapping, private project files, credit and order ledgers, subject to access controls.
• APIMart, OpenAI or other expressly configured image providers: process only the prompt, image inputs and generation settings sent for a task. Their processing conditions apply.
• Waffo and its payment partners: if production purchases become available, handle checkout, payment method details, tax/receipt information, refunds and payment status. ResearchFig receives order and entitlement status needed to supply the service; we do not intentionally store full payment-card numbers.
• Email delivery provider, if enabled: sends requested authentication codes and essential account communications.

Providers may process data across borders. We may also disclose information when legally required, to defend rights or address security incidents. No private research files are intentionally published on the certificate verification page; that page shows limited metadata and an image fingerprint.

5. Accounts and service administration

Gestion du compte et du service

Nous conservons en privé l’e-mail vérifié, le nom, la méthode de connexion et les horaires de connexion enregistrés. Les administrateurs autorisés voient le statut, les crédits, paiements et métadonnées de génération et peuvent limiter les nouvelles générations ou achats ou suspendre des modèles. Les changements sont journalisés. Aucun prompt scientifique, fichier téléversé ou image générée n’y est affiché. La suppression du compte efface les coordonnées ; les données financières et d’audit nécessaires sont conservées.

6. Optional first-party analytics

Statistiques facultatives du site

Avec votre accord, nous enregistrons les sources, balises UTM autorisées, chemins sûrs, horaires et types d’appareils dans notre base. L’identifiant du navigateur dure au plus 30 jours, celui de session expire après 30 minutes d’inactivité. Aucun IP, agent utilisateur complet, URL complète, paramètre OAuth, prompt, fichier de recherche ou nom de fichier privé. Après connexion, la visite peut être reliée à une inscription ou à un paiement confirmé. Les sessions sans activité depuis 90 jours sont supprimées lors des collectes suivantes.

La collecte commence après votre accord. Vous pouvez refuser ou retirer votre accord dans les réglages : les identifiants sont effacés et la collecte cesse. Do Not Track et Global Privacy Control sont respectés. La suppression du compte retire le lien d’attribution ; les visites anonymes peuvent rester. Les visites refusées ou bloquées ne sont pas comptées.

7. Retention, account deletion and your choices

Account identifiers and saved projects are retained while your account is active or while needed to provide the service. You can delete saved projects and request account deletion from your account. We delete or disconnect the data covered by those controls, subject to technical cleanup periods, legally required financial records, audit/security obligations and third-party provider or backup retention. We do not promise instantaneous erasure from all external systems.

Payment and accounting records may need to be kept after account deletion for legal, fraud-prevention or dispute-resolution purposes. If a test figure-provenance record exists, its public license identifier and nonidentifying image fingerprint may remain verifiable after account contact information is detached.

You may request access, correction or deletion, or ask questions about how your personal information is used, by writing to support@researchfig.com. Applicable privacy rights vary by location. We may need to verify your request before acting.

8. Security, age, changes and contact

We use restricted database access, server-side authorization and private object storage where configured. No service is perfectly secure; please avoid uploading restricted materials before verifying the suitability of the service and provider policies. ResearchFig is intended for adults and researchers, not children under 13.

We may update this policy as functionality or providers change. If a change materially alters how Google user data is used, we will update in-product notices before applying the new use. This policy is published in English for review; localized interface text may not replace the complete English disclosures.

ResearchFig · support@researchfig.com · Contact & support · Terms of Service