Privacy Policy

1. Who operates this service

ResearchFig provides this scientific-figure web service. For questions about the service and personal data, email support@researchfig.com. For transactions offered through Waffo as merchant of record, the payment seller is identified separately at checkout and on the receipt.

We process information to authenticate accounts, deliver the features you choose, store projects, prevent misuse, process purchases when available and provide support. We do not sell your Google sign-in data or use it to target advertisements.

2. Google sign-in: data accessed and purposes

If you select Continue with Google, ResearchFig requests only the standard OpenID Connect authentication scopes (openid, email, profile). These allow us to confirm your identity and obtain your verified email address and basic profile information such as your display name. Google may provide a profile photo as part of its standard response; ResearchFig does not deliberately save a profile-photo copy in the project database.

We use this data only to sign you in, associate projects and credits with your account, display account information, prevent unauthorized access and respond to account-related support requests. We create an internal account identifier derived from the verified identity. Authorized administrators can see your email, account status and limited operational records, but admin management views do not expose your research prompts or saved images.

We do not request access to Gmail messages, Google Drive, Calendar, contacts or other Google content. We do not send your Google account profile or login information to image-generation providers for model training, and we do not sell or share Google sign-in information with data brokers or advertising networks.

Google supplies the sign-in process under its own Privacy Policy. If you later revoke ResearchFig access in your Google Account, existing ResearchFig projects are not automatically deleted; use the account deletion controls or contact us to request deletion.

3. Prompts, images, projects and local tools

When you intentionally submit a generation or edit request, the prompt, optional reference images and optional edit masks are sent to the configured third-party image-generation service (which may be APIMart or an OpenAI image service). The selected provider needs this content to create your image. Its data processing, geographic location and retention practices may differ from ours. Do not submit confidential, unpublished or patient-identifying research material unless you have reviewed the applicable provider terms and are authorized to disclose that material.

Some provider workflows require a temporary, publicly reachable reference-image URL (potentially up to 72 hours). Such a URL is used only for the provider request but may be accessible to anyone holding the link until it expires. The studio must show relevant upload information before you proceed.

When you save a linked project, we store its prompt, generated PNG, added annotations, revisions and generation metadata in the configured project database and private object storage. Our current project controls limit retained revisions and image storage, but old objects, provider copies or backups may not disappear immediately when a project is deleted. Without a linked project, a generated result may remain only in the browser until you leave or refresh.

The figure resolution checker and our browser-based statistical-chart tools process chosen files or values locally unless a specific feature states otherwise; they do not upload that input simply to calculate a result. The resolution checker clears its working data when you leave or refresh it.

AI output can contain scientific errors or invented details. ResearchFig does not verify experimental truth, publication suitability, copyright ownership or third-party permissions. You must review final material before use.

4. Service providers and sharing

• Google: third-party authentication when you choose Google sign-in.
• Supabase or configured database/storage providers: account identity mapping, private project files, credit and order ledgers, subject to access controls.
• APIMart, OpenAI or other expressly configured image providers: process only the prompt, image inputs and generation settings sent for a task. Their processing conditions apply.
• Waffo and its payment partners: if production purchases become available, handle checkout, payment method details, tax/receipt information, refunds and payment status. ResearchFig receives order and entitlement status needed to supply the service; we do not intentionally store full payment-card numbers.
• Email delivery provider, if enabled: sends requested authentication codes and essential account communications.

Providers may process data across borders. We may also disclose information when legally required, to defend rights or address security incidents. No private research files are intentionally published on the certificate verification page; that page shows limited metadata and an image fingerprint.

5. Accounts and service administration

账号与服务管理

我们在私有账号记录中保存经验证的登录邮箱、姓名、登录方式及已记录的登录时间。授权管理员可查看账号状态、积分余额、付款记录及生成任务元数据，并可限制新生成和新购买或暂停模型，所有变更均留有操作日志。管理页面不展示科研提示词、上传文件或生成图像。删除账号会移除联系资料；必要的财务和审计记录保留。

6. Optional first-party analytics

可选的网站统计

经你同意后，ResearchFig 在自有数据库中记录访问来源、允许的 UTM 活动标记、安全页面路径、时间和设备大类。站内浏览器标识最多保留30天，会话标识在30分钟无活动后失效。统计不记录 IP、完整浏览器标识、完整网址、OAuth 参数、提示词、科研文件或私人文件名。登录后，可将访问关联到新账号注册或服务端确认的付款。会话连续90天无活动后，在后续采集时清理其访问记录。

只有选择“允许统计”后才开始记录。你可以通过“统计设置”拒绝或撤回，清除统计标识并停止后续采集；我们也遵循浏览器的 Do Not Track 与 Global Privacy Control 信号。删除账号会移除归因关联，匿名访问量可继续保留。被拒绝或拦截的访问不包含在统计中。

7. Retention, account deletion and your choices

Account identifiers and saved projects are retained while your account is active or while needed to provide the service. You can delete saved projects and request account deletion from your account. We delete or disconnect the data covered by those controls, subject to technical cleanup periods, legally required financial records, audit/security obligations and third-party provider or backup retention. We do not promise instantaneous erasure from all external systems.

Payment and accounting records may need to be kept after account deletion for legal, fraud-prevention or dispute-resolution purposes. If a test figure-provenance record exists, its public license identifier and nonidentifying image fingerprint may remain verifiable after account contact information is detached.

You may request access, correction or deletion, or ask questions about how your personal information is used, by writing to support@researchfig.com. Applicable privacy rights vary by location. We may need to verify your request before acting.

8. Security, age, changes and contact

We use restricted database access, server-side authorization and private object storage where configured. No service is perfectly secure; please avoid uploading restricted materials before verifying the suitability of the service and provider policies. ResearchFig is intended for adults and researchers, not children under 13.

We may update this policy as functionality or providers change. If a change materially alters how Google user data is used, we will update in-product notices before applying the new use. This policy is published in English for review; localized interface text may not replace the complete English disclosures.

ResearchFig · support@researchfig.com · Contact & support · Terms of Service