Privacy Policy

1. Overview

This Privacy Policy explains how Recursity collects, uses, shares, and protects personal data when you use our websites and web application (the "Service"). It also explains your choices and rights, including how to contact us with questions or requests.

When we say “personal data” (or “personal information”), we mean information that identifies you or can reasonably be linked to you. Some information we process may not directly identify you (for example, aggregated usage analytics), but it may still be treated as personal data in some jurisdictions.

2. Key Privacy Principles

Our privacy approach is built around a few core principles. These are product and operational commitments we use to guide decisions about data collection, storage, sharing, and access.

• User-owned documents: You own the content you create and upload.
• No training on private content: We do not use your private documents or uploads to train AI models.
• Limited access: We restrict internal access and use role-based access controls.
• Purpose limitation: We process data to provide, secure, and improve the Service.

In practice, this means we aim to collect what we need to operate the Service, keep it secure, and support you, while avoiding unnecessary collection or secondary uses that are not aligned with the Service.

3. Information We Collect

3.1 Information you provide

You provide information directly when you create an account, upload content, configure settings, or contact support. Some fields are required to provide the Service (for example, an email address), while other fields are optional.

• Account information such as email address and profile fields you choose to provide
• Documents and content you create, upload, or store in the Service
• Sources you upload (e.g., PDFs) and related metadata
• Citations, references, and bibliographic metadata you add or import
• Support requests and communications

Documents and uploads may contain personal data depending on what you choose to include. For example, academic drafts may include names, affiliations, or personal notes.

3.2 Information collected automatically

When you use the Service, we automatically collect certain information needed for security, performance, and reliability. This helps us prevent abuse, debug issues, and understand how the Service is used.

• Usage data (how you interact with the Service and which features you use)
• Device and browser information
• IP address (for security, abuse prevention, and regional compliance)
• Performance and error/crash logs

We may derive approximate location from IP address for security and compliance purposes (for example, to enforce regional restrictions).

3.3 Payment information

If you purchase a paid plan, payments are processed by Lemon Squeezy. Recursity does not store your full payment card numbers.

We may receive limited payment-related information such as subscription status, plan tier, billing cycle, and transaction identifiers. We use this information to provide paid access, manage subscriptions, issue refunds (where applicable), and respond to billing-related support requests.

4. How We Use Your Information

We use the information we collect to operate, maintain, and improve Recursity. We do not use your private documents for unrelated advertising purposes.

• To provide and maintain the Service
• To authenticate users and secure accounts
• To store, render, and synchronize your documents and sources
• To run AI features you request (e.g., rewriting, summarization, grounded answers)
• To process subscriptions and manage billing status
• To monitor performance, prevent abuse, and ensure platform integrity
• To respond to support requests
• To comply with legal obligations

We may also use aggregated and de-identified information to understand overall product performance and improve reliability. Where required by law, we will obtain consent for analytics technologies.

5. Legal Bases (GDPR/UK GDPR)

Where GDPR/UK GDPR applies, we rely on one or more lawful bases for processing. The lawful basis depends on the context and the specific processing activity.

Common lawful bases include: contract (to provide the Service you request), legitimate interests (such as security, preventing abuse, and maintaining reliability), consent (for non-essential cookies/analytics where required), and legal obligation (compliance).

6. AI and Your Data

Recursity includes AI-assisted features (for example, rewriting, summarization, and source-aware assistance). When you choose to use an AI feature, the Service may process portions of your content to generate the requested output.

AI inference providers may include OpenAI and DeepSeek. We aim to minimize what is sent to providers and include only what is reasonably necessary for the feature to work.

• Training policy: We do not use your private documents to train AI models.
• Human review: We do not review your documents by humans unless needed for a support request, abuse investigation, or legal compliance.
• Data minimization: We aim to send only the data required to complete the requested AI task.

You are responsible for ensuring that any content you submit for AI processing is lawful and that you have the rights to submit it (including copyrighted materials). If you submit sensitive information, you do so at your discretion.

7. Sharing and Third-Party Processors

We use third-party service providers (processors) to operate Recursity. These providers help us host the Service, store content, deliver emails, process payments, run analytics, and handle error reporting.

Depending on your use, your data may be processed by providers such as:

• Vercel (hosting)
• Supabase (authentication and database)
• Cloudflare (storage)
• Lemon Squeezy (payments)
• OpenAI and DeepSeek (AI inference)
• PostHog (analytics)
• Sentry (error logging)
• Resend (email)

We share data with these providers only as needed to operate the Service, subject to contractual protections and appropriate safeguards.

We may also share information to comply with law, respond to lawful requests, enforce our policies, prevent abuse, and protect the rights, property, and safety of Recursity and others.

8. International Transfers

Recursity and our providers may process data in countries other than where you reside. For example, if you access Recursity from outside the United States, your data may be transferred to and processed in the United States or other jurisdictions.

Where required by law, we use appropriate safeguards for international transfers (such as contractual protections). The exact safeguards can vary depending on the provider and transfer pathway.

9. Retention

We retain personal data only as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention can vary based on the type of data and operational needs.

• Account data: retained while your account is active
• Documents and uploads: retained until you delete them
• Logs: retained for up to 12 months
• Backups: retained for up to 30 days
• Deleted accounts: purged within 30 days (subject to backups and legal requirements)

When you delete content, it may remain in backups for a limited period. We do this for disaster recovery and service integrity. After the backup window, deleted content is removed from backup rotations under normal operations.

10. Security

We use technical and organizational measures designed to protect personal data from unauthorized access, disclosure, alteration, or destruction.

Measures may include encryption in transit (TLS), encryption at rest (where supported), role-based access controls, limited internal access, tenant isolation where applicable, and audit logging. No system can be guaranteed 100% secure, so you should also protect your account (for example, by choosing a strong password and keeping credentials confidential).

11. Your Rights

Depending on your location and applicable law, you may have rights regarding your personal data. These may include the right to request access, correction, deletion, portability, or information about how your data is processed.

We will take reasonable steps to verify your identity before fulfilling certain requests. We may also decline requests where an exception applies under law (for example, if fulfilling a request would compromise another person’s privacy or conflict with a legal obligation).

California residents may have additional rights under CCPA/CPRA, including an opt-out of certain “sale” or “sharing” practices where applicable. Recursity does not run advertising pixels, and we provide an opt-out mechanism where required.

12. Cookies

For details on the categories of cookies used and your choices, see our Cookie Policy.

13. Children’s Privacy

Recursity is not intended for individuals under 16. We do not knowingly collect personal data from anyone under 16.

If you believe a minor under 16 has provided personal data to us, contact us and we will take steps to investigate and, where appropriate, delete the information.

14. Contact

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact:

Privacy: privacy@recursity.com