Draft — this policy describes the data Lacuna actually collects and how it is handled, but it has not yet been reviewed by a lawyer. Please consult counsel before relying on it.

Privacy Policy

Last updated: 13 June 2026

This policy explains what data Lacuna collects, why, and your rights over it. We collect only what the service needs — we do not sell your data or use it for advertising.

1. What we collect

Account data: your e-mail address and a hashed (never plaintext) password.
Research data you upload: corpora, effect tables and the cleaned/derived artefacts and analysis results produced from them.
Operational records: an append-only audit log of key actions, and standard server logs for security and reliability.

2. Why we use it

To provide the analysis service, keep your work reproducible, secure your account, and operate and improve the platform. The legal bases (where GDPR applies) are performance of our contract with you and our legitimate interest in running a secure service.

3. Where it lives and who processes it

Hosting/storage: our infrastructure provider (Railway) — a managed PostgreSQL database plus a persistent volume for content-addressed artefacts.
Scholarly providers: when you run an API query, the query is sent to keyless sources (OpenAlex, Crossref) to fetch records.
E-mail: a transactional e-mail provider delivers account messages (e.g. password reset) when configured.
Payments: if you subscribe, payment is handled by our payment processor (iyzico); we do not store full card details.

4. Retention

We keep your data while your account is active. When you delete your account, your account and all data in the workspaces you own are permanently removed. Audit-log entries may be retained as a security/integrity record.

5. Your rights

Access and export the data you have provided.
Correct your account details.
Delete your account and owned data (Settings → Account → Delete account).
Where GDPR/KVKK applies, object to or restrict certain processing — contact us to exercise these.

6. Security

Passwords are hashed with argon2id; sessions use signed tokens kept in httpOnly cookies; traffic is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.

7. Contact

Privacy questions or requests: dr.ofrencber@gaziantep.edu.tr. For Turkish users, see also our KVKK aydınlatma metni.