Privacy Policy

A transparent summary of how we handle your data. Draft; subject to external counsel review before v0.9.

Last updated: 2026-04-18

This page is a v0.8 MVP draft. A reviewed version will ship at v0.9 after external counsel sign-off. This draft is not legal advice.

Data we collect

Account data: email, hashed password, preferences, session tokens.
Payment data (v0.9 onward): name, billing address, last-4 card digits. Card data stays with Stripe; we do not process it.
Product data: research questions, literature scan records, study plans, protocol exports.
Technical data: IP, browser info, error traces (Sentry, if deployed).

Our role

LitElekt is a data controller for account data.
We are a data processor for your content (research questions, study plans, protocols).
Your content is never routed to any model training pipeline. This is enforced in code (ZDR at the AI gateway) and stated in this policy.

AI gateway and Zero Data Retention

AI calls reach Anthropic models through a gateway.
`zdrOptions` enforces Zero Data Retention: the provider does not persist your content.
This configuration is re-verified at each v0.9 compliance pass.

Sub-processors

Vercel Inc. — hosting, Functions, analytics (United States).
Neon Inc. — Postgres database (United States).
Anthropic PBC — AI model inference with ZDR (United States).
Resend Inc. — transactional email (United States).
Stripe — payments (United States / Ireland).
PostHog Inc. — product-usage analytics, EU Cloud (Frankfurt, EU). Session replay and autocapture disabled; only funnel events are collected.
Sentry — error monitoring (if deployed, United States).
See /security for the full list and updates. New sub-processors get 30 days' notice before going live.

Retention and deletion

Project data is retained while your account is active.
On deletion, a 30-day grace window applies; after that, hard-delete. Backups purge on the same cycle.
Export: request a ZIP of your project data (protocols, RQ packages, search logs) at any time. Self-service export is coming soon; for now, request it via email ticket and we reply the same business day.

Data-subject requests

For data access, correction, deletion, or portability requests, contact us. Response time: 4 business hours (TRT 09:00–18:00, Mon–Fri); best-effort on weekends.

privacy@litelekt.ai Security Terms Legal hub