Privacy Policy

OpenAbstracts ("we", "us") operates the OpenAbstracts website, journal search API and MCP server at openabstracts.com. We are the controller of the personal data described in this policy. For anything privacy-related, contact privacy@openabstracts.com.

Account data: your first and last name, email address, optional company name, and a password (stored only as a salted scrypt hash — we cannot read it).

API and connection data: the API keys you create (stored only as a SHA-256 hash plus a short display prefix, a name you give it, creation, last-used and request-count metadata), and, if you connect an AI client through the OAuth "Connect" flow, the registered client, the key you authorised, and hashed refresh tokens.

Usage and billing data: the number and timestamp of billable requests per account or key, your free-allowance usage and credit balance, top-up amounts, and Stripe customer and checkout identifiers. We do not store the text of your search queries or results in our usage records. Card details are entered on Stripe's pages and never reach our servers.

Technical data: like any web service, our hosting and network providers process IP addresses, request URLs (which can include query parameters), user-agent strings and timestamps in the course of delivering and securing the Service.

Communications: messages you send to our support, contact or privacy addresses.

• To provide the Service — authenticate you, run searches, enforce quotas, bill you and show your usage (performance of a contract).
• To keep it secure and reliable — detect abuse, fraud and outages, and enforce our Terms (legitimate interests).
• To communicate — service and billing notices, and replies to your requests (contract and legitimate interests). We do not send marketing email without your consent.
• To meet legal obligations — tax, accounting and lawful requests (legal obligation).

We do not sell your personal data, and we do not use it for advertising or to train AI models.

We share data only with service providers that help us run the Service, under appropriate terms:

• Stripe — payment processing for top-ups.
• Cloudflare — DNS, network protection and traffic delivery, and email routing for our domain.
• Our hosting provider — the servers and database the Service runs on.
• Marketplaces you choose — if you access the Service through RapidAPI, RapidAPI handles your account and subscription there and forwards requests to us.

If you connect an AI assistant or other application, the results of the searches it makes for you are delivered to that application and governed by its provider's privacy policy. We may also disclose data when required by law or to protect rights and safety.

We use only what is needed to run the Service: a secure, HTTP-only session cookie that keeps you signed in (up to 7 days), a sidebar_state preference cookie, and browser local storage that holds your session details for the dashboard. We do not use advertising or third-party analytics cookies. Our network provider may set its own security cookies.

We keep account, key and usage data while your account is open. If you ask us to close it, we delete or anonymise personal data within a reasonable period, except records we must keep — such as billing and tax records — for as long as applicable law requires. Revoked keys and expired tokens are kept only as needed for security and audit.

We protect data with measures including hashed passwords and keys, HTTPS in transit, access controls and server-side verification of every session and key. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as required by law.

Depending on where you live (including under Malaysia's Personal Data Protection Act and, where it applies, the GDPR) you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive a portable copy, and to withdraw consent. Email privacy@openabstracts.com and we will respond within 30 days. You can also revoke any API key at any time on the API Keys page. You may lodge a complaint with your local data-protection authority.

Our providers operate globally, so your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards such as standard contractual clauses with those providers.

The Service is not directed to anyone under 16 and we do not knowingly collect their personal data. If you believe a child has given us data, contact privacy@openabstracts.com and we will delete it.

We may update this policy as the Service or the law changes. We will post the new version here with a new "last updated" date and, for material changes, notify account holders by email.

Privacy questions and requests: privacy@openabstracts.com. General enquiries: contact@openabstracts.com.