Privacy Policy

1. Overview

Symbiotic Scholar LLC (“we,” “us,” or “our”) operates the Symbiotic Scholar platform and its connected academic tools. This Privacy Policy explains what information we collect, how we use it, and how we protect it. We are committed to handling your data with transparency and care.

2. Information We Collect

Account Information

When you create an account, we collect your email address, name (optional), and a securely hashed password or OAuth token. This information is used to authenticate you and communicate with you about your account.

Subscription Information

We record your Scholar Pass subscription tier, status, and billing history. Payment details (card numbers, billing address) are handled entirely by Stripe and are never stored on our servers.

Usage Information

We collect information about how you use the Platform, including which tools you access via SSO, when your account was created, and whether you have completed onboarding steps. This helps us improve the Platform and communicate relevant information to you.

Tool-Level Data

Each connected tool (Dr. Dissertation, Peer-Review PRO, IRBWiz, ScholarlyFit, QuantAI, Qualai) maintains its own data separately. When you use SSO to access a tool, we record that a connection exists (to display the “Connected” badge) but we do not store the content of your work within those tools at the Symbiotic Scholar Hub level. Please review each tool’s individual privacy policy for details about what data they collect.

Communications

If you contact us via the contact form, we store your name, email address, and message content to respond to your inquiry.

3. How We Use Your Information

• To authenticate you and manage your Scholar Pass subscription
• To provide SSO access to connected tool sites
• To send transactional emails (welcome, billing receipts, password resets) via Resend
• To send periodic digest communications about your usage and account status
• To improve the Platform based on aggregated, anonymized usage patterns
• To respond to support requests and communications
• To enforce our Terms of Service and prevent fraud

We do not sell your personal information to third parties. We do not use your data to train AI models.

4. Third-Party Services

We use the following third-party services to operate the Platform:

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or financial compliance purposes (e.g., Stripe transaction records).

6. Your Rights

You have the right to:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your account and associated data
• Portability — Request your data in a machine-readable format
• Opt-out — Unsubscribe from non-transactional communications at any time

To exercise any of these rights, email privacy@symbioticscholar.com. We will respond within 30 days.

7. Security

We take reasonable technical and organizational measures to protect your data, including:

• Encryption at rest (AES-256) and in transit (TLS 1.2+) via Supabase and Vercel
• Row-level security policies ensuring users can only access their own data
• Service-role API keys stored only in server-side environment variables, never exposed to the browser
• Short-lived, single-use SSO tokens for cross-tool authentication (3-minute TTL)

No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

8. Cookies

Symbiotic Scholar uses cookies and local storage to maintain your authenticated session. We do not use third-party advertising cookies or tracking pixels. You may disable cookies in your browser, but doing so will prevent you from staying logged in.

9. Children's Privacy

The Platform is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Platform. Continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

11. Contact

Questions about this Privacy Policy or how we handle your data?