TeamResearch Privacy Policy

Version 1.9 | Effective date: 2026-09-23

1. Who operates TeamResearch

TeamResearch (teamresearch.app) is operated by Adriano Quieti, trading as TeamResearch. In this policy, “we”, “us” and “our” refer to that operator. TeamResearch is currently operated by an individual, not a limited company.

Privacy enquiries and requests: privacy@teamresearch.app

This policy explains how personal information is handled when you visit TeamResearch, create an account, join a project or contact us. The current service is free; paid subscriptions are not enabled.

2. Our role and your institution’s role

We act as a data controller when deciding how to use account, authentication, service-administration, security and support information.

For personal information in project content that we handle on a customer’s instructions, we act as a processor. The controller may be the researcher, their university, employer or another organisation responsible for the research. Creating or owning a project in the app does not necessarily make that individual the legal controller. Where a customer is itself a processor, we act as its subprocessor.

The data-processing schedule in our Terms of Service governs processing on a customer’s behalf. The responsible controller determines its lawful basis and provides any privacy information needed for that processing. This policy does not replace an institution’s research privacy notice.

3. Information we handle and where it comes from

Account information includes your name, email address, authentication identifier, profile image where provided through sign-in, account settings and notification preferences. It comes from you and the authentication provider, Clerk. Where the terms-acceptance screen is enabled, we also record your application user identifier, the Terms and Privacy Policy versions shown, your confirmation that you are at least 18, and the acceptance timestamp. We do not collect a date of birth through this screen.

Project information includes project titles, methods and progress, tasks, deadlines, assignments, writing sections, notes, document links, submission details and collaboration records supplied by you or other project members. Include only information appropriate for a project-management tool.

Invitation information includes an invited person’s email address and the relevant project invitation. We receive this from the person inviting them. If you receive an invitation before registering, this policy also applies to the information we use to deliver and administer that invitation.

Technical information includes authentication and session identifiers, IP address, user agent, browser and operating system information, approximate city and country, referrer, timestamps, last-seen information and diagnostic or security events. The categories recorded depend on the relevant provider and event.

Communications include information you send when requesting support, exercising privacy rights or asking to hear about future plans. Please avoid sending sensitive research information in support messages. Messages to privacy@teamresearch.app are forwarded by Namecheap to the operator’s personal Gmail account. Adriano Quieti handles these enquiries and may reply from that Gmail address.

4. Why we use personal information

Where UK or EU GDPR applies to our controller activities, we use the following bases. Other applicable data-protection laws may impose additional requirements.

• Account creation, authentication and requested service functions: performance of our contract with you. Where an organisation is the contracting customer, we rely on legitimate interests in providing its authorised users with the service. We use terms-acceptance and adult-confirmation records to administer service eligibility and document the agreement, relying on legitimate interests in doing so where UK or EU GDPR applies. This is an age declaration, not independent age verification.
• Invitations and collaboration administration: legitimate interests in enabling research teams to collaborate and delivering invitations requested by users. We consider the invited person’s interests and will stop unwanted invitations on request.
• Security, troubleshooting and abuse prevention: legitimate interests in protecting accounts, project information and reliable operation.
• Support and service communications: contract where necessary to deliver your service, or legitimate interests in resolving enquiries and administering an organisation’s account.
• Legal requirements: compliance with a legal obligation where a specific applicable requirement requires processing. Handling or defending legal claims may rely on legitimate interests.
• Plan-interest requests: legitimate interests in recording and assessing interest you voluntarily submit. We do not currently send marketing emails. If we introduce optional marketing, we will explain it and obtain separate consent where required before sending it.

The information needed to register, authenticate and operate an account is necessary to provide the service. Without it, we may be unable to create or maintain your account. Optional profile information and expressions of interest in future plans are not required to use the service.

Accepting our Terms is separate from consent to optional marketing. This policy is an explanation of our practices, not a request for blanket consent. We do not sell personal information or use project content for advertising or to train machine-learning models.

Service email settings allow you to manage assignment notifications, deadline reminders, submission-status updates, section-completion notifications and weekly digests. Assignment emails are enabled by default; the other listed email types are disabled by default. Project invitation emails are sent when an invitation is issued.

5. Cookies and browser storage

TeamResearch uses authentication and session technologies provided through Clerk to sign users in and maintain secure access. The app also uses local browser storage for the following purposes:

• view-pref:my-projects and view-pref:shared-projects remember the card/list display for your project lists; view-pref:methods remembers the display for methods. These settings have no programmed expiry and remain until overwritten, removed by you or cleared by your browser.
• pendingTierInterest remembers a Team or Lab plan selected before sign-in. The app removes it when the signed-in interest-check component runs and attempts to record the selection in the waitlist. If that step never runs, the value has no programmed expiry and can remain until browser storage is cleared.

These local settings are stored in the browser, not as project content. Deleting an account does not itself clear them. Anyone sharing the same browser profile may encounter the saved settings or pending selection.

We do not currently use visitor analytics or advertising trackers.

Browser checks on 22 September 2026 identified the following storage. Cookie names can include an instance-specific suffix, shown here as <instance>.

Clerk authentication cookies: __client on clerk.teamresearch.app and __client_uat / __client_uat_<instance> on teamresearch.app showed expiry dates approximately 400 days ahead. Signed-in checks also showed __session / __session_<instance> and __refresh_<instance> on teamresearch.app with expiry dates approximately one year ahead, and __clerk_active_context marked as a browser-session cookie. These support the authentication system. These are observed browser expiry periods, not a guarantee of how long sign-in remains valid; cookies may be renewed or removed earlier. Our configured Clerk session lifetime remains 30 days, separate from these cookie expiry dates and the session-data cleanup described in section 8.

Cloudflare security cookies on clerk.teamresearch.app: __cf_bm supports bot protection and expires after 30 minutes of inactivity; _cfuvid supports rate limiting and was marked as a browser-session cookie.

Local storage: __clerk_environment was observed on teamresearch.app. Local storage has no browser-enforced expiry and can remain until removed by the application or cleared through browser settings.

You can manage cookies through your browser, although blocking authentication technologies can prevent sign-in. Where consent is required for optional technologies, they must remain inactive until you consent and you must be able to withdraw that consent.

6. Who can receive information

Project owners and authorised collaborators can see information made available within their projects, according to their permissions. Invitations and service notifications may include relevant project or task details. Check recipients before inviting them or sharing links.

We use these providers to operate the service:

• Clerk: authentication, account management and session information.
• Vercel: application hosting, delivery and runtime diagnostics. Our configured function region is London, United Kingdom; this is not a promise that every category of Vercel data stays in the UK.
• Neon: application database and recovery history. Our database is configured in London, United Kingdom.
• Resend: email delivery, email content and delivery logs. Resend states that customer data is stored in the United States, irrespective of the selected sending region. Our sending domain is configured to send from Tokyo; that setting does not move stored email data to Japan.

Namecheap and Google Gmail: forwarding and handling messages sent to our contact email address. We currently use a personal Gmail account.

Providers receive information needed for their functions. Their own service-administration or legally required processing may be covered by their privacy notices. A provider’s location or database region does not necessarily describe all support access, logs, backups or subprocessors.

We may disclose information when legally required, to investigate abuse or protect legal rights where justified, or to professional advisers under appropriate confidentiality obligations. If the business is transferred or incorporated, we will explain any resulting change of controller and any relevant sharing before it takes effect where required.

Documents hosted on external services remain subject to those services’ access controls and privacy practices. Linking a document in TeamResearch does not secure the document itself.

7. Locations and international processing

The application database is configured in London. The operator administers TeamResearch from Thailand and may access personal information there for support and operation. Infrastructure providers may process information in other countries, including the United States.

For information about processing locations and safeguards, contact privacy@teamresearch.app.

8. Retention and deletion

We retain account information while your account exists and project information while the project remains in the service, subject to the choices below. We do not currently delete accounts or projects automatically because of inactivity. You may use the deletion options or contact us to request deletion. We will review this retention approach as the service develops and give notice before introducing an inactivity-deletion policy. Archiving alone does not permanently delete a project.

Project deletion

After archiving a project, its owner can choose either of the following:

• Delete now: permanently removes the project and its contents from the active application database.
• Delete in 30 days: hides the project immediately and retains it during a 30-day grace period. The next daily deletion process after the period expires permanently removes it. Contact privacy@teamresearch.app during the grace period to request recovery.

Account deletion

You can delete your account through your account security settings. Clerk immediately deletes the live user record and terminates active sessions. Once our application receives the account-deletion event, it automatically deletes your application account record, associated settings and every project you own. There is no 30-day grace period for account deletion.

Deleting your account also deletes your owned projects for all collaborators. Arrange for any information that must be retained to be copied to an authorised system before deleting your account.

Projects owned by other users remain. Membership records linked to your application user account are deleted, your access is removed, and tasks assigned to you become unassigned. Unlinked invitations, including invitations to another email address, are not necessarily removed by account deletion. Contributions and references to you within shared notes or project history may also remain. Contact us or the responsible project controller to request review, correction or removal of remaining personal information, subject to applicable rights and obligations.

Provider backups, sessions and logs

• Neon database recovery history: the current recovery window is 24 hours. Deleted information may remain recoverable within that window after removal from the active database.
• Vercel function/runtime logs: the standard Pro plan retention period is one day from log creation. This period does not describe every category of information Vercel may hold. The operator reports no optional logging add-on or external log drains configured.
• Clerk user backups: residual copies in encrypted rolling backups age out within 15 days of user deletion. They are restricted to authorised personnel for disaster recovery and restoration testing. There is no individual-user restore path, and rotation cannot be shortened for one record.
• Clerk session information: scheduled for cleanup when the session reaches its abandonment timestamp, currently 30 days after session creation. Account deletion ends active sessions immediately; cleanup of retained session information follows its separate schedule.
• Clerk application logs: one day from the event timestamp on the current Hobby plan.
• Resend email content and logs: 30 days on its standard Free, Pro and Scale plans. Account deletion in TeamResearch does not itself mean immediate removal of these email records.
• Resend backups follow a separate retention schedule. We have not established a reliable account-specific period, so the 30-day email and log period above should not be read as a deadline for erasing all backup copies.

Backup retention is separate from live-data deletion and does not provide a recovery service for deleted projects. Emails already delivered to recipients are outside our control and may remain in their mailboxes.

Other records

The application stores notification-trigger records containing a task or section identifier, trigger type and timestamp to prevent duplicate reminders. The updated project and account deletion processes remove the related reminder records for deleted projects; task and section deletion also includes cleanup. These records do not contain email addresses or message bodies, but identifiers should not be treated as necessarily anonymous.

Unaccepted invitations, including declined invitations, are eligible for automatic deletion 30 days after they were last sent. A daily cleanup normally removes them at the next scheduled run. A fresh invitation starts a new 30-day period. Accepted memberships are not removed by this cleanup. Delivered invitation emails may remain in recipients’ mailboxes.

Waitlist entries include your selected plan, message, creation timestamp and any contacted timestamp. They are linked to your account and are deleted with that application account. No separate age-based waitlist purge is implemented; withdrawal requests require manual handling.

We retain ordinary support and privacy-request correspondence for 12 months after the matter is resolved. Unnecessary identity-verification documents and attachments are removed sooner, once no longer needed. A minimal privacy-request record recording the date, request and outcome is retained for 24 months after closure. Records needed for a specific legal obligation or dispute may be kept longer, only for that purpose and with access restricted. We review these records manually each month to remove information whose retention period has expired.

Terms-acceptance records are linked to the application account and are removed when that account is deleted. Historical copies may remain within the database recovery window described above. We do not currently keep a separate post-deletion acceptance archive.

We use plan-interest details to assess the request while it remains relevant and do not currently send marketing emails. You may ask us to remove your entry or stop contacting you. Any minimal suppression record needed to respect your opt-out must be limited to that purpose. These exceptions do not authorise indefinite retention of deleted projects.

9. Research participants and sensitive information

Do not put identifiable research-participant records, participant contact lists, consent forms, health records, special-category personal data or criminal-offence data into TeamResearch. This restriction also covers coded or pseudonymised participant-level records where re-identification remains possible. It applies to free-text fields, writing sections and identifying details in file names or URLs.

Use TeamResearch for project coordination and non-identifying descriptions or aggregate progress. Keep participant records in systems approved by your institution. Writing sections may contain links to manuscript sections hosted in external services. Restrict those documents to named authorised people or an appropriately restricted institutional group; do not use public or “anyone with the link” sharing. You are responsible for checking permissions when adding a link and when team membership changes. Links and their visible text must not expose participant identities, access credentials or participant datasets. Removing someone from a TeamResearch project does not revoke their access in the external service.

Ordinary professional information about researchers and collaborators, such as names and task assignments, may be used for collaboration. You must have authority to share it.

10. Your rights and complaints

Depending on the law that applies and the circumstances, you may have rights to access and correct information, request erasure or restriction, object to processing based on legitimate interests, receive eligible information in a portable format, and withdraw consent without affecting earlier lawful processing. These rights have conditions and are not absolute.

Contact privacy@teamresearch.app. We may request proportionate information to verify your identity. For requests governed by UK or EU GDPR, we normally respond within one month; where a lawful extension or clarification affects the deadline, we will explain this. Other applicable legal deadlines will be respected.

For project information processed on behalf of a customer, the responsible researcher or institution decides how to respond. We will route requests to that controller and assist it as required. Contact us if you do not know who is responsible.

You may complain to the relevant supervisory authority without first complaining to us. This may include the UK Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/), your EEA national data-protection authority, or Thailand’s Personal Data Protection Committee (https://www.pdpc.or.th/), depending on the applicable law.

11. Security

We use Clerk authentication and server-side checks for project membership and owner, editor or viewer permissions. Account-deletion webhook messages are checked for a valid signature. Calendar feed tokens are randomly generated and can be replaced in account settings to invalidate the old URL. These controls help protect information; operational access must also be restricted to what is needed for the service. We are responsible for implementing technical and organisational safeguards appropriate to the information and risks. No internet service can guarantee absolute security.

Keep your login details and any private calendar-feed links confidential. A person or calendar service with a feed link may be able to read the information it exposes. Contact us if a link or account may have been compromised.

We will investigate personal data breaches and notify affected controllers, individuals and authorities as required by applicable law. Where UK or EU GDPR requires a controller notification to a supervisory authority, the usual deadline is within 72 hours after becoming aware, where feasible; high-risk breaches require notification to affected individuals without undue delay.

12. Age requirement

TeamResearch is available only to people aged 18 or over. This is our service eligibility rule. If you believe someone under 18 has registered, contact privacy@teamresearch.app so we can investigate and take appropriate action.

13. Changes and contact

We will update this policy when our practices change and give appropriate notice of material changes through the service or by email. If new processing requires consent, we will request it separately.

Privacy contact: Adriano Quieti, trading as TeamResearch — privacy@teamresearch.app.

Questions? privacy@teamresearch.app