Privacy Policy

1. Who we are

SHEAF is operated by SHEAF LTD, a private limited company registered in England and Wales (company number 17232059) with its registered office at Dormers, Quarry Wood Road, Cookham, Maidenhead, SL6 9UA, United Kingdom. References in this policy to "SHEAF", "we", "us", or "our" mean SHEAF LTD.

SHEAF LTD is the data controller for personal data processed in connection with the Service, within the meaning of UK GDPR Article 4(7).

2. What data we collect

• Product feedback and beta participation — original feedback, visible diagnostic context, receipts, review status, agreements, counted sessions and check-in records are retained while your account is active, until account deletion. Leaving the invited beta stops required check-ins but does not delete these records. Your account export includes these records, and account erasure deletes them. The web app also keeps account-scoped drafts, pending submissions and receipts in this browser so you can resume or retry; deleting your account from web Settings removes that account’s local feedback copy on this browser.
• Account data — your name, email address, and a hashed password. Your API key is stored as a SHA-256 hash; we cannot recover the raw key.
• Paper ratings — when you save, pass, or manually add a paper, we record the paper ID, action, and timestamp, linked to your account.
• Collections — the collections you create, their names, and which papers you add to them.
• Profile photo (optional) — an image you choose to display in your account. You can replace or remove it in Profile. Uploaded photos are resized and image metadata is removed before storage.
• Research profile — the topics, authors, and excluded terms you configure. We also hold seven “quality weights” (how much you value each dimension of a paper — rigour, novelty, and so on) that personalise your ranking; these are learned automatically from your save and pass history, not set by you.
• Derived data — vector embeddings and similarity scores computed from your saved papers, used to rank future recommendations. These are derived from your activity and live alongside your account record.
• Invitations and usage credits — if you use a referral code, we record the referring and new accounts, signup and first qualifying action timestamps, and the promised reward amount. We record credits earned, used for generation, and returned after a failed generation. Your inviter sees aggregate invite counts and their own credit history, not your name, email or paper activity. Account deletion removes your identifiers from these referral records; anonymous reward totals for the other participant may remain.
• Subscription data — your plan and billing status, complimentary-access eligibility and start/end dates, and active Free collection. For web subscriptions we hold Stripe customer and subscription identifiers. When App Store subscriptions are available, we hold Apple transaction identifiers, expiry and revocation status, purchase environment, and an opaque account token linking verified purchases to your SHEAF account. See section 7 for payment handling.
• Daily delivery allowance — we record your account, local date and the IDs of papers delivered in your shortlist to enforce the daily allowance across devices. Records older than seven days are removed on your next shortlist request. These records and subscription metadata are included in account export and cleared on account deletion.
• Usage data — request logs (method, route template, status code, duration) and limited error reports where Sentry diagnostics are enabled. Diagnostic capture is configured to omit request bodies, research text and personal profile values.
• Product feedback — the original message and any check-in answer you submit, its receipt and internal review status, and the context shown in the form: screen, app or web surface, release version where available, browser/OS version and graph mode. Feedback is reviewed privately by the platform owner, not organisation admins. No attachments, research text, queries or logs are added automatically.
• Invited beta participation — invitations, agreement version and acceptance time, leaving or declining the beta, counted meaningful sessions, and check-in exposures and completions. These records are separate from your subscription and paper ratings.
• Organisation membership — if you join an organisation, we record its membership, your role, invitations and monthly counts of accepted literature-review, reading-path and manual-paper-add requests made while you are a member. Its admins can see members' names, email addresses, roles, active-account status and these counts. Organisation membership does not give admins access to your papers, collections, research interests or generated documents.

We do not collect payment card numbers (your billing provider handles those), location data, or any data from third-party sources beyond what you explicitly import (e.g. BibTeX or RIS files).

3. Lawful basis for processing

We process your personal data on the following lawful bases under UK GDPR Article 6:

• Contract (Art 6(1)(b)) — to provide the Service you have signed up for. This covers account creation, daily paper recommendations, collections, knowledge graph, literature reviews, and reading paths.
• Legitimate interests (Art 6(1)(f)) — to diagnose errors via Sentry and maintain request logs for security and reliability. We have assessed that our interest in operating a reliable service is not overridden by your interests in this context.
• Legitimate interests (Art 6(1)(f)) — service improvement — to analyse how the Service is used and to develop, evaluate, and improve our ranking, recommendation, and summarisation features. We have carried out a legitimate-interests assessment and concluded this processing is not overridden by your interests or rights. You may object to it at any time (see your right to object in section 10), and where we train models for these purposes we use aggregated or de-identified data.
• Legal obligation (Art 6(1)(c)) — to retain certain records for tax and accounting purposes as required by UK law.
• Consent (Art 6(1)(a)) — for any future marketing communications (we do not currently send marketing).

4. How we use your data

• To personalise your daily paper recommendations using your rating history, profile, and quality weights.
• To compute and display your knowledge graph of connections between saved papers.
• To generate literature reviews and reading paths from your collections with your permission (via Anthropic Claude; see section 6).
• To diagnose errors and keep the Service reliable and secure (Sentry error tracking).
• To analyse how the Service is used so we can fix problems, improve usability, and develop new features.
• To develop, evaluate, and improve our ranking, recommendation, and summarisation models. Where this involves training a model, we use aggregated or de-identified data that does not identify you.
• To handle billing and subscription management through Stripe or, when enabled, Apple.

We do not sell, share, or use your data for advertising. We do not engage in cross-context behavioural advertising.

5. Automated decision-making (GDPR Article 22)

The SHEAF paper ranking is fully automated. Each candidate paper is scored against your quality weights, your saved-paper embedding centroid, your declared topics and authors, and your excluded terms — without human review per individual paper. This is automated decision-making within the meaning of UK GDPR Article 22.

The decisions concern which papers are surfaced in your daily feed and in what order. They do not produce legal effects on you or similarly significantly affect you within the meaning of Article 22(1) — they affect what you read, not legal rights or commercial decisions about you.

You retain the right to:

• Request a human review of any ranking decision by emailing legal@usesheaf.io;
• Express your point of view on any ranking decision and contest it;
• Adjust the inputs to the ranking yourself at any time via your Profile settings — your topics, authors, and excluded terms are directly editable. The quality weights are learned automatically from your save and pass history rather than set by hand, so you shape them by rating papers; you can request that they be reset, or a human review, using the contact above.

6. Sub-processors

SHEAF uses the following third-party processors to deliver the service. Each is bound by its own privacy commitments and (where applicable) by a written Data Processing Agreement with SHEAF LTD under UK GDPR Article 28:

• Anthropic (Claude API; Anthropic Ireland Limited is the contracting entity for UK customers under its standard commercial terms, with processing by Anthropic and its subprocessors) provides paper scoring, summaries, concept extraction, literature reviews and reading paths. Requests contain paper titles, author/publication details and permitted abstract excerpts; collection analyses also reveal your selected papers and may include extracted concepts and any review focus you enter. During initial setup, we ask for your permission for this sharing when you request reviews or reading paths. We remember your choice on your account, including the notice version and time. Choosing “Not now” leaves your saved papers and collections available. You can enable AI analysis or withdraw permission in Settings. Withdrawal stops future covered transfers, including queued work that has not yet been dispatched; it cannot retract a request already sent. We ask again if a material change exceeds the accepted scope. These requests do not include your account credentials, email address, collection names or collection notes. Paper and research-profile embeddings are computed on our server. API content is not used for Anthropic model training by default under its Commercial Terms. Please avoid putting confidential or sensitive personal information in a review focus.
• Stripe Payments UK Limited (London, UK) — subscription billing and payment processing for paid plans. Holds card data subject to its own privacy policy and PCI DSS compliance.
• Hetzner Online GmbH (Germany, EU) — application hosting and database storage.
• Backblaze, Inc. (B2 Cloud Storage, USA) — off-site database backups, encrypted at rest before upload.
• Resend (Plus Five Five, Inc.) (Delaware, USA) — transactional email delivery (password-reset and account emails); receives your email address and the message content of those emails.
• Sentry — Functional Software, Inc. (Delaware, USA) — limited error diagnostics where enabled. Server reports use route templates and stripped exception traces. Native crash reports are restricted to crash categories, addresses, binary identifiers and app build information; request capture, screenshots, replay and performance tracing are disabled.
• Apple Inc. (California, USA) — App Store distribution of the iOS app and, when enabled, in-app subscription purchase and verification, and (when SHEAF push notifications are enabled in future) push-notification delivery via APNs.

This list is current as of the "Last updated" date. We will update this section as sub-processors change.

7. Payment data and PCI compliance

SHEAF uses Stripe Checkout for website subscription billing. When enabled, in-app subscriptions are handled by Apple through the App Store. We receive verified transaction metadata from Apple, not payment card details. Your payment card details are entered on Stripe-hosted pages and never touch SHEAF servers. SHEAF stores only Stripe-provided identifiers and metadata: your Stripe customer ID, subscription tier, subscription status, and (for display purposes only) the last four digits of your card and its expiry month and year.

Because we never hold or process card data, our PCI DSS scope is SAQ-A — the lightest tier, applicable to merchants that fully outsource card handling to a compliant third party (Stripe is PCI Service Provider Level 1).

8. International transfers

Our Anthropic API workspace uses global inference routing and US workspace storage; it is not restricted to processing in the UK or EEA. Anthropic's Data Processing Addendum includes transfer safeguards, including the applicable Standard Contractual Clauses and UK addendum. Where Sentry diagnostics are enabled, Sentry (Functional Software Inc., Delaware, USA) processes limited error data outside the UK and EEA. Stripe Payments UK Limited may transfer data to other Stripe group entities outside the UK and EEA. Where transfers occur, they are made under:

• The European Commission's Standard Contractual Clauses (or the UK addendum) as available from each provider; or
• Other transfer mechanisms recognised under UK GDPR and EU GDPR.

9. Data retention

• Anthropic API inputs and outputs are normally retained for up to 30 days. Our workspace does not use Zero Data Retention. Anthropic may retain data longer for safety, policy enforcement or legal requirements, as described in its retention policy. Cancelling a future analysis does not retract a request already sent.
• Pass ratings — automatically purged after 2 years. Implementation: purge_old_pass_ratings() runs on every server startup.
• Save ratings, manual-add records, and collections — retained for as long as your account is active. These form the basis of your knowledge graph and your personal ranking centroid; deleting them would destroy your recommendations.
• Account data — retained until you request deletion or your account is closed.
• Organisation usage — counts remain attributed to the organisation where the requests occurred after you leave; later activity is not shared with it. Account deletion removes your membership, invitation records and organisation usage counts. Your account export includes your own organisation records.
• Request logs — retained for 30 days on the server.
• Sentry error data — retained under the applicable Sentry plan: 30 days on the free Developer plan or 90 days on standard Team/Business plans. See Sentry’s retention information.
• Stripe customer and subscription records — retained for as long as your account is active, plus an additional period required to meet UK tax and accounting obligations (typically 6 years after the end of the relevant accounting period).

10. Your rights

Under UK GDPR (and EU GDPR where applicable) you have the following rights:

• Right of access & data portability — call GET /api/users/me/export with your API key to download all your data as JSON at any time. The export covers your account, ratings, collections, product feedback and beta participation records in a machine-readable format.
• Right to erasure — call DELETE /api/users/me to immediately delete all your ratings, paper feedback, product feedback, beta participation records, collections, and profile data and deactivate your account.
• Right to rectification — email legal@usesheaf.io to correct any inaccurate personal data.
• Right to restrict processing — email legal@usesheaf.io to request that we restrict our processing of your data.
• Right to object — you may object to our processing on the basis of legitimate interests.
• Rights regarding automated decisions — see section 5.
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time. Withdrawal does not affect lawfulness of processing carried out before the withdrawal.
• Right to complain to a supervisory authority — UK users can complain to the UK Information Commissioner's Office (ICO). EU users may complain to their local Data Protection Authority.

11. Security

Passwords are hashed with PBKDF2-SHA256 (600 000 iterations) with a random 32-byte salt. API keys are stored as SHA-256 hashes. All requests are served over TLS (HTTPS). The service is hosted on Hetzner infrastructure in Germany (EU); off-site database backups are encrypted at rest before leaving the server. Card data is handled by Stripe and never reaches our servers.

We follow standard development security practices: input sanitisation, rate limiting (via slowapi), parameterised queries (via SQLAlchemy), and XSS-hardening in the web app. We maintain a regular dependency vulnerability scan (pip-audit) as part of our CI pipeline.

12. Cookies and similar technologies

The SHEAF web app uses localStorage to keep you signed in across visits (one item: your session token). No third-party tracking cookies, no advertising cookies, no analytics cookies are set by SHEAF. We do not currently use Google Analytics or equivalent.

If we add analytics in future, we will update this policy and (where required) display a cookie consent banner compliant with UK PECR and EU ePrivacy rules.

13. Children

SHEAF is intended for adult use only. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has provided us with personal data, please contact legal@usesheaf.io and we will delete it.

14. Data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the UK ICO within 72 hours of becoming aware of the breach and, where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay.

15. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify you in advance by email (at the address on file with your account) and via in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this document is updated whenever the policy changes.

Continued use of the service after the effective date constitutes acceptance of the updated policy.

16. Contact

• General: hello@usesheaf.io
• Privacy and data protection: legal@usesheaf.io
• Post: SHEAF LTD, Dormers, Quarry Wood Road, Cookham, Maidenhead, SL6 9UA, United Kingdom