Privacy Policy

1. Information We Collect

We collect two types of information: information you actively provide and information we collect automatically.

Information You Provide

• Account Information — Email address and password you provide during registration (passwords are hashed, we cannot retrieve the original password)
• Chat Content — Your messages, prompts, and AI-generated responses
• Uploaded Files — PDFs, Office documents, images, and other files you upload
• Custom API Keys — If you choose to add your own OpenAI-compatible API Key, it is stored only in your browser's localStorage and never uploaded to our servers
• Payment Information — We do not collect your credit card or payment account information. Payments are processed by Stripe, which handles your payment data in accordance with its own privacy policy
• Communication Records — If you contact our support team, we collect your communication content and contact information

Information Collected Automatically

• Usage Data — How often you use the service, feature usage, credits consumed, page interactions, and other anonymous usage patterns
• Device & Log Information — IP address, browser type, operating system, device identifiers, page access times, and standard server logs
• Cookies & Local Storage — We use essential cookies to maintain login sessions and basic functionality. We do not use third-party tracking cookies for advertising purposes

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide Service — Process your chat requests, perform searches, fetch web pages, analyze files, and return results to you
• Account Management — Manage your registration, login, credit balance, and subscription
• Improve Product — Analyze aggregated usage patterns to optimize service performance, fix bugs, and improve user experience
• Security Maintenance — Detect and prevent abuse, fraud, unauthorized access, and other security threats
• Legal Compliance — Fulfill legal obligations and respond to lawful legal requests

3. Third-Party Services

PennyResearch relies on third-party services for AI inference, web search, content retrieval, database storage, and payment processing. Each service has its own privacy policy. Our agreements with these services prohibit them from using your data for their own model training.

4. Data Retention

• During Account Activity — Your data (chat history, files, account information) is retained while your account is active, accessible for you to view and manage at any time
• After Account Deletion — When you delete your account, we will delete all your data within 30 days, including chat history, uploaded files, and usage logs
• Legal Requirements — If laws, regulations, or government authorities require retention of certain data (such as tax-related payment records), we will retain that data for the legally required period and delete it thereafter
• Backups — Our database backups are automatically rotated and overwritten within 90 days. Data in backups is not used independently

5. Your Rights

You have the following rights over your data:

• Right of Access — You can view your chat history and account information through the product interface. Contact us for a more complete copy of your data
• Right to Rectification — You can update your personal information such as email in your account settings
• Right to Deletion — You can delete your account in settings, and we will erase your data within 30 days
• Right to Data Portability — You can request an export of your chat history and account data in a machine-readable format

GDPR Rights (for EEA Users)

If you are located in the European Economic Area (EEA), in addition to the above rights, you also have:

• Right to Restrict Processing — Request that we restrict the processing of your data under certain conditions
• Right to Data Portability — Request your data in a structured, commonly used, machine-readable format
• Right to Object — Object to our processing of your data based on legitimate interests
• Right to Lodge a Complaint — If you believe we have violated GDPR, you may file a complaint with your local data protection authority

CCPA Rights (for California Residents)

If you are a California resident, you also have:

• Right to Know — Know what personal information we collect, its sources, and how we use it
• Right to Opt-Out — Opt out of the "sale" of personal information (we do not sell personal information)
• Right to Non-Discrimination — Exercising your rights will not result in discriminatory service

Exercising the above rights is free of charge. We will respond promptly, typically within 30 days.

6. Data Security

• Encryption in Transit — All data transmissions are encrypted using TLS 1.2+
• Encryption at Rest — Data in our database is encrypted at rest
• Password Security — Passwords are hashed using bcrypt or an equivalent-strength algorithm before storage
• Access Control — We strictly limit internal access to user data; only core engineers can access it when necessary

7. Children's Privacy

PennyResearch is not intended for users under 18 years of age. We do not knowingly collect personal information from individuals under 18. If we discover that we have inadvertently collected information from a minor, we will immediately delete such data and terminate the associated account.

8. Policy Changes

We may update this Privacy Policy from time to time. For material changes (such as new types of data collection, changes in data processing methods, introduction of new third-party providers, etc.), we will:

• Send an email to your registered email address
• Notify you via an in-product banner
• Update the "Last updated" date at the top of this policy

Material changes will take effect 14 days after notification. Your continued use of the service after the changes take effect constitutes acceptance of the updated Privacy Policy.

9. Contact

If you have any questions, requests, or complaints regarding privacy matters, please contact us through the following channels:

• Privacy Email: privacy@pennyresearch.com
• General Support Email: support@pennyresearch.com

We will respond to privacy-related requests within 7 business days. If you are not satisfied with our response, you may lodge a complaint with your local data protection authority.