Privacy Policy

Last updated: 24 July 2026

This Privacy Policy explains how EvidenceBee ("we", "us", "our") collects, uses and protects personal data when you use our website and platform for managing systematic reviews and meta-analyses (the "Service"). We act as the data controller for the personal data described below. We are committed to complying with the EU General Data Protection Regulation (GDPR) and applicable data-protection law.

1. Who we are & how to contact us

EvidenceBee is a service operated by EvidenceBee SAS, a French société par actions simplifiée with its registered office at 146 rue Guillaume Leblanc, 33000 Bordeaux, France. EvidenceBee SAS is the data controller for the personal data described in this policy. For any privacy question, or to exercise your rights, contact us at support@evidencebee.com. Full company details are set out in our Legal notice.

2. Information we collect

a. Account information

When you register we collect your name, email address, an encrypted (hashed) password, and any organisation or profile details you provide. If you sign in with a third-party provider, we receive basic profile information from that provider.

b. Research content you upload

To provide the Service we store the content you create or import into your projects - bibliographic references, uploaded full-text PDFs, screening decisions, extracted data, notes and analysis results. This is your content; we process it only to operate the Service on your behalf.

c. Author-contact data

The Service can retrieve corresponding-author email addresses from public sources (e.g. PubMed, CrossRef, Unpaywall, or full-text PDFs) so you can contact study authors. Where this data relates to identifiable people, you are responsible for having a lawful basis for any outreach you send.

d. Usage & technical data

We collect log and device data - such as IP address, browser type, pages viewed and timestamps - to keep the Service secure and reliable, and to diagnose problems.

e. Payment data

When paid billing is enabled, payments are processed by our payment provider (Stripe). We do not store your full card details; we retain only limited billing metadata (e.g. plan, status, invoices).

3. Cookies

We use strictly necessary cookies to keep you signed in and to secure the Service (session and authentication cookies, CSRF protection). We do not use third-party advertising or cross-site tracking cookies.

4. How we use your data

• To provide, maintain and secure the Service and your projects;
• To authenticate you and manage team collaboration and permissions;
• To send transactional email (invitations, notifications, author outreach you initiate) via our email provider;
• To process subscriptions and payments (when billing is enabled);
• To provide support and respond to your requests;
• To detect, prevent and address fraud, abuse and security issues;
• To comply with legal obligations.

5. Legal bases (GDPR Article 6)

We rely on: performance of a contract (to provide the Service you signed up for); legitimate interests (to secure and improve the Service, where not overridden by your rights); consent (where specifically requested, which you may withdraw at any time); and legal obligation (e.g. tax and accounting).

6. AI reviewer & third-party AI providers (bring your own key)

The Service offers an optional AI reviewer. When you enable it, you supply your own API key for a third-party large-language-model provider (such as Anthropic, OpenAI or Google). The reference or full-text content you choose to review is sent to that provider, using your key, and is processed under their terms and privacy policy. We do not use your research content to train any AI model. Your API key is stored encrypted. If you do not enable the AI reviewer, no content is sent to any AI provider.

7. Service providers & data sharing

We share personal data only with processors that help us run the Service, under appropriate agreements, including: hosting and object storage (for the application and uploaded PDFs), our email provider (Mailgun) for transactional mail, and our payment provider (Stripe) for billing. When you use certain features, your queries may be sent to external research services you invoke - PubMed / NCBI, CrossRef and Unpaywall - which may include identifiers such as DOIs, titles or PMIDs. We do not sell your personal data.

8. International transfers

Some of our processors may be located outside the European Economic Area. Where that is the case, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect your data.

9. Data retention

We keep account and project data for as long as your account is active or as needed to provide the Service. You can delete your projects and content at any time. Some records (e.g. email-campaign history) are retained for a limited period and then purged, and we may retain limited data where required for legal, tax or security reasons. Backups are rotated on a routine schedule.

10. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. Where we rely on consent, you may withdraw it at any time. To exercise any of these rights, email support@evidencebee.com. You also have the right to lodge a complaint with your data-protection supervisory authority (for example, the CNIL in France).

11. Security

We use technical and organisational measures to protect your data, including encryption in transit (HTTPS), encrypted storage of sensitive secrets such as AI API keys, access controls and least-privilege permissions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Children

The Service is intended for researchers and professionals and is not directed to children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the "Last updated" date above. Material changes will be communicated as appropriate.

14. Contact

Questions about this policy or your data? Email support@evidencebee.com.