Legal

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how Acadex processes personal data, for which purposes, on which legal bases, and what rights you have.

We have tried to write it so that you can understand what actually happens to your data without having to translate legal terminology first.

1. Who is responsible for Acadex?

Where Acadex determines the purposes and means of processing personal data, the controller is:

Acadex Solutions UG (haftungsbeschränkt)
Reuterweg 5
49637 Menslage
Germany

Email: info@acadex.io

2. Acadex can be a controller or a processor.

The role depends on why particular personal data is being processed.

For individual Acadex accounts, we generally determine the processing necessary to provide and operate the service ourselves and therefore act as controller.

Institutional use can be different.

Where a university, research institution, or other organisation determines the purposes of processing research-related personal data and instructs Acadex to process that data on its behalf, the institution may be the controller and Acadex the processor.

In that case, the processing is governed by a Data Processing Agreement under Article 28 GDPR.

Even in an institutional setting, Acadex may separately remain a controller for processing carried out for its own purposes, such as account administration, billing, service security, legal compliance, and our limited first-party Product Metrics.

The legal role is determined by the actual processing purpose — not simply by the name used in a contract.

3. When you visit our website

When you access the Acadex website, our systems necessarily receive technical information required to deliver the page and protect the service.

This can include your IP address, the requested resource, date and time, browser or protocol information, and technical information needed to process the request.

We process this information to deliver the website, maintain technical security, diagnose errors, prevent abuse, and protect our infrastructure.

Where this processing is not required to perform a contract with you, our legal basis is Article 6(1)(f) GDPR.

Our legitimate interests are the secure, reliable, and technically correct operation of Acadex.

Operational logging is described separately below.

4. Server-side website statistics

We want to understand whether important parts of our website are being used.

For that purpose, Acadex generates a limited set of server-side website statistics on its own infrastructure.

These can include page views of selected pages such as the homepage, Pricing, or Institutions.

We do not create a persistent analytics visitor ID.

We do not fingerprint your browser.

We do not use these statistics for cross-site tracking.

We do not include full URL query strings, search terms, or complete referrer URLs in the long-term analytics dataset.

Full IP addresses are not retained there as long-term analytics identifiers.

The purpose is to understand aggregate use of the website, improve the product and website, and assess whether Acadex is reaching and serving its intended users.

The legal basis is Article 6(1)(f) GDPR.

Our legitimate interests are product improvement and the technical and economic operation of Acadex while using a less intrusive approach than external behavioural analytics.

You have the right to object to processing based on legitimate interests under the conditions of Article 21 GDPR.

5. Cookies and local browser storage

Acadex does not currently use optional analytics or advertising cookies.

We do not use cookie-based cross-site tracking.

We may use cookies or comparable browser storage where they are necessary to provide a function you have requested.

This can include, for example, authentication and session information or settings such as language and appearance.

Where access to or storage of information on your device is strictly necessary to provide a digital service you have expressly requested, no separate consent is required under Section 25(2) TDDDG.

We do not use the absence of a cookie banner as permission to introduce optional tracking technologies.

If we later add technology that requires consent, we will request that consent before using it.

Cookie Policy →

6. When you contact us or request Early Access

If you contact Acadex, request Early Access, ask for a demonstration, or send us another enquiry, we process the information you provide.

This usually includes your contact details, the content of your message, and information required to respond to your request.

Where your request relates to entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR.

For general enquiries, feedback, press requests, or similar communication, processing may instead be based on Article 6(1)(f) GDPR.

Our legitimate interest is communicating with people who contact Acadex and handling legitimate business enquiries.

We retain correspondence only for as long as it is required for the relevant purpose or statutory retention obligations.

7. When you create an account

When you register for Acadex, we process the information necessary to create and maintain your account.

This can include your name, email address, authentication information, account identifiers, registration and account status, plan information, and technical account settings.

Passwords are not stored in plaintext.

They are stored as cryptographic password hashes.

The legal basis for processing required to create and provide your account is Article 6(1)(b) GDPR.

Certain information may also need to be retained under Article 6(1)(c) GDPR where we are subject to a legal obligation.

8. When you use Acadex

Using Acadex can involve personal data contained in:

conversations and prompts, generated answers, uploaded documents, saved memories, chat titles, watchlists, saved research material, bibliographic queries, and other information you choose to provide while using the service.

For individual accounts, we process this information primarily to provide the Acadex functions you request.

The legal basis is Article 6(1)(b) GDPR where the processing is necessary to perform the contract with you.

We do not use this research content for advertising.

We do not use it for our own Product Analytics.

We do not use it to train our own AI models.

Where an institution uses Acadex as controller and we process this content on its behalf, the institution determines the relevant legal basis and Acadex processes the data under its documented instructions and the applicable Data Processing Agreement.

9. Saved context and memory

Acadex can retain information so that useful context does not have to be explained again in every conversation.

You can review, correct, and delete saved memories.

Certain memory information is processed in a searchable form so that Acadex can retrieve relevant context when required.

The searchable text used for semantic memory retrieval cannot be protected with the same field-level encryption while it remains actively searchable as other stored content.

Embeddings used for internal semantic retrieval are generated locally by Acadex.

We do not use a separate external embedding provider for this purpose.

10. Uploaded documents

If you upload a document, we process its content so Acadex can work with it.

This can include extraction, indexing, retrieval, analysis, and sending relevant portions to an approved model provider where that is necessary to perform the requested task.

We do not treat an uploaded document as permission to use it for unrelated purposes.

Uploaded document content is not used for our own Product Analytics or advertising.

You can delete uploaded documents from Acadex.

11. Watchlists

If you create a watchlist, we process the information necessary to store it and provide the monitoring functions you requested.

That can include researchers, publications, or other research objects you choose to follow.

Watchlist information is associated with your account.

It is not used to build an advertising profile.

12. Product Metrics and business metrics

Operating Acadex without any information about whether the product is being used would mean operating it in the dark.

We therefore process a deliberately limited set of first-party Product Metrics.

These can include information such as registration, activation, plan status, the start or cancellation of a Researcher subscription, credit usage, active paid accounts, and aggregated commercial metrics.

Where these metrics are not necessary for the direct performance of the contract, we process them on the basis of Article 6(1)(f) GDPR.

Our legitimate interests are understanding whether Acadex functions as a product, improving it, operating the business sustainably, and identifying whether our plan and usage structure works in practice.

We deliberately use less intrusive means than detailed behavioural tracking.

We do not use conversation content, prompts, answers, uploaded document content, saved memories, research interests, research topics, or bibliographic search queries for our own Product Analytics.

We do not maintain an exhaustive clickstream of how individual users move through Acadex.

We do not use session replay.

Our principle is:

We measure events, not behaviour.

And:

We want to know whether Acadex is being used — not what people are researching.

You may object to processing based on Article 6(1)(f) GDPR under the conditions of Article 21 GDPR.

13. External model providers

Acadex can use external language-model providers to perform requests.

Depending on the selected or permitted processing profile, this can include models made available by providers such as Mistral, OpenAI, Anthropic, or Google.

A provider being technically integrated into Acadex does not mean it receives data from every user.

Data is sent to a model provider only when that provider is used for the relevant request.

For institutional accounts, the permitted providers and processing profiles can be restricted technically.

The information transmitted depends on what is required for the requested function.

It does not automatically include your entire account, all previous conversations, every uploaded document, your complete memory store, or our Product Metrics.

The exact providers, purposes, and relevant processing conditions are documented separately.

External Services & Sub-processors →

14. International data transfers

Acadex’s central application infrastructure, primary database, and the backups managed by Acadex are located in Germany.

External providers can have different processing locations.

Where personal data is transferred outside the European Economic Area, the transfer must comply with Chapter V of the GDPR.

Depending on the particular recipient and processing path, this can involve an adequacy decision or appropriate safeguards such as contractual mechanisms recognised under the GDPR.

We do not make the blanket claim that every technical data point involved in Acadex always remains exclusively within the EU.

For institutional accounts with geographic requirements, permitted processing profiles can be restricted accordingly.

We document the applicable processing path rather than deriving its location from the provider’s name alone.

15. Public bibliographic data

Acadex works with bibliographic information about publications, researchers, authorship, affiliations, and citations.

Much of this information originates from publicly accessible scholarly databases and bibliographic sources rather than directly from the person concerned.

This can include names, researcher identifiers, publication history, institutional affiliations, authorship relationships, and citation information.

Where Acadex determines the purposes of this processing itself, we process this information on the basis of Article 6(1)(f) GDPR.

Our legitimate interest is making publicly available scholarly information searchable, comparable, and usable for research.

The fact that information is publicly available does not remove it from data-protection law.

Where Article 14 GDPR applies because personal data was not obtained directly from the person concerned, the applicable information obligations and statutory exceptions must be assessed accordingly.

In large bibliographic datasets, individual notification can in some circumstances be impossible or involve disproportionate effort. Article 14(5)(b) GDPR provides an exception where its statutory requirements are met and appropriate safeguards are in place.

We do not treat that exception as automatic merely because a dataset is large.

If you believe bibliographic information about you in Acadex is incorrect, or you want to exercise a data-protection right in relation to it, you can contact us at info@acadex.io.

16. Web search

Acadex can use public web search when a task requires information beyond our bibliographic and internal data.

Our search layer can use a self-hosted SearXNG instance.

To obtain search results, a query or query derived from your request may need to be sent to external search services.

We aim to send only the information required for the search rather than an entire conversation.

The external service can receive technical request information as part of processing the search.

Web search is not used to create an advertising profile of Acadex users.

17. Push notifications

If Acadex offers you optional push notifications and you enable them, we process the information required to deliver those notifications.

The technical delivery path can depend on your browser, operating system, or device and may therefore involve the respective push infrastructure.

Push notifications are optional.

You can disable them again through the relevant Acadex or device settings.

Where consent is the applicable legal basis, you can withdraw that consent at any time with effect for the future.

18. Account and service emails

We may send emails required to operate your account or contractual relationship.

These can include account verification, security notifications, billing information, important service information, or notices relating to your subscription.

Where such messages are necessary to provide the service, the legal basis is Article 6(1)(b) GDPR.

Where communication is required by law, Article 6(1)(c) GDPR may apply.

We do not treat an operational account email address as unrestricted permission for unrelated marketing.

19. Payments and billing

When you purchase a paid Acadex plan or another paid service, we process the information required to administer the contract, payment, and billing.

Online payment processing can involve Stripe.

Institutional customers can also be billed by invoice.

The legal basis for processing required to perform the contract is Article 6(1)(b) GDPR.

Billing and transaction information may additionally be retained where required by tax, accounting, or commercial-law obligations under Article 6(1)(c) GDPR.

We retain such information for the applicable statutory period.

20. Operational logs and security

Acadex maintains operational logs where necessary to run and protect the service.

Conversation content is not written to application logs.

Logs can contain technical information such as user identifiers required for diagnosis and IP addresses used for security measures such as rate limiting.

Local logs are currently retained for seven days.

Older logs can then be compressed and encrypted and transferred to a separate archive system.

Archived operational logs are retained for no longer than three months.

Access is restricted to authorised administration.

Where processing is required to protect Acadex, detect technical failures, prevent abuse, or investigate security incidents, the legal basis is Article 6(1)(f) GDPR.

Our legitimate interest is the secure and reliable operation of the service and the protection of users, systems, and data.

21. Hosting

Acadex’s central application infrastructure is hosted with:

STRATO GmbH

The infrastructure used for Acadex is located in Germany.

STRATO processes personal data as an infrastructure provider where this is necessary to operate Acadex.

The current external services involved in Acadex are described in more detail on our separate provider page.

External Services & Sub-processors →

22. No advertising or external behavioural tracking

Acadex does not currently use external behavioural analytics or advertising platforms such as Google Analytics, Mixpanel, Amplitude, Meta Pixel, LinkedIn Insight Tag, or session-recording services.

We do not sell research profiles to advertisers.

We do not use research content to determine which advertisements someone should see.

Our own limited Product Metrics and server-side website statistics are described above.

23. How long do we retain personal data?

There is no single retention period for every type of data.

We retain personal data only for as long as it is needed for the purpose for which it is processed or for as long as a legal obligation requires us to keep it.

Account and research content generally remains available while the account exists unless you delete the relevant content earlier.

Account-linked Product Metrics are generally deleted together with the account unless another legal retention obligation applies.

Payment and accounting information can remain for the applicable statutory retention periods.

Operational logs follow the shorter retention periods described above.

Public bibliographic information can remain while it continues to form part of the relevant scholarly record, subject to applicable data-protection rights and correction of inaccurate information.

Existing backups can contain deleted data until the relevant backup reaches the end of its retention cycle.

We do not restore deleted data from a backup merely to return it to normal active use.

24. What happens when you delete data?

You can delete individual content such as conversations, memories, and uploaded documents.

You can also delete your Acadex account.

Our database architecture uses cascading relationships where appropriate to remove associated user data.

We additionally use automated schema checks intended to identify user-linked tables that are not covered by the expected deletion logic.

Deletion from the active system does not necessarily erase every historic backup copy at the same moment.

Data can remain in existing backups until those backups expire under the applicable retention schedule.

Statistics that were already genuinely anonymised or aggregated before account deletion may remain where they can no longer be linked to an identifiable individual.

25. Recipients of personal data

Personal data is only made available where this is required for a defined purpose.

Depending on how you use Acadex, recipients can include hosting and infrastructure providers, an approved external model provider, a payment provider, technical push-notification infrastructure, or other service providers required for a specific function.

Institutional customers can have a more restrictive provider configuration.

Bibliographic data providers primarily supply information to Acadex and do not automatically receive your conversations or documents merely because their records are used.

A current overview is available here:

External Services & Sub-processors →

26. Special categories of personal data

Research can concern information falling within the special categories of personal data described in Article 9 GDPR, such as health information, political opinions, religious beliefs, genetic or biometric data, or information concerning a person’s sex life or sexual orientation.

Acadex does not require this type of personal data simply to create an account.

If special-category personal data is processed, an additional legal condition under Article 9 GDPR may be required in addition to a legal basis under Article 6 GDPR.

For institutional use, the institution is responsible for determining whether such information may be processed within its research context where it acts as controller.

For individual use, you should not provide special-category personal data about another person unless processing it is necessary for your legitimate purpose and you are legally permitted to do so.

Acadex is not intended to turn the availability of a research tool into permission to process sensitive personal information.

27. No solely automated decisions with legal or similarly significant effects

Acadex can generate analyses, comparisons, summaries, calculations, and other research outputs.

Acadex does not use those outputs to make decisions about you that are based solely on automated processing and that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

Acadex is a research tool.

It is not intended to replace human judgement in decisions about people.

28. Do you have to provide personal data?

Some information is necessary if you want to use particular Acadex functions.

For example, we need the information required to create and authenticate an account if you want an account.

Payment and billing information is necessary if you purchase a paid service.

Research content is generally provided voluntarily, but Acadex cannot analyse a document or question that you do not provide.

Where particular information is legally or contractually required, we will indicate this where relevant.

29. Your data-protection rights

Depending on the circumstances and applicable legal requirements, you may have rights to access your personal data, correct inaccurate information, request deletion or restriction of processing, receive certain data in a portable format, object to processing based on legitimate interests, and withdraw consent with effect for the future.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

A right to deletion does not mean that data must be erased where the GDPR or another applicable law permits or requires continued retention.

If Acadex processes information only on behalf of an institution, we may need to coordinate your request with that institution as controller.

To exercise a right relating to processing for which Acadex is the controller, contact:

info@acadex.io

We may need to verify your identity before disclosing or changing personal data.

30. Your right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation.

We will then stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or the processing is necessary for the establishment, exercise, or defence of legal claims.

Where personal data is processed for direct marketing, you may object to that processing at any time.

Acadex does not currently use your research content for direct marketing.

31. Your right to complain

You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

For companies established in Lower Saxony, the competent supervisory authority is generally:

The State Commissioner for Data Protection of Lower Saxony (Landesbeauftragter für den Datenschutz Niedersachsen)

You may also have the right to contact another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

You do not need to contact Acadex before exercising your right to complain.

32. How we protect personal data

Acadex uses technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, and misuse.

These measures include TLS for data in transit, field-level AES-256-GCM encryption for selected sensitive stored content, Argon2id password hashing, restricted administrative access, multi-factor authentication for administrative systems, key-based production SSH access, environment separation, secret management, logging controls, backups, and deletion mechanisms.

Not every category of data is protected in exactly the same technical way.

For example, searchable semantic-memory text requires different treatment while it remains searchable.

We document those distinctions rather than describing every stored value as identically encrypted.

More detail is available here:

Security & Privacy →

Technical and Organisational Measures →

33. Changes to this Privacy Policy

Acadex and the services we use will change over time.

We update this Privacy Policy when the actual processing changes or when legal requirements make an update necessary.

The date at the top of this page shows when the current version was last updated.

Where a change materially affects how we process personal data and additional notice is required, we will provide that information through an appropriate channel.

A change to this Privacy Policy does not by itself create consent where consent is legally required.

34. Contact

For questions about privacy at Acadex or to exercise a data-protection right, contact:

Acadex Solutions UG (haftungsbeschränkt)
Reuterweg 5
49637 Menslage
Germany

info@acadex.io

Further information

Security & Privacy →

External Services & Sub-processors →

Cookie Policy →

Data Processing Agreement →

Technical and Organisational Measures →