Alethic Privacy Policy

Last updated: September 30, 2026

1. Who we are

Alethic Inc. ("Alethic", "we", "us", or "our") is a corporation incorporated under the federal laws of Canada, with its registered office in Ottawa, Ontario. We operate the Alethic research verification platform at tryalethic.com and platform.tryalethic.com (the "Service").

This Privacy Policy explains what personal information and content we collect, how we use it, who we share it with, and the choices and rights you have. It applies to everyone who uses the Service.

For privacy questions, or to exercise any of the rights described below, contact us at [email protected].

2. What the Service does (so you understand the data flows)

Alethic verifies the claims in an academic manuscript against their cited sources. When you upload a manuscript (as a PDF), we:

Extract the individual claims and the bibliography from your manuscript.
Look up and retrieve the papers your manuscript cites, from public academic sources.
Compare each claim against its cited source and produce a per-claim verdict.

To do this, parts of your manuscript and the cited papers are processed by third-party artificial-intelligence and infrastructure providers described in Section 5. Please read Section 5 carefully if your manuscript is unpublished or confidential.

3. Information we collect

3.1 Information you provide

Account information. When you create an account, we collect your email address and name. If you register with an email and password, we store a cryptographic hash of your password (we never store your password in plain text). If you sign in with Google, we receive your Google account email, name, and a Google account identifier.
Manuscript content. The PDFs you upload, including any reference papers you provide, together with everything derived from them (extracted claims, the resolved bibliography, and verification reports).
Payment information. When you purchase credits, payment is processed by Stripe. We do not receive or store your full card number. We store a Stripe customer identifier, your credit balance, and a ledger of credit transactions.
Communications. If you contact us by email or through a support form, we keep that correspondence.

3.2 Information collected automatically

Usage and technical data. IP address, browser and device information, and request logs. We use IP addresses for security and abuse prevention (for example, rate limiting sign-in and analysis requests).
Cost and metrics data. For each analysis we record processing metrics, including the volume of AI processing consumed, so we can operate billing and monitor for abuse.
Product usage data. To improve Alethic, we record how the product is used, such as which features you use, timing information, and errors. This is tied to your account or session, and helps us find rough edges and make the tool better. We do not sell this data or use it for advertising.
Cookies and similar technologies. We use only cookies and similar technologies that are necessary to keep you signed in and to operate the Service. If we later introduce analytics or other non-essential cookies, we will update this policy and, where required, ask for your consent first.

We do not collect special categories of data on purpose. Note, however, that a manuscript you upload could itself contain personal or sensitive information (for example, in a clinical or social-science paper). You are responsible for the content you upload. See Section 9.

4. How we use your information

We use the information above to:

Provide the Service: run the verification pipeline, return reports, and store your report history.
Authenticate you and keep your account secure.
Process payments and administer the credit system.
Operate, maintain, debug, and improve the Service.
Prevent fraud, abuse, and security incidents, and enforce our Terms of Service.
Communicate with you about your account, transactions, and material changes to the Service.
Comply with legal obligations.

We do not use your manuscripts, or anything derived from them, to train or improve any artificial-intelligence model, whether our own or a third party's. Your content is processed only to produce your verification results. Section 5.1 explains how our AI processing providers are held to the same limitation.

We do not sell your personal information.

5. Third parties who process your data (sub-processors)

We rely on the following service providers to deliver the Service. They process data on our behalf or, where indicated, as independent controllers under their own terms.

5.1 Artificial-intelligence processing (important)

OpenRouter, OpenAI, Microsoft and Amazon. To extract and verify claims, your manuscript (the PDF file itself, including its text, figures and tables), the claims derived from it, and the papers it cites, including any reference papers you provide, are sent through OpenRouter, a service that routes requests to AI model providers, to OpenAI's GPT models. OpenRouter sends each request to one of the companies that run those models: OpenAI itself, Microsoft (Azure) or Amazon Web Services (Amazon Bedrock). Your content is used to return your results, and none of these model providers uses it to train or improve any model. Under its API terms, OpenAI may keep request content for up to 30 days to detect abuse; Microsoft and Amazon do not keep it. Your manuscript content is never used to train any model.
Modal. We use Modal to host the embedding and reranking service that converts text into numerical representations and relevance scores for search. Portions of your manuscript and of the cited papers are sent to Modal for this purpose and are not used to train any model.

5.2 Retrieval of cited papers

To fetch the papers your manuscript cites, we query public academic sources using citation metadata (titles, DOIs, and similar identifiers), not your manuscript text. These sources include Semantic Scholar, arXiv, PubMed and Europe PMC, Unpaywall, OpenAlex, CORE, bioRxiv, and Crossref. When a paper is not available from those sources, we may use ScrapingBee, a web-retrieval service, to fetch an openly available copy from the web address where it is published. ScrapingBee receives that address, not your manuscript. We also send your manuscript's own title, and its DOI if it has one, to Semantic Scholar to look up its publication details.

5.3 Infrastructure, payments, and communications

Hetzner. Hosting and data storage. Our servers are located in Helsinki, Finland, in the European Union. See Section 7 on international transfers.
Cloudflare. Network, content delivery, and security layer for traffic to and from the Service.
Stripe. Payment processing. Stripe handles your card details under its own privacy policy.
Resend. Sending transactional email such as verification and password-reset messages.
GitHub. Hosting of our source code, and storage of our database backups in a private repository.
Google. Sign-in, if you choose to sign in with Google (under Google's own privacy policy), and our company email (Google Workspace), which stores messages you send to [email protected] and other Alethic addresses.

We maintain a current, named list of these sub-processors and make it available on request.

6. How long we keep your information

Account information: for as long as your account is active.
Manuscripts, reports, and derived data: retained until you delete them or close your account. You can have this data erased at any time (see Section 8).
In-flight session data held in our cache expires automatically after about 24 hours.
Payment and transaction records: retained as required for accounting, tax, and legal compliance.
Backups: copies of our database are kept in a private GitHub repository until we delete them.

When you ask us to erase your data, we delete it from our database, our search and vector stores, and our file storage. Backups made before your request still contain it until those backups are deleted. We keep bug reports you send us so that we can investigate the problem you reported. To request erasure, email [email protected], or use the account-deletion option in your account settings where the Service makes it available.

7. International data transfers

Alethic is a Canadian company, and our servers are hosted in Helsinki, Finland, in the European Union. Our AI processing providers (OpenRouter, OpenAI, Microsoft, Amazon Web Services, and Modal) and our backup provider (GitHub) are based in the United States, as are Cloudflare, Stripe, Resend, and Google. Your information will therefore be transferred and stored across borders, including out of your country of residence. For example, if you are in Canada, your manuscripts and account data are stored in the European Union, processed by our AI providers in the United States or other regions, and copied into backups stored in the United States. We rely on appropriate contractual and technical safeguards for these cross-border transfers. Because your data is stored and processed in the EU, EU data-protection law may apply to that processing in addition to Canadian law.

8. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

Access the personal information we hold about you.
Correct inaccurate information.
Delete your information.
Withdraw consent or object to or restrict certain processing.
Portability of information you provided to us.
Withdraw from the Service and close your account.

Canadian users have rights under PIPEDA, including access and correction. EU and UK users have rights under the GDPR and UK GDPR. California and certain other US-state residents have rights under their state privacy laws. To exercise any right, contact [email protected]. We will respond within the timeframe required by applicable law. You also have the right to complain to your local data-protection authority.

9. Your responsibilities for content you upload

You must have the right to upload any manuscript you submit, and to have it processed as described in this policy. If a manuscript contains other people's personal information, you are responsible for having a lawful basis to share it with us and our sub-processors. Do not upload content you are not authorized to disclose to third-party processors, including the AI providers described in Section 5.1.

10. Security and confidentiality

Protecting the confidentiality of your unpublished research is core to what we do. We use technical and organizational measures to protect your information, including:

Encryption in transit (TLS) for all traffic to and from the Service.
Encryption at rest. We are enabling encryption at rest for your manuscripts, reports, and derived data; until it is fully enabled across all stored data, that data is protected by the access controls and per-user isolation described here.
Per-user data isolation in our database and our search and vector stores, so one user's content cannot surface in another user's searches or results.
Hashed account passwords using a strong algorithm (Argon2id). We never store passwords in plain text.
No use of your content for AI training, including by our processing providers (see Sections 4 and 5.1).
Access controls on our internal systems and signature verification on payment webhooks.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we treat the confidentiality of your manuscripts as a primary obligation.

If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and we maintain records of such breaches.

11. Children

The Service is intended for researchers and academic professionals and is not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy. If we make a material change, we will notify you by email or through the Service before the change takes effect, where required. The "Last updated" date at the top shows when this policy was last revised.

13. Contact

Alethic Inc., incorporated under the federal laws of Canada The Entrepreneurship Hub, 150 Louis-Pasteur Private, STEM Complex, Room 122, Ottawa, Ontario, K1N 6N5, Canada Email: [email protected]