Draft — under review, not yet in force. Not yet reviewed by a lawyer; bracketed items are to be completed.
| Topic | Notice |
|---|---|
| Controller | [Legal entity], [address]. Contact through the OSF project page until a dedicated address is published. |
| Account | Email address, a hashed password or one-time sign-in links, sign-in times, consent dates. |
| Profile | Handle, display name, research field, role, country, and optionally affiliation, ORCID iD, website and bio. Country and consent dates are never shown to others. |
| Shared work | Presets, sealed-record entries and bundle files, project listings, and their visibility settings. |
| Billing | Plan, subscription status, renewal or end dates and Stripe identifiers. Card details go to Stripe, never to RGSR. |
| Purpose | Running your account, showing what you choose to share, enforcing plan limits and billing a subscription you start. No sale of personal data; no advertising. |
| Processors | Supabase (database, sign-in, storage); Stripe (payments); Vercel (website hosting); Cloudflare Turnstile (a human check on the sign-in and sign-up forms, when it is switched on: it runs only on those pages and receives technical signals from your browser, not your account details). |
| Visibility | New profiles are private. A private profile and everything in it is visible only to you; on a public profile only items marked Public are visible. |
| Your controls | Export everything as JSON, correct anything, or delete your account (cancels any subscription immediately). Stripe may retain billing records as the law requires. |
| Retention | While your account exists; deletions apply at once to the live database; backups expire within [period]. |
| Updates emails | Only if you opted in at sign-up; switch off at any time on your account page. |