Privacy Notice

Who is the data controller?

The controller for this service is KONSİL. For any question, request or objection about how your data is processed: [email protected]

KONSİL is currently in closed beta. When the service moves to commercial release, the controller's full legal name, address and — where applicable — registry details will be published in this section.

What data do we process?

• Public scholarly data: name, ORCID iD printed in publication records, institution, publications and research topics. Sources: OpenAlex (CC0), Crossref, PubMed/NCBI, DataCite and ClinicalTrials.gov. The closed-beta production path does not call the ORCID Public API.
• Contact details: the email a member provides in their own profile, or the corresponding-author address printed in publication metadata (shown with a "verify this" label).
• Account and security: ORCID iD, name, email, profile and institution details; consent and terms-acceptance timestamps; plan and organisation membership records. We store a scrypt hash made with a unique salt, not the password itself.
• Research archive: the idea text, selected search settings, generated report, candidate outcome statuses and impact/evidence records added by the user for each completed search. These are shown only in the account owner's archive.
• Chat: participants, subject, messages and, where needed, a translation cache. Messages are encrypted at rest. This is not end-to-end encryption, because the server must process a message to translate it.
• Usage events: technical records such as "search started / finished / failed", "profile saved", "chat opened", kept to operate and secure the service. The text of your research idea is never written to these records (only a coarse length bucket); no candidate names, emails or free text are stored, and your identity appears only as an irreversible pseudonym. Details below.

First-party measurement

KONSİL uses no third-party advertising or analytics trackers, including Google Analytics. Product measurement runs on our own server; data is not used for advertising or sold. Limited transfers to the infrastructure and AI providers described below do take place where needed to operate the service.

• Idea text is not written to the technical event log. Event records contain only a rough character-count range. The idea and report for a completed search are retained in your account archive so that you can reopen them.
• No cookies for measurement. To distinguish visitors we derive a one-way pseudonym from the IP address and browser string using a key that changes every night; the IP address itself is not stored and the pseudonym expires the next day, so tracking across days is technically impossible. (The session cookie that keeps you signed in is a separate, strictly necessary function and is not used for measurement.)
• Member pseudonym: your ORCID iD is transformed one-way with a secret key and cannot be reversed. When you delete your account these event records are deleted too.
• Retention: event records are deleted automatically after 180 days by default.
• Legal basis: operating the service, fixing faults, preventing abuse and controlling cost (legitimate interests / performance of a contract). There is no profiling and no advertising purpose.

External service providers

• Anthropic API: your research idea and the profile and public scholarly records needed for AI pre-assessment and matching are processed; the relevant chat message is processed when translation is requested. Under the provider's current statement, commercial API inputs and outputs are not used to train generative models by default and are ordinarily deleted from its backend within 30 days. Exceptions and current terms are set out in Anthropic's statements on model training ↗ and data retention ↗.
• Resend: for transactional email such as verification, password, closed beta and organisation invitations, we transfer the recipient address; for an invitation, the name; and a single-use code or link. Research ideas and report content are not put in email.
• Scholarly data sources: OpenAlex, PubMed/NCBI, Crossref, DataCite and ClinicalTrials.gov may receive the query, ORCID iD or publication identifier needed for a lookup. The ORCID Public API is not used in closed-beta production. If an authorised Member API connection is enabled later, this notice and the relevant permission screen will be updated before use.
• Site infrastructure: Cloudflare and Google Fonts used on the site may receive standard connection data such as your IP address and browser information when serving a request.

Purpose and legal basis

Purpose: to make research collaboration easier. For members, identity data (ORCID iD, name) is processed because it is necessary to enter into and perform the membership relationship (GDPR Art. 6(1)(b); KVKK Art. 5/2-c). Showing your profile to other members in the collaboration pool rests on explicit consent, recorded with a timestamp and withdrawable at any time. For non-members compiled from public scholarly records, the basis is legitimate interests. Data is never used for advertising or profiling, and is never sold.

Why is membership tied to ORCID?

A KONSİL account is tied to an ORCID iD; matching connects the identity declared by the user with public publication records.

• Identity — current state: KONSİL is in closed beta and your ORCID iD rests on your own declaration; ownership is not verified. The iD you provide is looked up in publisher records and the works you select and confirm are linked to your profile. This shows that the records relate to that iD; by itself it does not prove that the account holder owns the iD.
• Sign-in security: the closed-beta invitation code and a local password you set with KONSİL are used. The plaintext password is not stored; a uniquely salted scrypt hash is retained. KONSİL does not request read or write access to your ORCID account.
• Equal access: an ORCID record is free and open to everyone (orcid.org/register), so the requirement excludes no one permanently.

Running a search requires a signed-in account. A researcher who receives a personal chat invitation may join that particular chat through its invitation link without opening an account.

Retention

Caches containing personal data are kept for a limited period (60 days by default) and then refetched from the source, so deletions and updates at the source are reflected. Technical usage events are deleted automatically after 180 days by default. Your profile, research archive, outcome and impact records are retained until you delete your account or the relevant search. If a participant deletes their account, chat messages are retained for the other participants' conversation history but the deleted account's ORCID link is removed.

Your rights

You have the right to be informed, to rectification, to object and to erasure. Members can additionally delete their account permanently from the account page: the profile, the search archive and the technical event records are erased; chat messages are retained for the integrity of the other person's conversation but are unlinked from your account. KONSİL may send transactional email for account verification, passwords and invitations; it does not send collaboration outreach to a candidate researcher on your behalf. Novelty and feasibility outputs are an AI pre-assessment, not a systematic review. For membership terms see the Terms of Use ↗.