PRIVACY NOTICE

ABOUT THIS NOTICE

This Privacy Notice for OpenWorldLab ("we," "us," or "our") describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:

• visit our website at openworldlab.org, or any website of ours that links to this Privacy Notice;
• create an account, join or run a group, publish articles, sparks, comments, jobs, or events, send messages, or use our research tools;
• contribute to, or raise funds through, a fundraising campaign; or
• engage with us in other related ways, including by contacting us, reading our emails, or attending our events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. This notice should be read together with our Terms of Use and, if you use the fundraising features, our Fundraising Policy.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by following the link after each key point or by using the table of contents.

What personal information do we process? When you visit, use, or navigate our Services, we process personal information depending on how you interact with us and the Services, the choices you make, and the features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not ask for sensitive personal information.

Do we collect any information from third parties? Only from the services you choose to connect — such as Google, GitHub, LinkedIn, or ORCID when you sign in or link an account — from our payment processor, Stripe, and from public scholarly databases used by our research tools. We do not buy data from data brokers or marketing partners. Learn more about information collected from other sources.

Do we sell your information or use it for advertising? No. We do not sell personal information, we do not show third-party advertising, and we do not let advertisers track you on our Services.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, keep the Services and their users safe, meet our payment and sanctions obligations, and comply with law. Learn more about how we process your information.

In what situations and with which parties do we share personal information? With the service providers that help us run the Services, with other users as the features you use require, and where the law requires it. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located, the applicable privacy law may give you certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way is to submit a request through our contact page, or to email us at privacyquery@openworldlab.org. We will consider and act upon any request in accordance with applicable data protection laws.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, fill in your profile, publish or send content, join or run a group, contribute to or run a fundraising campaign, or contact us.

Personal Information Provided by You. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the features you use. It may include:

• Account details — your name, username, email addresses, and password (which we store only as a one-way hash). If you turn on two-factor authentication, we store what is needed to check your codes and your recovery codes.
• Profile details — the kind of account you have (for example student, researcher, or institution), your bio, website and social media links, profile and cover pictures, country, organisation or job title, research interests, whether you are open to collaboration, supervision, or positions, and, if you choose to give it, your date of birth.
• Affiliations and identifiers — the institutions you add to your profile and the institutional email address you verify them with, and your ORCID iD if you link it.
• Content you create — articles, sparks, comments, polls and poll votes, reposts, job and event listings, feedback and suggestions, fundraising campaigns and their updates, and the files and images you attach to them.
• Messages — the direct messages and group chat messages you send, and when you have read messages sent to you.
• Group information — the groups you create, join, follow, or help run, and the role and privileges you hold in them.
• Preferences — your notification, email, and appearance settings, and your subscriptions to newsletters and announcements.
• Contributions — when you back a campaign: the amount, currency, billing country, the email address for your receipt, the display name you choose or your choice to appear anonymously, and any public message you leave.
• Communications with us — what you tell us through the contact form, feedback, moderation reports and appeals, or by email.

Sensitive information

We do not ask for sensitive information. Please do not include it in your profile, posts, or messages.

Payment data

Payments are processed by Stripe. When you contribute to a campaign, you enter your card or other payment details on Stripe's hosted checkout; they are handled and stored by Stripe and never reach our servers. Groups that raise funds give the identity and business verification information Stripe requires to Stripe directly. We receive from Stripe the status of each payment, refund, and dispute, and the verification status of each group's account. You can find Stripe's privacy notice at stripe.com/privacy. More about how fundraising works is in our Fundraising Policy.

Sign-in and linked account data

You can register and sign in with your Google, GitHub, or LinkedIn account, and you can link your ORCID iD to your profile. If you do, we receive certain information about you from that provider, as described in "HOW DO WE HANDLE SIGN-IN WITH OTHER ACCOUNTS?" below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not by itself reveal your identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, referring URLs, country, and information about how and when you use our Services. We need it to keep the Services secure and working, to meet our legal obligations, and for the analytics described in "DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?" below. The information we collect includes:

• Log and usage data. Service-related, diagnostic, usage, and performance information our servers automatically record when you use the Services, such as your IP address, the pages you visit and the actions you take, the time of each request, and error reports. When something goes wrong in your browser, we may record the error, the page it happened on, and, if you are signed in, your account.
• Session data. Each time you sign in we record your IP address, browser, and device type against that session, so that you can review your signed-in devices and sign them out from your account settings, and so that we can detect suspicious sign-ins.
• Location data. We work out the country (and, for some countries, the region) your IP address belongs to, using a database that runs on our own servers. We use it to apply sanctions controls to the fundraising features and to count readers by country. We do not use GPS or ask your device for its precise location.

Google API

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information collected from other sources

In Short: We collect limited data from services you choose to connect, from our payment processor, and from public scholarly databases.

• Sign-in providers (Google, GitHub, LinkedIn): your name, email address, and the identifier the provider uses for your account.
• ORCID: your ORCID iD, confirmed by you signing in to ORCID.
• Stripe: the outcome of payments, refunds, and disputes, and the verification status of groups that raise funds.
• Our email delivery provider: whether an email we sent you was delivered, bounced, or marked as spam, so that we stop sending to addresses that no longer work.
• Public scholarly databases such as OpenAlex: publicly available information about researchers and their publications, which our literature and research-area tools display and search.

We do not buy personal information from data brokers or marketing partners.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, to meet our payment and sanctions obligations, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To create and manage your account, sign you in, and keep your account secure, including two-factor authentication and the list of your signed-in devices.
• To provide the Services you ask for — publishing your content, running your groups and their privileges, showing you feeds and search results, listing jobs and events, and providing our research tools.
• To enable communication between users, through comments, direct messages, and group chats.
• To run fundraising — reviewing and screening campaigns, processing contributions, refunds, and disputes through Stripe, sending receipts, and keeping the records the law requires. See our Fundraising Policy.
• To send you notifications in the app, by email, and, if you allow it, as browser push notifications, according to your notification settings.
• To send administrative information about the Services, your account, and changes to our terms and policies.
• To send newsletters and platform announcements, in accordance with your preferences. You can opt out at any time; see "WHAT ARE YOUR PRIVACY RIGHTS?" below.
• To show authors and groups how their content is read, using the privacy-preserving analytics described in "DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?" below.
• To award badges for milestones you reach on the Services, which appear on your profile unless you choose to hide them.
• To provide AI-assisted features you choose to use, as described in "DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?" below.
• To respond to your enquiries and offer support, and to request feedback about the Services.
• To moderate content and enforce our terms — reviewing reports, removing content or restricting accounts that break our Terms of Use, and handling appeals.
• To protect our Services, including fraud monitoring and prevention, rate limiting, spam detection, and sanctions screening.
• To identify usage trends and understand how the Services are used so that we can improve them.
• To save or protect an individual's vital interest, such as to prevent harm.
• To comply with our legal obligations, including tax, accounting, anti-money-laundering, and sanctions requirements.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill our legitimate interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose, such as browser push notifications or newsletters. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Performance of a Contract. We may process your personal information when it is necessary to fulfill our contractual obligations to you, including providing our Services, or at your request before entering into a contract with you.
• Legitimate Interests. We may process your information when it is reasonably necessary to achieve our legitimate interests and those interests are not outweighed by your interests and fundamental rights and freedoms. For example, we may process your personal information to: analyse how our Services are used so we can improve them; show authors and groups aggregate readership of what they publish; tell users about new features and announcements; moderate content and keep our users safe; and diagnose problems and prevent fraud and abuse.
• Legal Obligations. We may process your information where it is necessary for compliance with our legal obligations, such as keeping financial records, applying sanctions controls, cooperating with a law enforcement body or regulatory agency, exercising or defending our legal rights, or disclosing your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with the service providers that help us run the Services, with other users as the features you use require, and where the law requires it. We do not sell your personal information.

Service providers

We use the following kinds of service providers, each of which processes personal information only to provide its service to us:

• Payment processing — Stripe, for contributions, refunds, disputes, group account verification, and payouts.
• Email delivery — Google (Google Workspace) and, where we use it, Amazon Web Services (Amazon Simple Email Service), which send account, notification, and announcement emails on our behalf.
• File storage — IDrive e2, which stores the images and files you upload in its London data centre.
• AI model providers — Google, and depending on our configuration OpenAI or Anthropic, which receive the text needed to answer a request when you use an AI-assisted feature. See "DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?" below.
• Browser push services — if you turn on push notifications, the notification is delivered through the push service run by your browser's maker (for example Google, Mozilla, Apple, or Microsoft).

Other users and the public

• Your public profile and content. Your name, username, profile and cover pictures, bio, links, affiliations, ORCID iD, badges (unless you hide them), and the articles, sparks, comments, reposts, jobs, events, and campaigns you publish can be seen by other users and by anyone on the internet, including search engines, and may remain available outside the Services. Your bookmarks, and the lists of what you have liked and whom you follow, are shown only to you.
• Messages. Direct messages and group chat messages are visible to the people in that conversation, along with whether they have been read. Messages are stored on our servers and are not end-to-end encrypted.
• Groups. The owners and administrators of a group can see its members and their roles. Administrators of a group see aggregate reading statistics for what the group and its linked subgroups publish, as described in the analytics section below — never who read something.
• Fundraising. The group running a campaign can see each contribution's amount and billing country and, unless you chose to be anonymous, the display name you gave. Your name and total contributed may appear on the public backer list and on the contributor leaderboard; if you chose to be anonymous, you appear as "Anonymous". Your email address is not shared with the group. See the Fundraising Policy.
• Job and event listings. Applications and registrations happen on the external website or email address the poster gives. What you send them is governed by their own privacy practices, not this notice.

Moderators

If content is reported, our moderators — and, for content posted in a group, that group's moderators — see the reported content and the reason given. A report about a message includes a copy of the reported message and a limited number of the messages around it, taken from what the reporter could already see; moderators cannot otherwise read private conversations. The person reported is never told who reported them, and group moderators are not told who reported something if the reporter is not a member of their group.

Legal, safety, and business reasons

• Legal obligations and safety. We may disclose information to regulators, law enforcement, courts, auditors, or our payment partners where the law requires or permits it, including to meet sanctions and anti-money-laundering obligations, or to protect the rights, property, or safety of our users, the public, or ourselves.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of any information that you share with third parties that we link to but are not affiliated with our Services.

The Services link to third-party websites, online services, and applications that are not affiliated with us — for example the application pages of job listings, the registration pages of events, publishers of research papers, and links users include in their posts. We do not make any guarantee regarding any such third parties, and we will not be liable for any loss or damage caused by their use. The inclusion of a link does not imply an endorsement by us. Any data collected by third parties is not covered by this Privacy Notice. You should review the policies of such third parties and contact them directly to respond to your questions.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use only the cookies needed to sign you in and keep your account secure. We measure how content is read ourselves, without cookies, and we do not allow third parties to track you on our Services.

Cookies and local storage

We set a small number of cookies, all of which are strictly necessary for the Services to work:

• a session cookie that keeps you signed in, and a cookie that remembers whether you asked to stay signed in;
• short-lived cookies that protect a sign-in, account-linking, ORCID-linking, or two-factor set-up step from being tampered with, and that remember which page to return you to after you sign in.

Some of our interactive pages, such as the simulations, save your display settings in your browser's local storage. If you turn on push notifications, your browser also stores a subscription so that it can receive them.

We do not use advertising cookies, and we do not permit third parties to place cookies or other tracking technologies on our Services for analytics or advertising. Because none of these technologies is used to sell or share your personal information, there is nothing to opt out of; you can still block or delete cookies in your browser, though you will not be able to stay signed in if you do.

Email analytics

Newsletters and platform announcements we send you contain a small, invisible image, and links that pass through our own servers before forwarding you to their destination. When your mail application loads that image, or you follow one of those links, we record that the message was opened or the link was clicked, along with the time, a one-way hash of your IP address, and a general description of the mail application or browser used. We do not store the IP address itself, we do not use any of this to build advertising profiles, and we do not share it with advertisers.

We use this for two purposes. The first is analytics: understanding which announcements are read and which are ignored, so that we send fewer and better ones. The second is security and delivery integrity: unusual open and click patterns are how we notice that our mail is being forwarded in bulk or used in a phishing attempt against our members, and delivery outcomes are what tell us an address has stopped working so we can stop mailing it.

These records are kept only as long as they are useful for those purposes and are then deleted automatically. Some mail applications — Apple Mail Privacy Protection and Gmail's image proxy among them — load images on your behalf whether or not you read the message; where we can tell, we mark such an open as machine-generated rather than yours. Email about your own account, such as password resets and security alerts, is not measured this way. You can stop receiving newsletters and platform announcements at any time, using the unsubscribe link at the foot of any such message or from your notification settings.

How posts and pages are read

We measure how the posts, jobs, events, fundraising campaigns and group and profile pages on the Services are read, so that their authors and the groups that publish them can see what reaches people. We do this ourselves, on our own servers; no third party is involved. We record when a page or a post in a feed was on your screen, how long you spent actively reading it, how far through it you scrolled, and whether you applied, registered, went to contribute, shared it or followed a link out of it.

With each of these we record how you arrived (for example from a feed, a search, a notification, or another website, of which we keep only its domain name), the kind of device (phone, tablet or computer), and the country your IP address is in. We look the country up in a database on our own servers and do not store the IP address. If you are signed in we also record the kind of account you have (student or researcher, for example), the research fields you chose, and whether you are a member or follower of the group that published what you read.

To count how many different people read something without cookies, each record carries a key made from your account if you are signed in, or from your IP address and browser description if you are not, combined with a secret of ours. For signed-out readers the secret changes every day and is deleted after 48 hours, after which a key cannot be linked to anyone or to any other day. No cookies, local storage or similar technologies are used for any of this, and nothing is tracked on other websites.

These individual records are deleted after 90 days. What is kept after that is only counts: how many reads, how much reading time, and how many readers of each kind, per post and per period, together with estimates of distinct readers that cannot be turned back into a list of anyone. Authors and group administrators see those counts for what they published, and the administrators of a group see them for the groups linked beneath it. Nobody is shown who read something, and any group of fewer than five readers is merged into “Other” so that a count cannot point to a person.

If your browser sends a Global Privacy Control or Do Not Track signal, we still count that a page was read, but record nothing about you: no key, no country and nothing from your account, only how you arrived and the kind of device. We do not use any of this for advertising and do not share it with advertisers.

Invitation links

Some of our introductory pages are shared through personal invitation links. When one of these pages is opened, we record how far through it the reader scrolled, which sections they reached, how long the page was visible, which links into the Services they followed, and whether the screen was narrow. The visit is identified only by a random value created for that page load; nothing is stored on your device, and no account, IP address, or location is recorded with it.

7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: Yes. Some optional features send text to an AI model provider to produce an answer or a draft. We tell you which features these are, what is sent, and how long we keep it.

As part of our Services, we offer features powered by artificial intelligence ("AI Products"). You never have to use them, and they are only used when you ask. They are provided through third-party model providers — Google (Gemini) by default and, depending on our configuration, OpenAI or Anthropic.

Our AI Products

• Explanations of passages in articles. When you select a passage in an article and ask for an explanation, we send the passage, the surrounding text of the article that the model needs for context, and any question or note you add. We do not send your name, email address, or account details. We keep the request and the answer with your account so that you can see them again and so that we can apply fair-use limits. An answer may be reused for another reader who asks about the same passage, but it is never shown with your name.
• AI article studio (preview). You can upload research papers (as PDF files) and ask for a readable article to be drafted from them. Uploaded files are kept in private storage that is not publicly accessible, and their text is extracted by a service that runs on our own servers; original files are kept until you choose to delete the source or project. Deleting a source removes its original file, extracted text and figure crops from the project; existing drafts and published articles remain. The extracted text, your instructions, and your drafts are sent to the model provider to write and revise the article. The extracted text, drafts, and revision history are kept in your project until you delete it. Please do not upload work that is under embargo, confidential, or that you do not have the right to use.

How we process your data using AI

All personal information processed using our AI Products is handled in line with this Privacy Notice. We use these providers' paid API services, whose terms do not allow them to use the text we send, or the answers they return, to train their models or improve their products. The provider processes the text only to return a result to us, and may keep it for a limited period to detect abuse and meet its legal obligations before deleting it. We do not use AI Products to make decisions about you that have legal or similarly significant effects — moderation and fundraising decisions are made by people. AI output can be wrong: check it before you rely on it or publish it.

Your use of AI Products is also subject to our Terms of Use.

8. HOW DO WE HANDLE SIGN-IN WITH OTHER ACCOUNTS?

In Short: If you choose to register or sign in with another account, or link your ORCID iD, we receive certain information about you from that provider.

Our Services let you register and sign in with your Google, GitHub, or LinkedIn account, and link an existing account to one of these so that you can use it to sign in. Where you choose to do this, we receive profile information from the provider — usually your name, email address, whether the provider has verified that address, and the identifier the provider uses for your account. If the email address the provider gives us already belongs to an account on the Services, we ask you to confirm before the two are linked.

You can also link your ORCID iD to your profile. We receive your ORCID iD after you sign in to ORCID, and show it on your profile as verified.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the Services. We do not control, and are not responsible for, other uses of your personal information by the provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps. You can manage linked accounts from your account settings.

9. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

We are based in the United Kingdom, and the images and files you upload are stored in London. Some of the service providers listed in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" — including Stripe, our email providers, and our AI model providers — process information in the European Union, the United States, and other countries. If you are accessing our Services from elsewhere, please be aware that your information may be transferred to, stored, and processed in those countries, which may not have data protection laws as comprehensive as those in your country.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we will take the measures the law requires to protect your personal information when it is transferred, such as relying on adequacy decisions or on standard contractual clauses with our service providers, and we will otherwise protect it in accordance with this Privacy Notice and applicable law.

10. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). In particular:

• Account, profile, and content — for as long as your account exists. When your account is closed, we delete or anonymise this information within two (2) months, except as described below.
• Signed-in sessions — until you sign out, revoke the session, or it expires, and at most 30 days.
• Reading analytics — individual records for 90 days, after which only aggregate counts remain, as described in the analytics section above.
• Email open and click records — only as long as they are useful for analytics and delivery integrity, after which they are deleted automatically.
• AI article studio — original files, extracted text and figure crops are kept until you delete the source or project. Drafts and revision history are kept until you delete the project. Published articles remain until you delete them separately.
• Fundraising and compliance records — at least 5 years from the relevant transaction or decision, even if your account, group, or campaign is deleted, because the law requires us to be able to produce them. See the Fundraising Policy.
• Moderation records — reports, decisions, and appeals, and content removed for breaking our Terms of Use, are kept for as long as we need them to enforce our terms, handle appeals, and prevent repeated abuse. Enforcement actions stop counting toward further action after 180 days.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

11. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. For example, passwords are stored only as one-way hashes, you can protect your account with two-factor authentication and review and sign out your sessions, uploaded research papers are kept in private storage, and card details never reach our servers. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

12. DO WE COLLECT INFORMATION FROM MINORS?

In Short: Young people aged 13 and over may use the Services with a parent or guardian's permission. We do not knowingly collect information from children under 13, and we never sell young people's information or use it for advertising.

Students and young people interested in research are welcome on the Services. You must be at least 13 years old to create an account, or older if the law where you live sets a higher age for agreeing to the use of your personal information online (in some countries of the European Union this is as high as 16). Users under 18 may only use the Services with the permission of a parent or guardian, who agrees to our Terms of Use and this Privacy Notice on their behalf.

We process the information of users under 18 in the same way as that of other users, as described in this notice, with these additional commitments:

• we do not sell their personal information, share it for targeted advertising, or send them marketing from third parties — as for every user;
• users under 18 cannot raise funds, so we do not collect payout or identity-verification information about them, and they may only contribute to a campaign with a parent or guardian's permission;
• we encourage users under 18 not to add their date of birth, contact details, or location to their profile, and not to share personal information in posts or messages; and
• the reading statistics shown to authors and groups are aggregate counts that never identify a reader, whatever their age.

A parent or guardian may ask to review, correct, or delete the personal information of their child under 18, or to close their child's account, by contacting us at privacyquery@openworldlab.org or through our contact page. We will take reasonable steps to confirm the request comes from the child's parent or guardian.

If we learn that we have collected personal information from a child below the minimum age, we will deactivate the account and take reasonable measures to promptly delete that information from our records, except where the law requires us to keep it. If you become aware of any such information, please contact us at privacyquery@openworldlab.org.

13. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or close your account at any time.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time — for example by turning off push notifications in your notification settings or your browser, or by contacting us using the details in "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. This will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of newsletters and announcements

You can unsubscribe from our newsletters and platform announcements at any time by clicking the unsubscribe link in the emails that we send, by changing your notification settings, or by contacting us. You will then be removed from those mailing lists. We may still send you messages that are necessary for your account and the Services — for example password resets, security alerts, receipts, and moderation notices.

Account information

If you would at any time like to review or change the information in your account or close your account, you can:

• sign in and update your profile, email addresses, linked accounts, notification preferences, and sessions from your account settings; or
• contact us through our contact page or at privacyquery@openworldlab.org.

Upon your request to close your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and comply with applicable legal requirements, as described in "HOW LONG DO WE KEEP YOUR INFORMATION?".

Cookies and similar technologies

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject cookies. Because we only use cookies that are needed to sign you in, rejecting them will stop you from staying signed in. See "DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?".

14. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") setting, and some also send a Global Privacy Control ("GPC") signal, to tell websites that you do not want data about your online browsing activities monitored and collected.

We honour both. If your browser sends either signal, our reading analytics record nothing about you, as described in "How posts and pages are read". We do not track you across other websites, sell your personal information, or use it for targeted advertising, whether or not your browser sends these signals.

15. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of certain US states, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our support channels;
• Participation in surveys or feedback; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

We keep each category for the periods described in "HOW LONG DO WE KEEP YOUR INFORMATION?".

Sources of Personal Information

Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?"

Will your information be shared with anyone else? We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

How to Exercise Your Rights

To exercise these rights, you can contact us through our contact page, by emailing us at privacyquery@openworldlab.org, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

16. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws and to reflect changes to the Services.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact us by email at privacyquery@openworldlab.org, or through our contact page.

18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. Much of your information can be reviewed and updated directly from your account settings. To request to review, update, or delete your personal information, please submit a request through our contact page or email us at privacyquery@openworldlab.org.