Privacy Policy

1. Who operates this service

ResearchFig provides this scientific-figure web service. For questions about the service and personal data, email support@researchfig.com. For transactions offered through Waffo as merchant of record, the payment seller is identified separately at checkout and on the receipt.

We process information to authenticate accounts, deliver the features you choose, store projects, prevent misuse, process purchases when available and provide support. We do not sell your Google sign-in data or use it to target advertisements.

2. Google sign-in: data accessed and purposes

If you select Continue with Google, ResearchFig requests only the standard OpenID Connect authentication scopes (openid, email, profile). These allow us to confirm your identity and obtain your verified email address and basic profile information such as your display name. Google may provide a profile photo as part of its standard response; ResearchFig does not deliberately save a profile-photo copy in the project database.

We use this data only to sign you in, associate projects and credits with your account, display account information, prevent unauthorized access and respond to account-related support requests. We create an internal account identifier derived from the verified identity. Authorized administrators can see your email, account status and limited operational records, but admin management views do not expose your research prompts or saved images.

We do not request access to Gmail messages, Google Drive, Calendar, contacts or other Google content. We do not send your Google account profile or login information to image-generation providers for model training, and we do not sell or share Google sign-in information with data brokers or advertising networks.

Google supplies the sign-in process under its own Privacy Policy. If you later revoke ResearchFig access in your Google Account, existing ResearchFig projects are not automatically deleted; use the account deletion controls or contact us to request deletion.

3. Prompts, images, projects and local tools

When you intentionally submit a generation or edit request, the prompt, optional reference images and optional edit masks are sent to the configured third-party image-generation service (which may be APIMart or an OpenAI image service). The selected provider needs this content to create your image. Its data processing, geographic location and retention practices may differ from ours. Do not submit confidential, unpublished or patient-identifying research material unless you have reviewed the applicable provider terms and are authorized to disclose that material.

Some provider workflows require a temporary, publicly reachable reference-image URL (potentially up to 72 hours). Such a URL is used only for the provider request but may be accessible to anyone holding the link until it expires. The studio must show relevant upload information before you proceed.

When you save a linked project, we store its prompt, generated PNG, added annotations, revisions and generation metadata in the configured project database and private object storage. Our current project controls limit retained revisions and image storage, but old objects, provider copies or backups may not disappear immediately when a project is deleted. Without a linked project, a generated result may remain only in the browser until you leave or refresh.

The figure resolution checker and our browser-based statistical-chart tools process chosen files or values locally unless a specific feature states otherwise; they do not upload that input simply to calculate a result. The resolution checker clears its working data when you leave or refresh it.

AI output can contain scientific errors or invented details. ResearchFig does not verify experimental truth, publication suitability, copyright ownership or third-party permissions. You must review final material before use.

4. Service providers and sharing

• Google: third-party authentication when you choose Google sign-in.
• Supabase or configured database/storage providers: account identity mapping, private project files, credit and order ledgers, subject to access controls.
• APIMart, OpenAI or other expressly configured image providers: process only the prompt, image inputs and generation settings sent for a task. Their processing conditions apply.
• Waffo and its payment partners: if production purchases become available, handle checkout, payment method details, tax/receipt information, refunds and payment status. ResearchFig receives order and entitlement status needed to supply the service; we do not intentionally store full payment-card numbers.
• Email delivery provider, if enabled: sends requested authentication codes and essential account communications.

Providers may process data across borders. We may also disclose information when legally required, to defend rights or address security incidents. No private research files are intentionally published on the certificate verification page; that page shows limited metadata and an image fingerprint.

5. Accounts and service administration

アカウントとサービスの管理

確認済みメール、アカウント名、ログイン方法と記録されたログイン時刻を非公開で保存します。権限を持つ管理者は状態、クレジット、支払い、生成タスクのメタデータを確認し、新規生成・購入の制限やモデルの一時停止ができます。変更を監査記録に残します。研究プロンプト、アップロードや生成画像は管理画面に表示しません。アカウント削除時は連絡先情報を削除し、必要な財務・監査記録を保持します。

6. Optional first-party analytics

任意のウェブサイト統計

同意後、訪問元、許可されたUTMタグ、安全なページパス、時刻、端末の種類を自社データベースに記録します。ブラウザIDは最大30日、セッションIDは無操作30分まで有効です。IP、完全なユーザーエージェントやURL、OAuth情報、プロンプト、研究ファイル、個人のファイル名は記録しません。ログイン後は登録や確認済み支払いに関連付ける場合があります。90日間活動のないセッションの記録を、以後の収集時に削除します。

許可した場合のみ収集を開始します。「統計の設定」から拒否・撤回でき、識別子を削除して以後の収集を停止します。Do Not TrackとGlobal Privacy Controlにも従います。アカウント削除時は帰属の関連付けを削除し、匿名の訪問数は残る場合があります。拒否・ブロックされた訪問は集計しません。

7. Retention, account deletion and your choices

Account identifiers and saved projects are retained while your account is active or while needed to provide the service. You can delete saved projects and request account deletion from your account. We delete or disconnect the data covered by those controls, subject to technical cleanup periods, legally required financial records, audit/security obligations and third-party provider or backup retention. We do not promise instantaneous erasure from all external systems.

Payment and accounting records may need to be kept after account deletion for legal, fraud-prevention or dispute-resolution purposes. If a test figure-provenance record exists, its public license identifier and nonidentifying image fingerprint may remain verifiable after account contact information is detached.

You may request access, correction or deletion, or ask questions about how your personal information is used, by writing to support@researchfig.com. Applicable privacy rights vary by location. We may need to verify your request before acting.

8. Security, age, changes and contact

We use restricted database access, server-side authorization and private object storage where configured. No service is perfectly secure; please avoid uploading restricted materials before verifying the suitability of the service and provider policies. ResearchFig is intended for adults and researchers, not children under 13.

We may update this policy as functionality or providers change. If a change materially alters how Google user data is used, we will update in-product notices before applying the new use. This policy is published in English for review; localized interface text may not replace the complete English disclosures.

ResearchFig · support@researchfig.com · Contact & support · Terms of Service