Privacy Policy

This Privacy Policy describes how Avidemic AB, a Swedish company ("we", "us"), handles personal information when you use Kahubi (the "Service"). The short version: you own your data, everything you put into Kahubi is private by default, we never use your content to train AI models, and we never sell it. The longer version follows.

1. Information we collect

Information you provide

• Account details: name, email address, password (stored as a salted hash), and optionally your university or organization.
• Research content: papers, PDFs, notes, manuscripts, datasets, interview audio/video and their transcripts, and anything else you upload or create in the Service.
• Billing information: processed by Stripe; we never see or store full card numbers.
• Correspondence: messages you send via the contact form or by email.

Information collected automatically

• Device and usage information: browser type, IP address, time zone, pages viewed, and how you interact with the Service, collected via log files and strictly necessary cookies.

2. How we use information

• To provide the Service: store your library, run AI requests you initiate, transcribe recordings you upload, compile manuscripts, and sync integrations you connect.
• To operate accounts: authentication, email verification, support, and service notices.
• To protect the Service: fraud and abuse screening (e.g. by IP address) and security monitoring.
• To improve the Service: aggregate, de-identified usage analytics.
• To process payments and manage subscriptions.

We do not use your research content to train AI models — neither our own nor third parties'. AI providers process your requests under API terms that exclude training on customer data. We do not sell personal information, and there are no ads on the platform.

Product analytics

We use Mixpanel with EU data residency for product analytics: events such as "draft compiled" or "flow created", tied to your account, so we can see which features help researchers and which need work. Analytics never includes your research content, is never used for advertising, and is never sold. On the public website (kahubi.com marketing pages), analytics runs only if you accept the consent banner — decline it and nothing is tracked there. Inside the signed-in workspace, this processing is part of operating and improving the Service (legitimate interest and contract, Art. 6(1)(b) and (f)); you can object at any time via team@kahubi.com.

3. Legal bases (GDPR)

• Contract: providing the Service you signed up for (Art. 6(1)(b)).
• Legitimate interests: security, fraud prevention, and service improvement (Art. 6(1)(f)).
• Legal obligation: bookkeeping and tax requirements (Art. 6(1)(c)).
• Consent: marketing communications, which you can withdraw at any time (Art. 6(1)(a)).

4. Sharing and subprocessors

We share personal information only with the subprocessors needed to run the Service, each for a single documented purpose:

• OpenAI / Microsoft Azure OpenAI — AI text generation and analysis for requests you make. API traffic is excluded from model training under provider terms.
• AssemblyAI (EU endpoint) — transcription of interview audio/video, processed within the European Union.
• Stripe — payment processing (PCI-DSS Level 1).
• SMTP2GO — transactional email delivery (verification, invitations, support replies).

If you connect optional integrations (e.g. Zotero, GitHub), data flows to those providers only when you use the integration, under their terms. We may also disclose information where required to comply with applicable law, regulation, or a valid legal request.

5. Storage, security, and international transfers

Data is stored on GDPR-compliant, encrypted infrastructure within the EU. Stored integration tokens are additionally encrypted at the application level and shown only in masked form. Passwords are hashed, transport is encrypted (TLS), and access to production systems is restricted. Where a subprocessor processes data outside the EU/EEA, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. We offer the same level of protection to users outside the EU (including under the CCPA and the Australian Privacy Act); Data Processing Agreements are available on request.

6. Retention and deletion

We keep your content for as long as your account exists. When you delete content, it is removed from the live Service and expires from backups on a rolling basis. If you delete your account — or ask us to at team@kahubi.com — we delete your account and associated content from our systems, retaining only what bookkeeping or other law requires (e.g. invoices). Subscription records are kept until you ask us to delete them, subject to those legal requirements. You can export your library and manuscripts at any time; there is no data lock-in.

7. Your rights

Under the GDPR (and similar laws elsewhere) you have the right to:

• access the personal information we hold about you;
• have it corrected, updated, or deleted;
• receive a portable copy of data you provided;
• restrict or object to certain processing;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a supervisory authority — in Sweden, the Integritetsskyddsmyndigheten (IMY).

To exercise any of these rights, email team@kahubi.com. We respond within the timelines the GDPR requires.

8. Information about researchers on public profile pages

Kahubi's public author profile pages (kahubi.com/authors) display information about researchers, who may not be Kahubi users. This information comes from OpenAlex, an open (CC0) catalog of scholarly metadata, and is limited to the public scholarly record: name, institutional affiliation, publication metadata, citation metrics, and ORCID identifier where one exists. We do not publish contact details or photos. Kahubi stores none of this information itself, apart from short-lived caching and any suppression requests described below.

Our legal basis for this processing is legitimate interest (Art. 6(1)(f) GDPR) in making the public scholarly record searchable and browsable — the same record already published by journals, indexes, and institutional pages.

If a profile concerns you, you can object to the processing or request erasure (Art. 17 and 21 GDPR) at any time: every profile page carries a claim-or-remove form ("Is this you?"), or you can email team@kahubi.com. A confirmed removal request hides the profile from Kahubi; the underlying OpenAlex record is not affected. You also have the right to lodge a complaint with the Swedish supervisory authority, the Integritetsskyddsmyndigheten (IMY).

9. Cookies

Kahubi uses strictly necessary cookies only: a session cookie that keeps you signed in, and local storage for preferences such as your theme and your analytics consent choice. Product analytics (see above) uses local storage rather than cookies, and on the public website only after you consent. We do not use advertising cookies. General information about managing cookies is available at allaboutcookies.org.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal information without parental consent.

11. Changes to this policy

We may update this Privacy Policy from time to time for operational, legal, or regulatory reasons. Material changes will be announced in the Service or by email before they take effect.

12. Contact

Privacy questions and requests: team@kahubi.com or the contact form. See also our Terms of Service and Compliance & Security overview.