Privacy policy

This is a courtesy translation. RevueNova is operated by a French company and the French version of this policy is the only legally binding one; in case of discrepancy, the French text prevails.

1. Data controller

MQUANTUM SAS, with its registered office in 37000 Tours (France), is the controller of the personal data collected through the RevueNova platform. For any question about your data: contact.mquantum@gmail.com.

2. Data we collect

We collect the following data, openly:

• Identification data: first name, last name and email address, provided when the account is created.
• Professional data: laboratory, institute or affiliated organisation (optional).
• Usage data: search history, saved papers, notes and review notebooks, annotations — tied to your account in order to provide the service.
• Technical data: connection logs and IP addresses, for security and abuse prevention.
• Billing data: for paid accounts, billing identity, payment history and country of tax residence. Card details are entered directly with our payment provider and never pass through our servers.

3. Purposes and legal bases

Your data is used exclusively to:

• create and manage your account and your workspace;
• provide RevueNova's features (search, extraction, notebook);
• secure the platform against unauthorised access;
• send notifications related to your account.

Each processing operation rests on a legal basis within the meaning of Article 6 GDPR:

• Performance of the contract (art. 6(1)(b)) — account creation and management, provision of features, account-related notifications, subscription billing.
• Legitimate interest (art. 6(1)(f)) — securing the platform, preventing abuse and protecting against automated sign-ups. You may object to this processing under the conditions set out in section 7.
• Legal obligation (art. 6(1)(c)) — retention of accounting records and compliance with our tax obligations.

MQUANTUM neither sells nor rents your personal data to third parties.

4. Processors and hosting

To provide the service we rely on technical processors, all bound by confidentiality and security obligations:

• Supabase (Supabase Pte. Ltd., Singapore) — authentication and database (PostgreSQL), on infrastructure located primarily within the European Union.
• Vercel Inc. — hosting and delivery of the application.
• Anthropic — AI processing of the queries and article excerpts submitted to the analysis and translation tools. This content is not used to train third-party models. What is sent, tool by tool, is set out on the AI & transparency page.
• Stripe (Stripe Payments Europe, Ltd, Ireland) — payment processing, subscription management and invoicing. Your card details are collected and stored by Stripe alone; MQUANTUM never has access to them.
• Intuition Machines (hCaptcha) — anti-bot verification on sign-up and sign-in. This service processes your IP address and technical browsing signals for the duration of the check.

Looking up bibliographic data also queries public sources (OpenAlex, CrossRef, Semantic Scholar, PubMed); those requests do not transmit your personal data.

If you use the Zotero integration, the references you choose to export or import are exchanged with Zotero at your request; Zotero processes them under its own terms, as a separate service.

5. Transfers outside the European Union

Some of the processors above are established outside the European Union, or operate part of their infrastructure there — this is the case for Anthropic, Vercel, Stripe and Intuition Machines (United States) as well as Supabase (a company established in Singapore, with data hosted primarily within the European Union). Processing your queries with the AI tools therefore involves transferring their content outside the European Union; Stripe's processing of your billing data involves a separate transfer, limited to what payment requires.

These transfers are governed by the standard contractual clauses adopted by the European Commission, supplemented, where the provider has joined it, by its certification under the EU-U.S. Data Privacy Framework. You can obtain a copy of the applicable safeguards by writing to contact.mquantum@gmail.com.

If you would rather avoid any transfer of your research content outside the European Union, you can use RevueNova without the artificial-intelligence features: everything else (bibliographic search, notebook, screening) remains fully available.

6. Retention and security

Your data is retained for as long as you use the service. It is deleted no later than 3 years after your last sign-in, or upon your deletion request. Passwords are stored in encrypted form and are never accessible in clear text.

By way of exception, accounting records (subscription invoices) are kept for 10 years from the end of the financial year, in accordance with Article L. 123-22 of the French Commercial Code. This retention is required by law and survives the deletion of your account.

7. Your rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• the right of access, rectification and erasure of your data;
• the right to restriction of and objection to processing;
• the right to data portability;
• the right to give directions concerning your data after your death.

To exercise these rights, contact us at contact.mquantum@gmail.com.

Complaint to the supervisory authority

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr. If you reside in another EU member state, you may also complain to your own national authority.

Deleting your account

You can delete your account and all associated data, permanently and immediately, from the Settings section of your RevueNova workspace. Only the accounting records mentioned in section 6 are kept beyond that point, because the law requires it; they are then used solely to meet our tax and accounting obligations.

8. Cookies

RevueNova uses no advertising cookie and resells no browsing data. We measure site traffic with Vercel Analytics, a tool that sets no cookie and does not identify visitors individually. The cookies actually set are strictly necessary for the service to work — notably to keep your authentication session and remember your language. These technical cookies do not require prior consent; you can delete them at any time from your browser settings.

One exception worth naming: the sign-in and sign-up screens embed hCaptcha (see section 4), a third-party service that may set its own technical cookies for the time it takes to verify that you are not a robot. That check protects accounts against automated sign-ups: it too falls under strictly necessary cookies, and is used for no advertising or audience-measurement purpose.