Emerit Science respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). This policy explains how we collect, use, share and protect your data when you use Charlie, our AI-powered scientific research assistant, as well as in the context of our commercial prospecting activity.

1. Who we are

Charlie is published by Emerit Science SAS, a company registered with the Le Havre Trade and Companies Register under number 984 135 473, with its registered office at 85 boulevard de Strasbourg, 76600 Le Havre, France. For any question regarding your personal data, contact us at contact@emeritscience.com. Emerit Science has appointed a data protection lead: you can reach them at the same address (subject “Personal data”) or by post at the registered office.

2. What data we collect

Depending on how you use Charlie, we process the following categories of data:

• Account data: email address, last name, first name, language, password. Your password is stored in hashed form by our authentication service — we never have access to it in plain text.
• Usage data: conversation history, documents imported into your libraries, notes and personalized memory, watch/alert history.
• Content submitted to the AI: your messages and documents are sent to the language model provider you choose (see section 4).
• Billing data: managed directly by Stripe, our payment provider. We never store your bank details.
• Technical data: IP address, browser type, technical logs required for the security and operation of the service.
• Professional contact details from scientific publications: if you are not yet a customer, your professional email address as associated with a publicly available publication — see section 6.

Data marked as required in our forms (email address, password, first and last name at sign-up) is necessary to create and operate your account: without it, registration is not possible. Other data (imported documents, notes, preferences, profile picture passed on by your identity provider) is optional and depends on how you use Charlie. If you are invited to join a team, its administrator gives us your professional email address for the sole purpose of sending you the invitation; if you do not accept it, no account is created and this address is deleted on request.

3. Why we process your data

• Providing the Charlie service (account, conversations, libraries, watch/alerts): performance of the contract.
• Processing your subscriptions and payments: performance of the contract.
• Securing the service, preventing fraud: legitimate interest.
• Audience measurement (Google Analytics): consent, collected via our cookie banner.
• B2B commercial prospecting: legitimate interest, with the possibility to object at any time.
• Accounting and tax obligations: legal obligation.

4. Your data and artificial intelligence

Charlie relies on language models to generate its answers. These models run exclusively within the European Union. You choose the provider used for your conversations yourself, in the application settings; its name and the country where it runs are shown there. Your messages and the documents you submit are sent to that provider to generate the answer.

Your exchanges are not used to train third-party models: our contracts with model providers exclude the use of your data for training purposes. A configuration relying solely on open models hosted in France is available to organisations that request it.

AI-generated answers may contain errors. Charlie does not make any automated decision within the meaning of Article 22 of the GDPR and does not carry out any profiling for commercial or scoring purposes. It does not replace qualified professional advice — see our terms of use.

5. Who we share your data with (subprocessors)

We never sell your data. We use subprocessors, each bound by a contract compliant with Article 28 GDPR, operating in the following categories:

Our goal is a sovereign service: the application, your data (accounts, conversations, documents, notes) and authentication are hosted in France, with a French hosting provider certified ISO 27001, and we are progressively reducing our dependencies outside the European Union (fonts, flags and other resources are now served by our own servers). We are not fully there yet: a few providers located outside the European Union handle specific functions, with the role and safeguards set out below.

• Hosting and infrastructure (France, European Union — hosting provider certified ISO 27001) — hosting of the application and of your data (accounts, conversations, uploaded documents, notes), authentication, technical logs, automatic analysis of your documents, and running the open models if you choose that option.
• Cookiebot (Cybot A/S, Denmark, European Union) — collection and archiving of your cookie consent.
• Google LLC (United States, Data Privacy Framework) — audience measurement for this website and YouTube videos, subject to your consent; sign-in with a Google account, if you choose that sign-in method (see below).
• Language model providers (European Union) — generation of Charlie's answers, depending on the provider you select in the application.
• Business email and calendar (European Union) — sending our service emails (verification codes, password resets, team invitations, monitoring reports, replies to your feedback) and booking a demonstration.
• Stripe Payments Europe Ltd (Ireland, European Union, PCI DSS Level 1) — payments and subscriptions.
• Marketing email platform (United States, Data Privacy Framework) — sending our commercial prospecting emails (see section 6).
• Hosting of this website and its DNS zone (contracting entity in the European Union; infrastructure in the United States and European points of presence, Data Privacy Framework) — technical browsing logs only; the Charlie application and your data are not hosted there.

Scientific sources and web search: to answer your questions, Charlie queries public bibliographic databases and web search engines with anonymous queries rephrased by the AI — never your identity, nor the raw text of your conversations. In the Biodata module, functional enrichment by an external service is used only if you explicitly enable it for each analysis: only the gene list is transmitted. The list of these services and their country of establishment is available on request.

Sign-in via Google, Microsoft or ProConnect: if you choose one of these sign-in methods, your identity provider sends us your identifier, email address and name, and knows that you use Charlie. It acts as a separate data controller under its own privacy policy. Sign-in with email and password always remains available.

Voice dictation: if you use the microphone to dictate a question, transcription is performed by your browser (Google for Chrome, Microsoft for Edge, Apple for Safari); the audio does not pass through our servers. You can always type your question instead.

The complete, up-to-date list of our subprocessors by name — their role, their country of establishment and the applicable safeguards — is provided on request at contact@emeritscience.com. Client organisations receive it together with our data processing agreement.

6. Commercial prospecting toward research professionals

If you are not (or not yet) a Charlie user, we may have collected your professional email address as associated with a publicly available scientific publication (for example via PubMed), for the sole purpose of presenting our services to you. Our messages are grouped by scientific discipline, without individual profiling. This address is never used for other purposes nor disclosed to a third party, apart from our email sending provider (see section 5), and you can object at any time via the unsubscribe link or by writing to us.

Every email we send contains an immediate unsubscribe link. You may also object to this processing or request the deletion of your address at any time at contact@emeritscience.com.

7. How long we keep your data

• Inactive account (no login for 1 year), regardless of your subscription: a warning email 7 days beforehand, then full, automatic deletion at 365 days.
• Deletion on request: at any time from your profile — conversations, documents, notes and watches are then erased.
• Billing data: kept for 10 years by Stripe, a legal accounting obligation, independently of your Charlie account.
• Technical logs: kept for 30 days for security and diagnostic purposes.
• Technical execution state of your AI exchanges (internal resume points): kept for 7 days, to allow resuming an interrupted response.
• Prospecting contact details (section 6): kept until you unsubscribe or object.

8. Your Rights

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of the data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: delete your account and your data at any time.
• Right to data portability: receive your data in a structured, reusable format.
• Right to object and to restriction: object to a processing activity, in particular commercial prospecting.
• Right to withdraw consent: at any time, without retroactive effect on processing already carried out.
• Post-mortem instructions: define instructions on what happens to your data after your death (article 85 of the French Data Protection Act).

To exercise these rights (other than account deletion, available directly in the application), contact us at contact@emeritscience.com. We respond within one month at the latest, which may be extended by two months for complex requests; exercising your rights is free of charge and we may ask you to prove your identity where there is reasonable doubt. You also have the right to lodge a complaint with the CNIL or your local data protection authority.

9. Cookies and trackers

On your first visit, a banner lets you accept, refuse or customise non-essential cookies, split into three categories: preferences, statistics (Google Analytics audience measurement) and marketing (embedded YouTube videos, which only load after your consent). The details of each cookie (name, purpose, issuer, lifespan) can be viewed in the “Details” tab of the banner. Your choice is kept for 12 months and then asked again; you can change it at any time via the cookie preferences icon permanently displayed on the site.

10. Transfers of data outside the European Union

Our main providers (hosting of the application, of your data and of authentication, language models, service email, payment) are located in the European Union. A few providers mentioned in section 5 are located in the United States (audience measurement and sign-in with a Google account, marketing email, hosting of this website, functional enrichment in the Biodata module if you enable it): these transfers are framed by the EU–US Data Privacy Framework and/or by the standard contractual clauses approved by the European Commission. A copy of these safeguards is provided to you on request at contact@emeritscience.com. Public bibliographic databases and search engines receive anonymous queries only.

11. Security

Encryption of communications and of data at rest, secure authentication (hashed passwords, single sign-on with Google, Microsoft and ProConnect), access segregation following the principle of least privilege, separate test and production environments, regular backups and regular security reviews. The details of our architecture and of our security measures are set out in our architecture and security dossier, provided to organisations on request, under a non-disclosure agreement.

12. Changes to this policy

Any substantial change will be notified to you by email or via a banner in the application before it takes effect. The date of the last update appears at the top of this page.

13. Contact

For any question regarding this policy or your personal data: