Privacy Policy

1. Information we collect

Account information: the email you register through our sign-in provider Clerk and the sign-in methods you use (email code, password, Google, Apple, passkey). Passwords and passkeys are held by Clerk and we never see them; with Google or Apple sign-in we only receive your email and basic profile.

What you do in the service: your research questions, research progress and reports, watched products, feedback on reports (useful / inaccurate), and files you upload to your library together with the text extracted from them.

Voice sample (sensitive personal information): collected only if you choose to record "My voice" in Settings: your recording of the passage shown on the page, its length, and when you ticked "This is my own voice" along with the terms version. Your voice is used only to narrate explainer videos you make; nobody else can use it.

Payment information: subscriptions and credit packs are paid through Stripe. Card details are handled by Stripe and never stored by us; we only keep the Stripe customer ID, subscription status, order amount and currency.

Logs: access time, IP address, browser and device information and error logs, used for security auditing and troubleshooting.

Cookies and local storage: used to keep you signed in (Clerk) and remember interface preferences such as language, theme and currency. We do not use advertising trackers or third-party analytics.

2. How we use it

• To provide research, product dossiers, the library, export and sharing
• To calculate plan quotas, charge points and handle subscriptions and credit packs
• To keep accounts secure and detect unusual sign-ins and abuse
• To evaluate and improve research quality (for example, checking that cited sources are accurate)
• To meet legal and regulatory requirements

3. Processors we rely on

To provide the service we entrust the following providers with the data they need, and require them to use it only for that purpose:

• Authentication: Clerk (sign-in, verification emails, sessions)
• Hosting and storage: Vercel (website, Singapore region) and Railway (database, research services and library file storage, Southeast Asia region)
• Payments: Stripe (subscriptions, credit packs, invoices, customer portal)
• Large language models: during research we send your question, the retrieved material it needs and relevant library excerpts to model providers for inference: DeepSeek, Zhipu (GLM), Alibaba Cloud Model Studio (Qwen) and, as a fallback route, OpenRouter. Only what the task needs is sent.
• Search: Bocha (web search) and Just One (public social media content). Only search keywords are sent, never your account information.
• File generation: E2B (isolated cloud sandboxes hosted outside China). When you ask research to produce a PowerPoint, Word or Excel file, the research content and the material it uses are processed in an isolated E2B environment (no internet access, no account information) that is destroyed when the task finishes; the generated file is saved to your library.
• Narration: MiniMax (Shanghai, servers in mainland China). When you make an explainer video, the script text is sent to MiniMax to synthesise the narration; if you recorded "My voice", the recording is sent to MiniMax to create a voice that only you can use.
• Email: Clerk sends sign-in emails and Resend sends service notifications.

Apart from the above and where the law requires it, we do not sell, rent or share your personal information.

4. Where and how long we store data

Location: your account, research records and library files are stored on servers in Singapore. By using the service you acknowledge and agree to this.

Voice sample: kept until you delete it. When you click "Delete my voice" in Settings we delete the recording and preview from storage and ask MiniMax to delete the voice; after a successful re-recording the old recording and voice are deleted automatically. Videos already made are not affected and can be deleted separately.

Retention: we keep your data while your account is active. After you close your account we delete or anonymise your personal information within 30 days unless the law requires otherwise. System logs are normally kept for 90 days; orders and invoices are kept as accounting rules require.

5. Your rights

You can exercise the following rights over your personal information:

• Access and correction: see your account on the Settings page and change email, password and sign-in methods under “Manage account security”
• Deletion: delete library files yourself, or ask us to delete other data
• Export: export reports as PDF or a long image; contact us to export all data in your account
• Withdrawing consent and closing your account: contact us at any time to close your account (this ends any paid benefits)

To exercise these rights, email support@medcxy.com. We reply within 15 working days.

6. Security

We use industry-standard safeguards: HTTPS everywhere; database access separated per account so private library files are visible only to you; private library content never appears on shared report pages; least-privilege internal access.

No online service can be completely secure. If a data security incident occurs, we will notify you and the authorities as required by law.

7. Minors

The service is intended for industry professionals aged 18 or over. We do not knowingly collect information from minors and will delete such accounts once verified.

8. Changes and contact

We may update this policy and will publish changes on the website and notify you in the service or by email; significant changes will be highlighted.

Questions or complaints: support@medcxy.com.