Last updated: February 22, 2026

Privacy Policy

Your privacy matters. This Policy explains what data we collect, how we use it, and your rights as a user of ScholarFeedAI.

🇪🇺

European AI - European infrastructure - European law

All AI processing on ScholarFeedAI is performed by Mistral AI - France's leading sovereign AI company. The data you provide on ScholarFeedAI is processed exclusively within the European Union, in full compliance with the General Data Protection Regulation (GDPR). Mistral AI commits not to use your data to train or improve its models.

1. Data Controller

The data controller responsible for processing your personal data is:

Guillaume SUTTY, operating under ScholarFeedAI. ScholarFeedAI is the trade name under which Desiweb operates the service.

Email: contact@scholarfeedai.com

2. Data We Collect

We collect the following categories of personal data:

Account data

Full name and email address (provided at registration)
Encrypted password (hashed; never stored in plain text)
Account creation date

Research profile data

The research description written by you
Keywords extracted by AI or added manually

Usage data

Paper ratings (👍 / 👎), read status, saved status
Digest history (paper titles, publication dates, summaries)
Subscription status and billing events (no card data stored)

Technical data

No IP address
No browser or device information

We do not use tracking pixels, third-party analytics, or advertising cookies of any kind on ScholarFeedAI.

3. How We Use Your Data

We use your data exclusively for the following purposes:

Service delivery - Generating weekly paper digests tailored to your research profile.
Account management - Authentication, subscription tracking, and customer support.
AI-powered features - Sending your research description, keywords, and paper abstracts to Mistral AI to generate summaries and relevance notes (see Section 5).
Service improvement - Aggregate, anonymised usage analytics to improve the quality of digest generation.
Legal obligations - Retaining billing records as required by French accounting law.

We never sell, rent, lend, or otherwise share your personal data with any third party for commercial purposes.

4. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases under GDPR Article 6:

Performance of a contract (Art. 6(1)(b))

Processing your account data, research profile, and generating digests is necessary to provide the Service you signed up for.

Legitimate interests (Art. 6(1)(f))

Improving the Service using anonymised analytics, fraud prevention, and security measures.

Compliance with legal obligations (Art. 6(1)(c))

Retaining transaction records for tax and accounting purposes as required by French law.

Consent (Art. 6(1)(a))

Where you explicitly consent - for example, receiving promotional communications.

5. Our AI Partner: Mistral AI

ScholarFeedAI uses Mistral AI (Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, mistral.ai) as its exclusive AI processing partner.

Why Mistral AI?

European sovereignty - Mistral AI is a French company, incorporated under French law, and processes data exclusively on European infrastructure. This means your data never leaves the EU.
GDPR compliance - Mistral AI is a GDPR-compliant data processor. All data processing is governed by a Data Processing Agreement (DPA) consistent with GDPR requirements.
No model training on your data - Mistral AI does not use data submitted via the API to train, fine-tune, or improve its models.
No data retention beyond processing - Mistral AI does not retain prompt data beyond the immediate processing request (subject to their DPA terms).

Data sent to Mistral AI includes: your research description, research keywords, and paper abstracts from PubMed. No contact information (name, email) is ever sent to Mistral AI.

6. Other Third-Party Services

Stripe

Payment processing. The billing information you give to Stripe may be stored in the US. Stripe remains fully GDPR-compliant. We never see or store your card number.

Data location: USA (EU Standard Contractual Clauses)

Neon (database hosting)

PostgreSQL database hosting for all application data.

Data location: EU (AWS Frankfurt)

Railway (backend hosting)

Backend hosting for server logic.

Data location: EU (Amsterdam)

Vercel (frontend hosting)

Hosting and serving the ScholarFeedAI web application.

Data location: EU (Frankfurt)

PubMed / NCBI

Public scientific literature database. We query it with your keywords - no personal data is transmitted to NCBI.

Data location: USA (public government database, no PII)

7. Data Retention

We retain your data for as long as your account is active. Specifically:

Account and research profile data - Retained while your account is active, and for up to 12 months after deletion in backup systems before permanent erasure.
Digest and paper history - Retained while your account is active. Deleted upon account deletion.
Billing records - Retained for 10 years as required by French accounting law (even after account deletion).
Server logs - Retained by our hosting providers for up to 30 days per their standard practices.

8. Your Rights Under GDPR

As a resident of the European Economic Area (EEA), you have the following rights regarding your personal data:

Right of access

Request a copy of all data we hold about you.

Right to rectification

Request correction of inaccurate or incomplete data.

Right to erasure

Request deletion of your personal data ("right to be forgotten").

Right to portability

Receive your data in a structured, machine-readable format.

Right to restrict processing

Request that we limit how we use your data in certain circumstances.

Right to object

Object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, contact us at contact@scholarfeedai.com. We will respond within 30 days.

9. Cookies

ScholarFeedAI uses only strictly necessary cookies, specifically a session authentication token stored in your browser to keep you logged in. This cookie is essential for the Service to function.

We do not use advertising cookies, analytics cookies (e.g., Google Analytics), or social media tracking pixels.

No third-party cookies are set by ScholarFeedAI with the exception of our billing provider Stripe, which may set cookies on their own domain for payment processing purposes. We do not have access to or control over Stripe's cookies, and they are used solely for secure payment processing.

10. Security

We implement industry-standard security measures to protect your data:

All data in transit is encrypted using TLS (HTTPS)
Passwords are hashed using Argon2 and never stored in plain text
Database access is restricted to application servers only
API authentication uses short-lived opaque tokens
Infrastructure is regularly updated to apply security patches

If you discover a security vulnerability, please report it responsibly to contact@scholarfeedai.com.

11. Children's Privacy

ScholarFeedAI is intended for use by adults (18 years and older) engaged in academic or professional research. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when the most recent revision was made.

For material changes, we will notify you by email or via a prominent notice in the Service before the changes take effect. Your continued use of ScholarFeedAI after the effective date constitutes acceptance of the revised Policy.

13. Contact

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

Guillaume SUTTY, operating under ScholarFeedAI. ScholarFeedAI is the trade name under which Desiweb operates the service.

Email: contact@scholarfeedai.com