Legal
Privacy Policy
Effective date: August 14, 2026
PaperBeats (“PaperBeats”, “we”, “us”) provides an automatic literature-alert service that follows academic topics and authors and emails you a digest of matching papers. This policy explains what personal data we collect, why, who we share it with, and the rights you have over it.
PaperBeats is operated by an individual sole operator based in the Netherlands (not a registered company). Because the controller is established in the EU, no separate EU representative under GDPR Art. 27 is required. For any privacy question or to exercise the rights described below, contact support@paperbeats.com.
1. What data we collect
| Category | Data | Collected when |
|---|---|---|
| Account data | Email address, full name, password (stored as a salted hash by our authentication provider, never in plain text) | You sign up |
| Profile data | Institution, research field, digest frequency (daily/weekly/off) | You sign up or edit Settings |
| Alert configuration | Topic keywords you add (“topic alerts”), researchers you follow (name, institution, their OpenAlex identifier) | You use Settings |
| Usage data | Which papers you’ve read or saved, AI-generated relevance notes/scores tied to your profile, digest send history | Automatic, as you use the app |
| Technical data | Session/authentication cookies (see §6) | Automatic, on login |
Note: when you follow a researcher, we store that researcher’s name and institution — this is personal data about a third party (the researcher), not about you. We collect it only to match new publications against your alerts, and only from OpenAlex’s public author index.
2. Why we process it and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and secure your account | Email, password, name | Contract necessity (6(1)(b)) |
| Match and deliver relevant papers | Topics, followed authors, field, institution | Contract necessity (6(1)(b)) |
| Send digest emails | Email, name, matched papers | Contract necessity (6(1)(b)) |
| Generate AI relevance notes and weekly briefings | Field, topics, paper metadata (not your name or email) | Legitimate interest (6(1)(f)) — improving the relevance of a service you asked for |
| Understand aggregate site traffic | Anonymous, cookieless page-view events (see §6) | Legitimate interest (6(1)(f)) — no personal data involved |
We do not sell your data, use it for advertising, or process any special-category data (Art. 9).
3. Who we share data with
We use the following subprocessors to run PaperBeats. None of them may use your data for their own purposes.
- Supabase (Supabase Inc.) — hosts our database and handles account authentication. Receives all account, profile, and alert data listed in §1.
- Resend (Resend, Inc.) — sends your digest emails on our behalf. Receives your email address, first name, and the paper titles/links/AI notes included in each digest.
- Anthropic (Anthropic, PBC) — powers the optional AI relevance notes and weekly briefings. Receives your stated research field, institution, and topic keywords, plus the titles/abstracts of candidate papers. Does not receive your name, email, or password.
- Academic paper-source APIs — OpenAlex, PubMed/NCBI, Europe PMC, Crossref, and Semantic Scholar. We send them your topic keywords and author-search terms as ordinary search queries (the same way a public search box would) to find matching publications. We do not send your name, email, or any account identifier to these services.
- Vercel (Vercel Inc.) — hosts the PaperBeats application itself. Receives standard web traffic (requests, IP addresses in server logs) needed to serve the site.
- Vercel Analytics(Vercel Inc.) — collects anonymous, cookieless page-view analytics. See §6 for exactly what this does and doesn’t collect.
International transfers: Supabase, Resend, Anthropic, and Vercel are US-based providers. Where personal data is transferred outside the EEA/UK, each provider’s data processing agreement incorporates the EU Standard Contractual Clauses (SCCs) as the transfer safeguard, with a UK Addendum applied for UK transfers. Resend additionally certifies under the EU–U.S. Data Privacy Framework as a further transfer mechanism. We rely on these contractual safeguards for all cross-border processing by our subprocessors.
4. How long we keep your data
We retain your account and associated data for as long as your account is active. If you delete your account (Settings → Delete account), we erase your personal data — profile, topics, followed authors, and your matched-paper history — within 30 days. Papers themselves are stored in a shared, de-identified catalogue (title, abstract, authors as published) that is not linked to any individual account once your account is deleted, and is kept indefinitely as general research literature metadata.
5. Your rights
Under the GDPR/UK GDPR (and equivalent rights if you’re elsewhere), you may:
- Access the personal data we hold about you
- Correct inaccurate data (Settings lets you do this directly for most fields)
- Export your data in a portable format (Settings → Export my data)
- Delete your account and associated data (Settings → Delete account)
- Object to or restrict certain processing (e.g. the AI relevance notes — contact us to opt out while keeping your account)
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local data protection supervisory authority
To exercise any of these rights, use the relevant Settings control or email support@paperbeats.com. We’ll respond within 30 days.
6. Cookies and analytics
Authentication cookie: we set one strictly-necessary session cookie (via Supabase Auth) so you stay logged in. This cookie is required for the service to function and is exempt from cookie-consent requirements under ePrivacy Art. 5(3). We do not use any advertising, marketing, or cross-site tracking cookies.
Vercel Analytics:we use Vercel Web Analytics to see aggregate traffic (which pages are visited, roughly how many people, what device/browser). Per Vercel’s own privacy documentation:
- It sets no cookies — visitors are identified only by a hash derived from the incoming request, not a persistent identifier
- That hash is automatically discarded after 24 hours and is never linked to an individual, an account, or an IP address
- It collects only aggregated page/event data: timestamp, URL, referrer, coarse geolocation (country/region/city), device type, browser, and OS
- It cannot be used to reconstruct your browsing history across sites, and does not identify or attempt to identify you personally
Because no cookies are set and no personal data is collected, this analytics does not require cookie consent.
7. Children's privacy
PaperBeats is not directed at, and we do not knowingly collect data from, anyone under 16.
8. Changes to this policy
If we materially change this policy, we’ll notify active users by email before the change takes effect. The “Effective date” above always reflects the current version.