Legal information

Privacy

How private research stays private, what is sent to AI providers, and how operational analytics, retention, and preferences are handled.

Scoped access

Provider requests

Retention

Your rights

Version 1.0.0 · Effective 2025-09-23 · Canada · PIPEDA (Personal Information Protection and Electronic Documents Act). privacy@neuromaven.org.

All legal documents Terms License Contact

What we collect

account data

email
display_name
password_hash
organization/affiliation (optional)

usage data

prompts/queries and model outputs
timestamps
approximate location (derived from IP; truncated/anonymized where feasible)
device and browser metadata (user agent, screen size)
feature interaction logs and error reports

content uploads optional

files you upload (e.g., scripts, small text samples)
links to datasets or notebooks

Do not upload protected health information (PHI) or personal health data.
Do not upload identifiable human subject data unless you have rights and proper consent.

support communications

emails/messages to maintainers
bug reports
feedback content

cookies and local storage

strictly_necessary
functional
analytics (with consent)

Cookie banner with opt-in for analytics; browser settings respected.

How data is used

Provide, operate, and secure NeuroMaven features.
Debug, monitor, and improve performance and reliability.
Measure quality and safety of model outputs (with minimization and retention limits).
Conduct non-commercial academic research and evaluation with aggregated or de-identified data, where feasible and ethically appropriate.
Communicate important changes, security notices, and service updates.

Not used for

Clinical diagnosis or treatment decisions.
Profiling that produces legal or similarly significant effects without consent.
Selling personal information.

Sharing and transfers

Supabase (auth/storage, if used) — Canada/US (confirm region)

Neon/PostgreSQL (database, if used) — Canada/EU/US (confirm region)

Qdrant (vector DB, self-hosted or managed) — Confirm deployment region

RunPod / Cloud GPU provider (training/inference) — Confirm region per deployment

Hugging Face Hub (model hosting) — Global CDN; confirm repository settings

Personal information may be processed in other jurisdictions (e.g., US/EU).

We may disclose information if required by law or to protect rights, safety, or security.

Security and retention

Encryption in transit (TLS).
Restricted access to production credentials.
Role-based access controls and least privilege.
Audit/logging of admin access.
Regular dependency updates and vulnerability scanning.

account data: For the life of the account and up to 90 days after deletion for backups.

usage logs: 30–180 days, minimized and aggregated where possible.

uploads: Until you delete them or as required to provide the feature; regular sweeps remove orphaned files.

We will investigate, mitigate, and notify affected users and regulators as required by law in the event of a data breach.

Your rights and contact

Request access to and correction of your personal information.
You may withdraw consent for non-essential processing (e.g., analytics) at any time.
We can provide machine-readable exports where feasible.
Contact our Privacy Lead first (privacy@neuromaven.org).
Office of the Privacy Commissioner of Canada (OPC) and, where applicable, provincial privacy commissioners.
Transactional messages related to your account are required.
Sent only with opt-in consent; you can opt out anytime.

NeuroMaven (Research/Student Project) · privacy@neuromaven.org · University of Toronto Mississauga, Mississauga, ON, Canada

Loading page...