Privacy Policy

The data controller is Evidando, the research group that develops and operates SaiLR.

For any privacy questions or requests, contact us at privacy@evidando.com.

Access requests (name and email address)

When you submit the "Request Beta Access" form, we store your name and email so we can review your request and reply to you. Legal basis: legitimate interest (Article 6(1)(f) GDPR). Retention: 6 months after we process the request.

Account information (email address and name)

When we create an account for you, we store your email and name to identify you and provide access to the service. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Retention: for the duration of your account plus 12 months after your last activity. If you save your own database API keys (Scopus, Web of Science, Springer Nature), we store them encrypted. They are used only for your own searches, sent only to that database's provider, never shown again, and deleted when you remove them or when your account is deleted.

Research data (research questions, search queries, screening results)

SaiLR processes the literature review content you create: your research question, search strings, inclusion and exclusion criteria, and the screening decisions applied to papers. This data is stored in your account and used solely to provide the service. Legal basis: performance of a contract. Retention: 12 months after your last activity, or until you delete your data.

Uploaded full texts (PDF files)

At the full-text stage you can upload PDF files of papers that could not be retrieved automatically. We store each file and the text extracted from it on our servers, so the paper can be assessed and read next to its assessment. Both are deleted automatically 183 days (about six months) after you last worked on that review's full-text screening, data extraction or risk-of-bias assessment. The assessment, the short quotes it cites and your decisions stay with your research data. Legal basis: performance of a contract. Retention: 183 days after last use.

Usage and error logs

We log failed login attempts, search errors, and database failures to maintain the security and reliability of the service. Logs contain your email address, timestamps, and error details. Legal basis: legitimate interest. Retention: 90 days.

SaiLR uses AI models hosted by Microsoft (Azure OpenAI Service) to draft and check your review protocol, screen papers and summarise results. For this, your research question and its description, your review protocol (questions, criteria, search strings) and bibliographic data of the papers in your search results (titles, abstracts, keywords, author names, journal, year) are sent to the service. At the full-text stage, the text of the papers you assess is sent as well.

Microsoft acts as a data processor on our behalf under the Microsoft Products and Services Data Protection Addendum. The models run in Microsoft's Azure environment in Germany. According to Microsoft, your content is not available to OpenAI and is not used to train AI models. Content that Microsoft's automated abuse monitoring flags may be stored in Germany and reviewed by authorized Microsoft staff in the European Economic Area. You can review Microsoft's commitments at learn.microsoft.com/azure/foundry/responsible-ai/openai/data-privacy.

We do not send your name, email address, or account details to Microsoft's AI service, only the review content described above.

SaiLR uses one cookie:

This cookie is strictly necessary for the service to function. Under the ePrivacy Directive, strictly necessary cookies are exempt from the requirement to obtain consent. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies.

We also store your display name and session preferences in your browser's localStorage and sessionStorage. This data never leaves your browser except as part of normal API calls to the SaiLR service.

All your account and research data is stored on servers located within the European Union. We share data with two external processors, one for AI functionality and one for error monitoring:

We do not sell your data. We do not share your data with any other third parties except where required by law.

As a data subject in the EU/EEA, you have the following rights:

• Access (Art. 15): Request a copy of the personal data we hold about you.
• Rectification (Art. 16): Ask us to correct inaccurate data.
• Erasure (Art. 17): Ask us to delete your data ("right to be forgotten").
• Portability (Art. 20): Receive your research data in a machine-readable format (CSV or RIS export).
• Restriction (Art. 18): Ask us to restrict processing while a dispute is resolved.
• Objection (Art. 21): Object to processing based on legitimate interest.

To exercise any of these rights, email privacy@evidando.com with the subject line "Privacy Request". We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection supervisory authority. In Germany, this is the Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI).

We protect your data using industry-standard measures: HTTPS for all data in transit, bcrypt password hashing, HttpOnly session cookies that cannot be read by browser scripts, and encrypted storage for any API credentials you provide.

If you discover a security vulnerability, please report it to privacy@evidando.com before disclosing publicly.

We may update this policy when the service changes. The "Last updated" date at the top of this page reflects the most recent revision. We will notify registered users by email of any material changes.