This policy explains how LabScout ("we"), operated by Xiaolong Wu, handles personal data. It covers two groups of people: users who visit the website or create an account, and researchers whose public publication information appears in the Service.
1. Data we collect from users
- Account data: email address and a hashed password (we never store your password in plain text).
- Content you submit: research descriptions and the searches, keywords and results generated for them.
- Usage data: when you were last active, how many searches you have run, and basic technical logs (such as request timestamps and errors).
- Analytics: we use Google Analytics to understand aggregate traffic (pages visited, referrers, approximate location, device type).
- Billing: if you subscribe, Paddle (our Merchant of Record) collects your payment details and billing address. We receive only your subscription status, plan, and a customer identifier — never your full card number.
2. How we use it
- to provide the Service, run your searches and enforce plan limits;
- to send account emails such as verification codes and billing-related notices;
- to secure the Service and prevent abuse;
- to improve the product using aggregate statistics.
We do not sell your personal data and do not use it for third-party advertising.
3. Service providers
We share data only with providers that help us run the Service:
- Vercel (website hosting), Render (application servers and database), Cloudflare (DNS and email forwarding);
- OpenAI (processes the research descriptions you submit to interpret your search);
- SendGrid (sends verification emails);
- Paddle (payments, tax and invoicing);
- Google Analytics (traffic analytics); Mapbox (map display).
These providers may process data in the United States and other countries.
4. Public researcher information
The Service processes publicly available publication metadata, mainly from PubMed: author names, the institutions and locations listed in their affiliations, and publication identifiers. We use it to show where research in a field takes place. We do not collect private information about researchers, and we do not include email addresses that may appear in affiliation text in exports.
If you are a researcher and want your information corrected or removed from LabScout, email contact@labscout.io with the name and publication(s) concerned. We will respond within 30 days.
5. Cookies and local storage
We store your login token in your browser's local storage so you stay signed in. Google Analytics sets cookies to measure traffic. You can clear these at any time in your browser settings.
6. Retention
We keep account data and your searches while your account is active. If you ask us to delete your account, we delete your account data and searches within 30 days, except where we must keep limited records (for example billing records held by Paddle) to meet legal obligations.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to certain processing. To make a request, email contact@labscout.io.
8. Security and children
We use encrypted connections (HTTPS), hashed passwords and restricted database access. The Service is not directed to children under 16, and we do not knowingly collect their data.
9. Changes and contact
We may update this policy and will post the new version here. Questions: contact@labscout.io