Privacy Policy

Last updated: July 25, 2026

Abstracted (“we”, “us”) operates a personalized scientific research newsletter service at abstracted.science. This policy explains what personal data we collect, why, how long we keep it, and the rights you have over it. The data controller is Massimo Giovanni Brivio.

1. Data We Collect

  • Account data: your email address and a hashed password, collected at sign-up. Authentication is handled by Supabase Auth, which also stores GitHub or Google identifiers if you sign up via OAuth.
  • Profile data: job field and seniority level. Both are optional and can be skipped during onboarding. You can edit them at any time from the dashboard.
  • Research interests: the natural-language topic subscriptions you create (e.g. “transformer architectures”). Each subscription is translated by OpenAI into API-compatible queries and stored alongside a vector embedding used for semantic paper matching.
  • Summary preference: your choice of “hobbyist” or “expert” summary style, set from the dashboard.
  • Newsletter content: the generated HTML newsletter we deliver to you, including AI-generated summaries of the papers selected for your interests.
  • Email engagement data: email opens and link clicks, tracked via our link-tracking service to measure relevance. Each click record contains your user ID and the paper URL you clicked.
  • Referral data: if you use the referral feature, we store your name, an optional LinkedIn URL, an optional personal description, and up to 5 friend email addresses you invite. Invited emails are checked against existing users; those already registered are not stored.
  • Authentication logs: your IP address is used for rate-limiting sign-up, sign-in, and password-reset attempts via Upstash Redis. These entries expire automatically per the rate-limit window and are not retained long-term.

2. How We Use Your Data

  • To fetch relevant papers from Semantic Scholar and CrossRef based on your topic subscriptions.
  • To generate AI summaries of those papers using OpenAI models.
  • To deliver bi-weekly newsletters to your inbox via Resend.
  • To measure which papers you open and click, so we can improve relevance ranking and summary quality.
  • To prevent abuse (rate limiting on sign-up, sign-in, and password reset) and detect unsafe content via OpenAI moderation.
  • To send referral invitation emails on your behalf, if you use the referral feature.

3. Legal Basis (GDPR Art. 6)

  • Contract (Art. 6(1)(b)): account, profile, subscriptions, summary preferences, and newsletter delivery are necessary to provide the service you signed up for.
  • Consent (Art. 6(1)(a)): email open/click tracking and Vercel Analytics. You can opt out of tracking by blocking images in your email client, or by emailing us to disable analytics.
  • Legitimate interest (Art. 6(1)(f)): IP-based rate-limiting and abuse prevention.

4. Third-Party Processors

  • Supabase (Netherlands / EU) — authentication and database hosting.
  • OpenAI (United States) — query translation, summary generation, and content moderation.
  • Resend (United States) — email delivery and audience management.
  • Upstash (EU / US regions) — Redis-based rate limiting.
  • Vercel (United States) — hosting and anonymous traffic analytics.
  • Semantic Scholar and CrossRef — public paper-metadata APIs. We send them search queries derived from your subscriptions; they do not receive your identity.

Where your data is transferred outside the EU/EEA (e.g. to OpenAI, Resend, or Vercel in the United States), the transfer is protected by Standard Contractual Clauses adopted by the European Commission, or by an adequacy decision where one applies.

5. Data Retention

  • Account and profile data: retained until you delete your account. Deleting your account from the dashboard performs a soft-delete: your account is deactivated, your email is removed from the Resend audience, and you can no longer sign in. To request full hard deletion of all your records, email privacy@abstracted.science and we will erase your data within 30 days.
  • Newsletter content and email engagement data: retained for 12 months after delivery, then automatically purged.
  • Rate-limit logs: expire automatically per the Upstash TTL window; no long-term retention.
  • Referral data: retained for the lifetime of the referrer's account. Invited emails that never register are removed when the referrer's account is deleted.

6. Your Rights (GDPR Arts. 15–22)

  • Access (Art. 15): request a copy of the personal data we hold about you.
  • Rectification (Art. 16): update your profile from the dashboard, or email us to correct inaccurate data.
  • Erasure (Art. 17): delete your account from the dashboard, or email us for full hard deletion.
  • Portability (Art. 20): request an export of your subscriptions and profile in a machine-readable format.
  • Objection (Art. 21): opt out of email tracking or analytics by emailing us.
  • Restriction (Art. 18): request that we limit processing of your data in specific circumstances.
  • Lodge a complaint (Art. 77): with your local data protection authority, or with the Italian Garante per la Protezione dei Dati Personali at garanteprivacy.it.

To exercise any of these rights, email privacy@abstracted.science. We will respond within one month, as required by GDPR Art. 12(3).

7. Security

All database access is governed by row-level security policies, so each user can only read and modify their own data. Authentication uses JWT tokens issued by Supabase Auth. API routes that process newsletters require a service-role key. User-supplied text (query subscriptions, referral name and description) is sanitized before being rendered in newsletters to prevent markup injection. Passwords are hashed by Supabase Auth and never stored in plaintext.

8. Children's Data

The service is not directed at individuals under 16, and we do not knowingly collect personal data from them. If you believe we have collected data from a minor, please contact us and we will delete it.

9. Changes to This Policy

We may update this policy as the service evolves. Material changes will be announced via email or a notice on the website. The “Last updated” date above always reflects the current version.

10. Contact

Data controller: Massimo Giovanni Brivio. For any privacy-related question, request, or complaint, write to privacy@abstracted.science.

Privacy Policy - Abstracted