OpenRead

GDPR overview

The site never mentions the GDPR. Neither the privacy policy nor the terms use the words General Data Protection Regulation or the acronym, and no compliance is claimed anywhere, which is why this record marks OpenRead as non-compliant: this is documented silence, not an explicit denial. What the policy does publish is a generic rights list, covering access, correction, deletion, restriction, objection and non-discrimination, a thirty-day deadline to respond, the possibility of charging for requests, and a named Data Protection Officer, Han Wang, reachable at privacy@openread.academy. EEA and UK residents are told they may complain to a supervisory authority. The legal framework actually invoked is Singaporean, the PDPA and the PDPC. No Article 27 EU representative is designated, no EU entity or address is given, and no DPA, standard contractual clauses or subprocessor list is published.

Who owns the data?

The terms are unusually clear on ownership. Users keep the copyright on the articles and supplementary materials they post and on anything Oat or another AI tool generates for them: nothing is transferred or assigned to OpenRead, and content can be removed, archived privately or taken off a profile page at any time. OpenRead owns the Service itself and grants each user a worldwide, non-exclusive, non-sublicensable and non-transferable licence to use Content solely inside the platform. It positions itself as a temporary online transcoding provider for user-uploaded documents. The terms also state that personal data is never rented or sold, though the privacy policy allows data to be transferred in a merger, sale or bankruptcy.

Reuse rights

End users may not freely reuse the content they access. The licence granted by the terms covers use inside the Services only, which means transcoding or displaying papers online, annotating them and storing note data in the cloud. Any reproduction, modification, distribution or storage for another purpose is expressly prohibited without prior written permission, and users must respect the rules of the publishers and university libraries OpenRead sources from. The terms allow downloading or storing a reasonable portion of a paper together with one's notes for non-commercial educational purposes only, and warn that saving a large portion may breach local copyright law, at the user's own risk. Use of the service is restricted to personal, educational and non-commercial contexts. On its own side, OpenRead collects account details, communications, usage telemetry and advertising identifiers, and shares them with service providers, business and advertising partners; whether individual users' content feeds model training is never addressed.

Data retention & training

Hosting summary

OpenRead commits to no hosting location. Its privacy policy states that all information it processes may be transferred, processed and stored anywhere in the world, including but not limited to the United States, and acknowledges that destination countries may have different data protection laws from the user's own. The only safeguard offered is a generic promise to protect information consistently with applicable law; no mechanism is named, neither standard contractual clauses, nor an adequacy decision, nor any certification. There is no trust or security page anywhere on the site and no certification such as SOC 2 or ISO 27001 is claimed. Security itself is described in two words, physical and technical measures, with no detail and an explicit refusal to guarantee complete security. Breaches are notified to users electronically, by post or by email, and to Singapore's Personal Data Protection Commission when significant harm is likely or at least 500 people are affected. On the technical side, the domain resolves to a Vercel address, which describes where the website is served rather than where user data is stored.