OrbLit

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:
Luca Rippe
Zur Hoge 32, 27639 Wurster Nordseeküste, Germany
Email: rippeluca@gmail.com

2. Overview of processing

We only process personal data to the extent necessary to provide OrbLit's features (citation network mapping with OpenAlex and Zotero integration). Specifically, we use:

  • Supabase — authentication and database (Frankfurt, EU)
  • Vercel — application hosting
  • Google — sign-in via Google account (OAuth)
  • GitHub — sign-in via GitHub account (OAuth)
  • OpenAlex — literature search (public API, no personal data transmitted)
  • Zotero — optional sync with your reference library

3. Hosting and server logs (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the site, technical connection data (IP address, date/time, page accessed, browser type) is automatically recorded in server logs. Legal basis: Art. 6(1) (f) GDPR (legitimate interest in secure and stable operation). Vercel may transfer data to the US; EU Standard Contractual Clauses (SCCs) apply as a safeguard. A data processing agreement (DPA) with Vercel is in effect automatically through use of the Vercel Pro plan: vercel.com/legal/dpa.

4. Account, sign-in, and usage data (Supabase)

Using OrbLit requires an account. Sign-in is through Google or GitHub. We store the email address the provider sends us. We do not collect a password. This data, along with the citation maps you create (titles, notes, tags, map structure), is stored with our processor Supabase Inc. on servers in the EU (Frankfurt). Legal basis: Art. 6(1)(b) GDPR (contract performance). A data processing agreement with Supabase is in effect: supabase.com/legal/dpa.

5. Google or GitHub sign-in (OAuth)

Sign-in uses your Google or GitHub account. We receive the email address the provider sends in order to create your OrbLit account. The privacy policies of Google and GitHub also apply. Legal basis: Art. 6(1)(a) GDPR (your consent by choosing this sign-in option).

6. OpenAlex search

Literature search uses OpenAlex's public, unauthenticated API. Your search queries are sent directly from your browser to OpenAlex; no account or other personal data is transmitted by us in the process. OpenAlex/OurResearch's privacy policy applies.

7. Zotero integration

If you connect your Zotero library, we store your Zotero user ID and API key encrypted (AES-256) on our servers to communicate with the Zotero API on your behalf (e.g. fetching collections, adding items). The key is never shared with third parties or stored in your browser. You can disconnect at any time within the app, which deletes the stored key. Legal basis: Art. 6(1)(b) GDPR (contract performance).

8. Cookies

We use only strictly necessary cookies (Supabase session/login cookies, a cookie storing your language preference). These are exempt from consent requirements. Should analytics or marketing cookies be added in the future, consent will be requested via a cookie banner beforehand.

9. Retention

We retain personal data for as long as your account exists. When the account is deleted, the associated data is deleted.

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). To exercise these rights, contact rippeluca@gmail.com. You may have your account and associated data deleted at any time via this contact. You also have the right to lodge a complaint with a data protection supervisory authority.