SciFig Privacy Policy for Researchers

1. What Information We Collect

Information You Provide

• Registration Information: Username, password, date of birth, email address, and for organizational representatives, business details and physical address.
• User Content: Profile information, scientific figure prompts, descriptions, uploaded images, sketches, PDFs, and any material created or shared through the Services.
• Payment Information: Third-party payment processors (Stripe) handle transactions on our behalf. We do not store full payment card details, though we retain transaction records for compliance and support purposes.
• Correspondence Information: Support messages, feedback, and associated details collected through various communication channels.
• Surveys and Promotions: Information gathered when you participate in surveys, research studies, promotions, or sponsored events, with your consent.

Information We Collect Automatically

• Technical and Device Information: IP address, browser type, mobile carrier, device identifiers, operating system, network type, and screen resolution.
• Usage Information: Pages viewed, interaction duration, access times, navigation paths, clicks, searches, and referring URLs.
• Location Information: General geographic area inferred from your IP address; precise location collected only where necessary for location-based functions or legitimate business purposes.
• Cookies and Similar Technologies: Used to operate and optimize the Services, enable features, and enhance user experience. You can manage these through your browser or device settings. See our Cookie Policy for details.
• Marketing Attribution Cookie: We set a first-party cookie named "_scifig_attr" (30-day expiry) that records the marketing source you first arrived from, including UTM parameters from the URL and the referring website (e.g. when you click a link from a directory listing). This cookie does not contain personal information — no IP address, no device fingerprint, no email. We use it solely to measure which marketing channels bring users who later create an account, which helps us decide where to invest our growth efforts. If you create an account, the cookie’s contents are persisted to your account record. If you never sign up, the cookie expires and is never linked to a person. You can clear it at any time via your browser settings.

Information From Other Sources

When you register through third-party account providers (such as Google), those services may share your username, public profile details, and other authorized information with us. Limited information such as app ID and access token may be shared with these providers for authentication purposes.

2. How We Use Your Information

We use the information we collect to: verify eligibility and create accounts; provide, maintain, and improve the Services; fulfill your requests and process transactions; perform internal operations and analytics; display personalized content; communicate changes and updates; provide customer support; protect the platform and enforce our Terms; detect and prevent fraud; and support other purposes disclosed at the time of collection.

Lawful Basis for Processing (GDPR)

• Performance of a Contract: Creating accounts, providing Services, processing payments, and handling inquiries.
• Consent: Marketing emails, surveys, beta programs, and device data access are based on your consent, which you can withdraw at any time.
• Legal Obligations: Compliance with tax rules, regulatory requirements, identity verification, and honoring data subject rights.
• Legitimate Interests: Securing the platform, preventing fraud, improving Services, personalizing experiences, and supporting analytics.
• Protection of Vital Interests: In rare cases involving serious risk of harm.
• Establishment, Exercise, or Defense of Legal Claims: Processing information for asserting or defending legal claims and managing disputes.
• Other Permissible Grounds: Additional lawful bases as provided by applicable local law.

We may aggregate or de-identify information for trend analysis, feature improvement, and research purposes. Aggregated and de-identified analysis is limited to operational and product metrics; it never includes training an artificial intelligence model on your prompts, uploads, or Output. See the section on AI Models and Model Training below.

Exclusions of Liability

SciFig is not liable for information leakage or misuse caused by: (a) your failure to secure account credentials; (b) software, hardware, or network vulnerabilities beyond our reasonable control; (c) legal or regulatory requirements; (d) force majeure events; or (e) necessary data sharing as described in Section 4.

3. AI Models and Model Training

Many of the researchers who use SciFig work with unpublished manuscripts, embargoed data, and confidential grant material. This section sets out plainly how that content is treated in relation to artificial intelligence models.

We Do Not Train AI Models on Your Content

We do not use your prompts, your uploaded files (including images, sketches, photographs, PDFs, and manuscripts), or your generated Output to train, fine-tune, or otherwise develop any artificial intelligence model, whether our own or a third party's. This applies to every plan, including free accounts. There is no setting to opt in or opt out, because training on your content is not something we do under any plan.

Purpose Limitation

Your prompts and uploads are processed for a single purpose: to produce the figure you asked for and to make the result available in your account. They are not mined for product research, not assembled into training datasets, and not disclosed to third parties for those parties' own purposes. We do not sell your content.

Third-Party AI Model Providers

SciFig is an application layer built on top of third-party AI image models. To generate a figure, the content required to fulfil your request is transmitted to the relevant model provider through a commercial API, solely so that your Output can be produced. We do not authorise any provider to use your content to train their models. Providers process this content under their own terms, and we take that commitment into account when selecting them.

What "Improving the Services" Means

Where this Policy or our Terms of Service refer to improving the Services, or to aggregated and de-identified analysis, we mean operational and product metrics such as error rates, generation latency, feature usage counts, and similar statistics. It does not include training an artificial intelligence model on your prompts, uploads, or Output.

Limited Exceptions

Automated safety systems screen generated content for unlawful material as described in our Terms of Service, and we may access specific content where it is necessary to investigate abuse, respond to a support request you have made, comply with a legal obligation, or establish, exercise, or defend legal claims. These are safety and legal-compliance activities. They are not model training, and they do not give us any right to use your content for model development.

Deleting Your Content

Files you upload can be deleted from your account at any time, and deletion removes the stored object from our storage systems rather than merely hiding it. Figures in your library are first moved to Trash, where you can restore them for 30 days; after that window they are permanently removed from our database and the stored image is deleted. Residual copies may persist in routine encrypted backups for a limited period before being overwritten in the ordinary course of operations.

4. How We Share Your Information

• We do not sell your personal information. However, we may share your information in the following circumstances:

Service Providers or Business Partners

We share information with trusted third-party vendors, including payment processors (Stripe), hosting providers, analytics firms, and marketing partners. All service providers are contractually bound to process data only on our behalf and in accordance with our instructions.

Corporate Group

Information may be shared with subsidiaries, parent entities, and affiliates under common ownership. These entities may operate internationally, and appropriate safeguards are implemented for cross-border transfers.

Legal and Compliance Obligations

We may disclose information to law enforcement, regulators, or courts when necessary to comply with law, enforce our Terms of Service, investigate violations, detect fraud, protect rights and safety, or defend legal claims.

Sale or Merger

Information may be shared in connection with corporate transactions including mergers, acquisitions, asset sales, financing, restructuring, or bankruptcy. Recipients must honor this Policy or provide equivalent protection.

With Your Consent

We may share information with third parties when you consent or direct us to do so, with explicit consent obtained where required by law.

International Data Transfers

Personal information is stored on secure servers and may be processed internationally by our affiliates and service providers. When transferring data from the EEA, UK, or Switzerland to countries without adequate protection determinations, we implement appropriate safeguards including European Commission Standard Contractual Clauses, UK Addendum, and supplementary technical and organizational measures.

5. Your Rights and Choices

• Depending on your location and applicable law, you may have the following rights regarding your personal information:
• Access and Confirmation: Request confirmation of whether we process your data, and obtain a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal information.
• Erasure (Right to be Forgotten): Request deletion of your personal data in certain circumstances. We may decline erasure requests where retention is necessary for legal obligations, dispute resolution, or legitimate interests.
• Restriction of Processing: Request limitation of processing in specific situations.
• Data Portability: Request your personal information in a structured, commonly used, machine-readable format for transfer to another controller.
• Withdrawal of Consent: Where processing relies on your consent, you may withdraw it at any time. Withdrawal may impact your access to certain features but does not affect the lawfulness of prior processing.
• Opt-Out of Sales and Targeted Advertising (U.S. Residents): Individuals covered by CCPA/CPRA may opt out of the sale of personal information or sharing for cross-context behavioral advertising.
• Objection to Processing: Object to processing in certain cases, including direct marketing.
• Complaints: Lodge complaints with your local data protection authority.
• To exercise any of these rights, please contact us at hello@scifig.ai. We will respond within 15 days after verifying your identity.

6. Data Security

• We employ reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, the transmission of information via the internet is not completely secure, and any transmission is at your own risk. We encourage you to use strong, unique passwords and to avoid reusing credentials across services.

7. Data Retention

• We retain your information for as long as necessary to fulfill the purposes for which it was collected. Information may be retained for longer periods to comply with legal obligations or to establish, exercise, or defend legal claims. After termination of your use of the Services, information may be stored in aggregated, anonymized form.

8. Information Relating to Minors

• The Services are not directed at children under 13 years of age (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at hello@scifig.ai so we can take appropriate action.

9. Privacy Policy Updates

• We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. Material changes will be communicated through the Services or by other appropriate means. The "Effective Date" at the top of this Policy indicates when the latest changes took effect. Your continued use of the Services after any updates constitutes your agreement to the revised Policy.

10. Contact Us

• If you have any questions or concerns about this Privacy Policy, please contact us at hello@scifig.ai. We aim to respond to all privacy-related requests within 15 days after verifying your identity.