1. Who is responsible for your information?
Nigel Holland is the data controller responsible for personal information collected through ResearchBuddy and is registered with the Information Commissioner’s Office (ICO).
You can contact the data controller about privacy, data protection, or the exercise of your information rights through the ResearchBuddy contact form.
2. Information we collect
- Account data: name, email address, encrypted password hash, verification status, and account timestamps.
- Research data: questions, subjects, academic levels, generated guidance, sources, integrity flags, and saved session history.
- Usage and security data: token balances and ledger entries, session identifiers, security tokens, and technical logs produced by the server.
- Support data: name, email, topic, and message submitted through the contact form.
- Purchase data: token pack, Paddle customer and transaction identifiers, currency and transaction total. Paddle processes payment-card details; ResearchBuddy should not receive complete card details.
- Analytics data: device, browser, approximate location, pages, and interactions when you consent to Google Analytics.
Please do not include unnecessary personal data, confidential records, or special-category information in research questions.
3. Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Create accounts, provide research guidance, save history, manage tokens, and fulfil token purchases. | Performance of our contract with you, or steps requested before entering one. |
| Secure accounts, prevent misuse, diagnose faults, and protect the service. | Our legitimate interests in operating a safe and reliable service; legal obligation where applicable. |
| Send verification, password-reset, service, and purchase communications. | Contract and legitimate interests. These are transactional, not optional marketing emails. |
| Answer contact and support enquiries. | Legitimate interests and steps taken at your request. |
| Measure site use with Google Analytics. | Your consent, which can be withdrawn at any time. |
| Keep financial and compliance records. | Legal obligation. |
We do not use ResearchBuddy to make solely automated decisions that have legal or similarly significant effects on users.
5. Retention
Account and saved research data are retained while an account remains active and afterwards only as long as reasonably needed for security, disputes, legal obligations, or backup rotation. Contact enquiries are normally retained for up to 24 months after resolution. Token purchase and transaction records may be retained for the period required by tax and accounting law. Analytics retention follows the configured Google Analytics property settings.
6. Security
ResearchBuddy uses password hashing, HTTP-only session cookies, CSRF protection, account ownership checks, and server-side API credentials. No internet service is completely secure, so users should use a unique password and avoid submitting sensitive information.
7. Your rights
Depending on the circumstances, UK data protection law may give you rights to access, correct, erase, restrict, or receive your personal information, and to object to certain processing. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.
Your right to object: you may object to processing based on our legitimate interests. We will stop unless we demonstrate compelling legitimate grounds or need the information for legal claims.
Use the contact form to make a request. We may need to verify your identity. You may also complain to the Information Commissioner’s Office.
8. Children and students
ResearchBuddy is designed for students and may be accessed by people under 18. We aim to minimise collection, keep optional analytics off by default, and avoid advertising profiles. Users under 13 must not create an individual account unless a parent, guardian, school, or other authorised adult has approved the account and any consent relied upon is valid. Schools and institutions remain responsible for their own notices and lawful basis when providing managed access.
9. Changes
We will review this notice as the product, suppliers, and law change. Material changes will be brought to account holders’ attention where appropriate.