Privacy Policy

Controller Identity and Contact

• Controller: ResearchC Operated by Kazunori Fukuhara
• Address: 737 Campus Drive, Stanford, CA 94305, United States of America
• Privacy contact: support@researchc.app

If we appoint a data protection officer ("DPO") or EU/UK representative (where required), we will provide contact details here or in an addendum to this Privacy Policy.

Scope

This Policy applies to personal information collected through the Service, including when you create an account, build a profile, message other users, post or respond to opportunities, use matching, contact support, or submit reports. It does not apply to third-party sites/services you access via links.

Definitions

"Personal information"/"personal data" means information that identifies or can reasonably be linked to an identifiable person. "Processing" means collecting, using, storing, disclosing, analyzing, deleting, or otherwise handling personal data. "User Content" means content you submit (profiles, postings, messages).

Information We Collect

Account and eligibility data (required to use the Service)

• Name
• Email address
• Institutional email address (for verification)
• Affiliated institution; department/major; academic year
• Password (stored only as a one-way hash; never stored in plaintext)

Profile data (some optional)

• Bio, profile photo
• Research interests, skillset, research availability
• Research network information (e.g., connections/relationships represented on the Service)
• Research proposals/summaries or other profile fields you choose to submit

Messaging and communications

• Message content you send/receive through the Service
• Metadata associated with messages (timestamps, sender/recipient IDs, delivery status)

Opportunity/RA postings and interactions

• Opportunity postings (including RA postings), responses/applications (if supported), related communications

Engagement, matching, and interaction logs

• Likes, views, matches, follows/blocks (if present), and other engagement signals
• Interaction logs (e.g., profile views and feature usage events)

Onboarding/survey inputs (optional)

• How you heard about ResearchC; sign-up motivations; voluntary onboarding questions

Support, safety, and reports

• Support requests and correspondence
• Reports/complaints you submit; content identifiers; and related investigation records
• Block/report activity and outcomes

Device, cookies/storage, and technical logs

• IP address; device/browser information; session identifiers
• Security and diagnostic logs (e.g., authentication events, errors, rate-limit events)
• Cookies or similar technologies (including local storage/session storage) used for security, login, and (optionally) analytics

Sensitive Information Note

Please do not submit highly sensitive data (e.g., government IDs, financial account numbers, private home address) unless necessary for your intended collaboration. If you share sensitive data with other users, you do so at your discretion.

How We Use Information

We use personal information to:

• Provide and operate the Service (accounts, profiles, eligibility verification, messaging, postings, matching).
• Personalize and improve matching (using profile fields plus engagement signals like likes/views).
• Safety, security, and integrity (prevent abuse/spam/fraud, enforce Terms/Guidelines, investigate reports).
• Communicate with you (service updates, verification, support responses).
• Legal obligations and protection (comply with lawful requests; protect rights, safety, and property).

Legal Bases for Processing (EEA/UK Users)

Where GDPR/UK GDPR applies, we rely on one or more of the following legal bases depending on purpose:

Automated Decision-Making and Profiling (Matching)

ResearchC uses automated processing to recommend matches and opportunities. Inputs may include profile details (research interests/skills/availability), engagement signals (likes/views), and limited usage signals (e.g., feature interactions). The logic is designed to increase relevance (e.g., overlap/compatibility scoring and activity-based ranking). Recommendations are not guarantees.

If you are in the EEA/UK and believe a recommendation process produces legal or similarly significant effects on you, you may request human review and express your point of view by contacting support@researchc.app.

How We Share Information

• Within the Service (user-to-user visibility): certain profile fields and opportunity postings may be visible to other users depending on feature and settings (e.g., name, institution, department/major, academic year, bio, photo, interests/skills/availability, postings). Messages are visible to conversation participants.
• Service providers ("processors"): we share data with vendors that host and operate the Service (see below) under contractual protections.
• Legal and safety disclosures: we may disclose information if required by law or to protect the Service and users.
• Business transfers: if we're involved in a merger/acquisition/asset sale, data may transfer as part of the transaction with appropriate safeguards.
• No sale/share for targeted ads: we do not sell personal information and do not share personal information for cross-context behavioral advertising.

Cookies, Local Storage, and Consent

We use "strictly necessary" cookies/storage to keep you signed in, maintain security, and prevent fraud/abuse. We may also use optional analytics technologies to understand performance and improve the Service.

Where required by law, we request consent before using optional (non-essential) cookies/storage. You can change choices through our cookie controls (where available) or your browser settings. Disabling storage may affect login/session functionality.

Service Providers and Subprocessors

Current providers typically include:

• Frontend hosting/CDN: Vercel
• Backend hosting: Render
• Database hosting: MongoDB Atlas
• Image hosting/CDN (profile photos): Cloudinary
• Email delivery and notifications: Resend (used to send transactional emails such as account verification, notifications, and important updates related to the platform)

We may add providers for email delivery, analytics, abuse prevention, and error monitoring. We maintain a subprocessor record and will update transparency disclosures as providers change. Where required, we enter data processing agreements (DPAs) and impose appropriate transfer safeguards.

International Transfers

Your data may be processed in the United States and other countries where we or our providers operate. Where required, we use appropriate safeguards such as EU Standard Contractual Clauses (SCCs), the UK Addendum/IDTA, adequacy decisions, and (where applicable) reliance on certified DPF participants.

Data Retention

We keep personal information no longer than necessary for the purposes described, unless law requires longer or we need it to protect the Service (e.g., safety investigations). Typical retention:

Your Privacy Rights and How to Exercise Them

Depending on your location, you may have rights to: access, correct, delete, restrict, object, portability, and withdraw consent (where consent is used). To submit a request, email support@researchc.app with (a) your account email, (b) request type, and (c) sufficient detail.

• Verification: we will verify your identity (e.g., by account login, email verification, or additional proof if needed).
• Timelines: we respond within legally required timeframes; complex requests may take longer with notice.
• EEA/UK complaints: you may lodge a complaint with your local supervisory authority.

California Notice (CCPA/CPRA)

For California residents, we provide notice at collection and honor rights to know/access, delete, correct, and other rights where applicable. We collect categories such as identifiers (name/email), professional/education information (institution/department), internet activity (usage logs/engagement), and user-generated content (messages/postings). We use this data to operate the Service, provide matching, maintain security, and support users.

We do not sell personal information and do not share personal information for cross-context behavioral advertising. If our practices change, we will update this Policy and provide required opt-out mechanisms (e.g., "Do Not Sell or Share My Personal Information") as applicable.

Children's Privacy and Under-18 Policy

ResearchC is intended for users 18 and older. We do not knowingly collect personal information from children under 13, and if we learn we collected such information, we will take steps to delete it. Users who are under 18 are not permitted to use the Service.

Security and Breach Response

We implement measures designed to protect personal information, including: TLS encryption in transit, password hashing, restricted access controls, secrets stored outside client code, database authentication, network access controls, backups, logging/monitoring, and incident response procedures.

If a personal data breach occurs, we will take steps to investigate, mitigate harm, and provide legally required notifications.

Law Enforcement and Legal Requests

We may disclose information if we believe in good faith it is required by law or necessary to protect rights, safety, or the integrity of the Service. We may challenge overbroad requests where appropriate.

IP/DMCA and Research Content Complaints

If you believe content on the Service infringes your copyright or violates your IP rights, contact support@researchc.app / kazunorif28@gmail.com with sufficient detail to identify the work and the allegedly infringing content. We may remove or restrict content and may request additional information. If you wish to submit a formal DMCA notice/counter-notice (US), you may do so via the same contact.

Changes to This Policy

We may update this Policy from time to time. We will post the updated version and revise the "Last Updated" date. Continued use after changes means you accept the updated Policy where permitted by law.

Data Type, Retention, Legal Basis, and Access Controls Map