Privacy notice

Last updated: 26 October 2026

This notice explains how personal data is used in the NullYield beta, including accounts, research records, private drafts, groups and optional AI drafting.

Who is responsible and how to contact us

NullYield is jointly operated by Matus Bagin and Romana Caposova in Germany. Contact details are in the Imprint.

For privacy questions, rights requests or complaints, email contact@nullyield.org. You do not need a NullYield account to contact us.

What information is processed

Accounts: email address, sign-in provider identifier, and the name or profile picture supplied by Google or Auth0; terms acceptance and account-access status. NullYield does not store your sign-in provider's password.
Research: the fields you submit, such as methods, attempted approaches, outcomes, evidence, references, visibility and discipline-specific details. Submitted free text may contain personal data if you include it.
Original notes: research notes kept separately from the shared record. Other group members and public readers cannot see them unless you copy them into a shared field. Site administrators can view original notes on records entered through the general record form.
Private work and collaboration: saved and autosaved drafts, group memberships and invitations, bookmarks, saved searches, revisions, record links, activity indicators and moderation reports.
Record questions: questions and replies you post, their account links, dates and audience. Readers see role labels rather than your account name or email. Messages require access to the record; earlier private or group conversations remain restricted if the record is later made public.
Technical information: session and security information, IP addresses, request details and timestamps processed by the services delivering the site. Requested URLs, including search parameters, may appear in technical logs. NullYield does not build a search-history profile.
Correspondence: the contact information and message you provide when you email us, together with information needed to handle your request.

An account requires an email address and a sign-in identifier so that we can authenticate you and protect your work. Without them, we cannot provide account features. Research fields marked as required are needed to save that type of record; other fields and AI drafting are optional.

Purposes and legal bases

Requested features: We use account and research information to provide sign-in, private storage, group sharing, publication you request, search, exports and optional AI drafting. The legal basis is performance of our agreement with you or steps you request before it, Article 6(1)(b) GDPR.
Security and moderation: We process necessary technical information, access records, reports and moderation history to prevent abuse, protect private work, investigate faults and keep the service reliable. The legal basis is our legitimate interests in those purposes, Article 6(1)(f) GDPR.
Agreement evidence: We retain necessary Terms acceptance and publication evidence to administer and demonstrate our agreement, Article 6(1)(b) GDPR, and to establish, exercise or defend related legal claims, Article 6(1)(f) GDPR. This is separate from any legal basis required for commercial processing of research content.
Correspondence: We use your message and contact details to answer questions and handle concerns. The legal basis is our legitimate interest in responding, Article 6(1)(f) GDPR, or Article 6(1)(b) where the message concerns our agreement with you.
Legal duties: Where processing is necessary to meet a specific legal duty, including responding to GDPR rights requests, the basis is Article 6(1)(c) GDPR.

Accepting the Terms of Use is not blanket consent to processing personal data. If an optional use requires consent, we will explain that use and obtain consent separately before it starts.

Free access and research licence

Reading and submitting research on NullYield will remain free for researchers.

You retain your existing rights in your contributions. By making a research record public, you grant NullYield a non-exclusive licence to use, reproduce, distribute and sublicense its research content for commercial purposes, including as part of datasets.

This licence excludes private and group-only records, original notes, account information, questions and replies.

You agree to this licence when accepting these Terms. It takes effect for research content when you save a record as Public. Accepting updated Terms alone does not license existing submissions. A later public save covers only the content saved at that time, from that save onward; it does not license earlier revisions or private or group-only content.

Saving a private or group-only record does not grant this licence.

A content licence does not replace any required legal basis for processing personal information. Public research text can still contain personal information. Before any new commercial processing, we must establish the applicable legal basis, safeguards and required information.

We record the Terms version, acceptance time, public save time, saved content revision and content hashes as evidence of the agreement. This evidence is kept separately from research content and is not part of the licensed data. It contains no original notes or discussion text.

We do not sell your private account information.

Optional AI features

Choosing Draft with AI sends the notes you enter to OpenAI's API. Selecting Read photo sends the chosen image directly to OpenAI for transcription. Check the transcription, then review the resulting draft fields before saving. AI output is a suggestion and is not automatically published.

NullYield requests that AI responses are not stored as retrievable response history. This is not a promise of zero retention: OpenAI's default abuse-monitoring retention is up to 30 days, with legal, safety and endpoint-specific exceptions. See OpenAI's API data controls for those rules. API content is not used for model training by default.

Uploaded images are not saved as research-record attachments in NullYield's database. Temporary request handling and the AI provider's processing are separate from that database storage. Original notes and autosaved drafts can remain in your NullYield account under the retention rules below.

Manual record entry is available if you do not want notes or images sent to OpenAI. Information described as private within NullYield is still sent to the AI provider when you choose the AI feature.

Site-help assistant

Asking the optional help assistant sends your typed message, up to four recent chat exchanges and NullYield's public help guidance to OpenAI so it can understand follow-ups. Simple greetings, thanks and some help or unresolved-issue messages receive a fixed local reply without an OpenAI request. Account identity, research records, original notes and other page content are not automatically included. Do not include credentials, confidential research or participant information.

Help conversations remain on the current page in your browser and are not saved in NullYield's database, session or browser storage. New chat, reloading or leaving the page clears the conversation. We keep account-linked AI usage counts and request times to limit abuse and costs; counters reset as their usage window changes and account-linked counters are removed on account deletion. The provider's retention rules above still apply. You can read common questions or contact the team without using AI. If you choose an email handoff, the draft includes your recent issue messages for you to review; you edit and send it from your email application. NullYield does not send the email automatically.

Service providers and other recipients

Render: hosts the application and processes requests and technical logs. The current application hosting region is Oregon, United States.
Neon: stores account, research and collaboration data. The current database region is Frankfurt, Germany. An EU database location does not mean every service involved processes data only in the EU.
Google and Auth0: authenticate users where the corresponding sign-in method is enabled. The provider receives information about your sign-in and supplies the account information needed by NullYield. See Google's Privacy Policy and Okta/Auth0's Privacy Policy.
OpenAI: processes the notes, images or site-help questions sent when you choose the corresponding AI feature, as described above.
Cloudflare: provides DNS, routing and security services where enabled, and processes connection and browser signals for security checks. See Cloudflare's Privacy Policy.
jsDelivr: delivers browser libraries used, where needed, for animation fallback. Requests to the CDN expose connection information such as your IP address and browser request details. See jsDelivr's Privacy Policy.
PubChem, US National Library of Medicine: receives compound names submitted for the optional name-to-SMILES lookup. NullYield does not need to send your account identity for that lookup. See NLM's website policies.
Email providers: process messages and contact details when you correspond with us.

Authorised operators and administrators access data for the purposes above. Public readers and accepted group members receive the research content you choose to share with them. Information may also be disclosed to authorities where a legal duty requires it.

Processing outside the European Economic Area

Application hosting in the United States, AI processing and providers' international operations can involve processing outside the EEA. The GDPR requires an applicable adequacy decision or another lawful transfer safeguard, such as EU Standard Contractual Clauses and any necessary additional measures.

The published Render data-processing agreement and Neon data-processing agreement include Standard Contractual Clauses for relevant transfers. To request information or a copy of the safeguards applicable to a particular provider used by NullYield, email contact@nullyield.org. A provider's EU region or published agreement is not, by itself, a guarantee that all processing stays in the EEA.

How long information is kept

Accounts and private work: Account information, private drafts, bookmarks and saved searches are kept while your account exists or until you delete the item. Account deletion removes those items, your owned private and group records, and original notes on retained public records. Groups you own are disbanded; other contributors' records return to their owners' private access.
Public research and revisions: Public records and their public revision history may remain to preserve the research record after account deletion, without the account link or original notes. This does not guarantee that text you included is anonymous. Contact us if a retained record contains personal data that should be corrected, restricted or erased.
Questions and replies: Messages remain with their record until removed or the record is deleted. You can remove your own message text; administrators can also remove messages. Existing replies can remain under a removed question. Account deletion removes your message text and account links, while other people's replies may remain. Earlier restricted conversations on your retained public records are removed when your account is deleted.
Reports and moderation: Reports and moderation records are kept while needed to investigate and explain a moderation decision, handle a related dispute or meet a specific legal duty. Account deletion removes reports submitted by that account and clears its reviewer or moderator account links where applicable. Retained case information is reviewed when the case and any related dispute are closed.
Acceptance and licence evidence: Versioned Terms, acceptance and publication timestamps, revision numbers and content hashes are kept while needed to demonstrate the applicable agreement and grant or resolve a related legal claim. Account deletion clears the account link; record deletion clears the record link. Unlinked evidence contains no copy of deleted research content, original notes or account identity. Requests concerning this evidence are handled through the rights process below.
Application logs: Runtime logs available to the operators through the current Render Hobby workspace have a seven-day retention period. Information preserved for a particular security incident or legal claim is kept only while needed for that case.
Recovery history: The current Neon project has a six-hour point-in-time recovery window. A deletion from the live database may still be present in that recovery history until the window expires. Separately exported recovery copies, if created, are kept only for the recovery or verification task for which they are needed, or a specific legal preservation obligation.
Privacy correspondence: Requests and responses are kept until the matter is resolved and for any further period necessary to demonstrate how the request was handled or to resolve a related legal claim. Extra identity-verification material is removed when it is no longer needed for verification.

Provider security logs and exceptional legal or safety retention can follow separate rules; the AI rules are described above. Browser-storage durations are in the Cookies Notice. If data is restored for recovery, applicable deletion and restriction requests must be reapplied before the restored service is made available.

Your privacy rights and how to exercise them

Under the GDPR, depending on the processing, you can request access and a copy of your personal data, correction, erasure, restriction and portability. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing. These rights have legal conditions and exceptions.

Email contact@nullyield.org and describe the request. Account-wide copies and portability requests can be handled this way even where no automatic account-export tool exists. Please do not send identity documents unless we need further information to verify your identity and explain what is needed.

We respond to rights requests without undue delay and normally within one month of receipt. If the law permits an extension for complexity or the number of requests, we will explain the reason and additional time within that first month. Requests are normally free of charge. You can also delete your account from the Account page.

Your right to object

You can object, on grounds relating to your particular situation, to processing based on our legitimate interests under Article 6(1)(f) GDPR. Email contact@nullyield.org. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests and rights, or need the processing for legal claims.

Privacy complaints

You can raise a privacy complaint directly with contact@nullyield.org. We acknowledge complaints promptly, within 30 days at the latest, investigate them and explain the outcome without undue delay.

You also have the right to complain to a data-protection supervisory authority, particularly where you live, work or believe an infringement occurred. German state authorities are listed in the German Data Protection Conference's authority directory. Where UK data-protection law applies, you can also contact the UK Information Commissioner's Office.

Automated decisions and children

NullYield does not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI drafting proposes fields for your review.

The beta is intended for adult research users and is not directed at children. Contact us if you believe a child's personal data has been submitted so that we can investigate and take appropriate action.

Changes to this notice

We update this notice when data handling changes. Material new uses are explained before they begin; any use requiring consent will have a separate consent choice. The date above identifies the current notice.