Privacy Policy

EvidenceFlow is a hosted service — when you create an account at evidenceflow.in, your data is stored on EvidenceFlow's own infrastructure, and EvidenceFlow is the data controller for the account and project data you enter. This is different from self-hosting your own copy of the software, and this policy describes how the hosted evidenceflow.in service itself handles data.

Account details (name, email, a hashed password), and any project, study, screening, extraction, and meta-analysis data you enter are stored in EvidenceFlow's PostgreSQL database. Uploaded PDFs are stored on EvidenceFlow's servers. None of this is transmitted to any third party by EvidenceFlow itself.

AI-assisted screening, scoring, and extraction run via Ollama on EvidenceFlow's own infrastructure. Study titles, abstracts, and full text used for AI suggestions are processed there and are not sent to any external AI API.

To retrieve full-text PDFs and bibliographic metadata, EvidenceFlow queries public scholarly APIs — PubMed Central, Unpaywall, Europe PMC, Semantic Scholar, OpenAlex, Crossref, bioRxiv/medRxiv, and CORE. Only identifiers such as titles, DOIs, and PMIDs are sent to these services to locate open-access content.

If you subscribe to AI-assisted features, your payment is processed by Razorpay, our payment processor. Your card, UPI, or bank details go directly to Razorpay and are never seen or stored by EvidenceFlow. We store only your subscription status and billing period dates, needed to know whether your account has AI access.

Authentication tokens are stored in your browser's local storage to keep you signed in. Clearing your browser storage or logging out removes them.

You own the data you enter. To request export or deletion of your account or project data, contact contact@evidenceflow.in.

This policy may be updated as the platform evolves. Check this page for the current version.