Scholarcy

GDPR overview

GDPR is addressed explicitly. The privacy policy, in force since 1 January 2020 and revised in February 2024, carries a dedicated GDPR section and names the UK GDPR and the Data Protection Act 2018. Scholarcy declares itself data controller for its own users; where it processes data on a customer's behalf, the terms make the customer controller and Everway processor, with processing on instruction only, breach notification without undue delay, assistance with data subject requests at the customer's cost, and deletion or return at the end of the contract. Access, rectification and erasure are offered, and deleting an account removes credentials, email, settings and summaries. Three limits stand out: the Library terms contradict themselves on transfers outside the EEA, no Article 27 EU representative is named, and there is no DPO and no dedicated privacy email, only a contact form.

Who owns the data?

You keep what you bring: the terms confirm that customers retain all rights in their non-personal Customer Data and remain the owner, or licensee, of the verbatim content they import. What the service generates is treated differently. Everway owns the Everway Results, the classification and organisation produced from your document, and holds the intellectual property in the website, the browser extensions and the Library. You receive a perpetual, non-assignable, royalty-free licence over those results for personal use only: commercial copying or distribution is excluded. Everway states it never sells personal data or processed documents, and limits access to authorised employees.

Reuse rights

At sign-up Scholarcy collects a name, an email address and billing details, plus an optional institutional affiliation and professional role. Each time a document is processed, the IP address and the URL or file name are logged to monitor abuse. The legal bases claimed are performance of the contract, consent, legitimate interest and legal obligation. Affiliation data is used to count users per institution and identify prospects, role data to profile user types and design new services, and marketing emails are sent only on explicit opt-in. Personal information is not sold, leased or distributed to third parties, and card details are never stored, payments running through Stripe Payments Europe Ltd. Nowhere on the site does Scholarcy say whether imported documents feed model training, neither claiming it nor ruling it out. The summaries you generate can be reused freely for your own work, but the licence granted over Scholarcy Results stops at personal use: redistributing them commercially is not permitted without permission.

Data retention & training

Hosting summary

The privacy policy states that data is stored on secure third party servers within the EEA, and the Security page identifies Amazon Web Services, with the application deployed in containers on managed AWS services. No hosting country and no AWS region is named, so the jurisdiction cannot be narrowed further than the EEA. Encryption at rest and in transit is announced for all customers, and code is monitored with Dependabot, Snyk and a secrets scanner. Two contradictions sit inside the same documents. Clause 13.7(b) of the Library terms rules out transfers outside the EEA and the United Kingdom without appropriate safeguards, effective remedies and an adequate level of protection, while clause 13.5(b) states that personal data may be transferred or stored outside the EEA; and clause 9.8 warns that data may be transferred unencrypted, against the encryption claimed elsewhere. Sub-processors are disclosed in the privacy policy: Stripe, Postmark, Zendesk, Google Workspace, Webflow, Vimeo, ActiveCampaign, Facebook, Google Analytics, Google Tag Manager, Appzi, Mixpanel and Finsweet.