Research79

Privacy Policy

Last updated: June 29, 2026

newmean.ai (“Company”, “we”, “us”), operator of research79, respects your privacy and processes personal information as described below. This Policy applies to the research79.com site and global users.

1. Core principle — we do not store direct identifiers; we process pseudonymized data only

The core principle of the Service is that we do not store direct identifiers. When you upload survey data, items that directly identify an individual (name, contact number, email, student ID, etc.) are automatically detected and removed immediately upon upload, before storage, and that identifying information is not stored anywhere on our servers.

The analysis data we retain is pseudonymized data from which the above items have been removed — data that cannot identify a specific individual without additional information. We process it for statistical-analysis purposes only and do not attempt re-identification. We do not create or retain the additional information (e.g., an identifier-mapping table) that would be needed to re-identify individuals, so the information we hold cannot, by itself, re-identify an individual.

Free-text (open-ended) responses. The text of open-ended survey responses is retained and displayed verbatim as part of the research data. We automatically detect and remove entire identifier columns (name, contact, email, phone), but we do not automatically mask or remove text within the body of free-text responses. Free-text answers may therefore contain identifying or sensitive information, so you must warrant that (i) you obtained the consent or lawful basis needed to collect and use that data, and (ii) you reviewed the free-text responses beforehand so that they do not contain the identifying or sensitive information of respondents or third parties (Terms §4). We treat free-text responses as part of the pseudonymized data and process them for analysis purposes only.

Our role for uploaded respondent data. For the survey-response data you upload about third parties (your respondents), you determine why and how it is processed — you are the controller/business for that data — and we act as your service provider/processor, processing it only to provide the Service to you and on your instructions. We do not use respondent data for our own purposes.

2. Information we collect and how

  • Account (required): Google account email, name, profile identifier — via Google sign-in (OAuth).
  • Payment: transaction identifier, payment-method type, authorization result, receipt/invoice details — via our payment service provider PortOne (PayPal channel for the US); we do not collect or store original payment-instrument data such as card numbers.
  • Automatically collected: access logs (IP, timestamp), Service-usage records, device/browser information — generated automatically during use.
  • Usage analytics: de-identified interaction events collected via Google Analytics 4 (see §10) — no uploaded data, variable names, response values, or direct identifiers.
  • Inquiries/feedback: the content you submit and (if signed in) your email — via the feedback widget or email inquiry.

Uploaded survey data itself is processed only as pseudonymized data after identifier columns are removed (see §1).

3. Purposes of processing

  • Member identification and login; linking analysis records (“My analyses”) to your account
  • Providing the statistical-analysis service (data cleaning, computation, delivery of results)
  • Processing payments, issuing receipts/invoices, handling refunds and inquiries
  • Stable operation of the Service (abuse prevention, incident response) and compliance with legal obligations

We send transactional emails necessary to operate the Service (for example, sign-in links and replies to your inquiries); we do not send marketing email.

4. Retention and use periods

  • Account information: until account deletion.
  • Pseudonymized analysis data and results (unpaid): automatically deleted 30 days after upload.
  • Pseudonymized analysis data and results (paid): retained 1 year, then deleted (you may delete earlier).
  • On account deletion: analysis data and results deleted without undue delay.
  • Payment/transaction records: retained separately for the period required by applicable tax and recordkeeping law (at least 5 years), even after account deletion, as permitted by law (see Terms §7).
  • Inquiry/dispute-handling records: retained for the period required by applicable law.
  • Access logs: retained for the period required by applicable law.

5. Deletion procedure

Personal information whose retention period has expired or whose purpose has been achieved is deleted without undue delay. Electronic files are deleted by an unrecoverable method.

6. Service providers (sub-processors)

We use the following service providers. (Domestic-Korea processing by PortOne for the KR site is described in the KR policy; for the US site, PortOne processes payments via the PayPal channel.)

  • PortOne — payment processing and payment-method authentication (PayPal channel for the US).

7. International data transfer and storage

By using the Service, you understand that your information will be processed in Singapore, the Republic of Korea, and the United States, which may have data-protection laws different from those where you live. We take reasonable steps to protect your information consistent with this Policy wherever it is processed.

The Service is operated from infrastructure outside the United States. Data from US (and global) users is processed and stored on cloud infrastructure located in Singapore and (in part) the Republic of Korea and the United States, as described below. We remove direct identifiers before storage and use only pseudonymized data, but stable statistical computation and service delivery require some processing and storage by overseas cloud providers.

  • Neon (database) — Singapore. Items transferred: pseudonymized analysis data (survey response values, including verbatim free-text), analysis results, and account identifiers. Purpose: database storage of analysis data and results. Timing/method: real-time over the network during use. Retention: same as §4 (unpaid 30 days · paid 1 year · deleted on account deletion).
  • Railway (compute) — Singapore. Items transferred: pseudonymized analysis data (survey response values, including verbatim free-text) and analysis results. Purpose: statistical computation (R analysis engine). Timing/method: real-time over the network at each analysis run. Retention: same as §4.
  • Vercel, Inc. — United States (some Korea regions). Items transferred: Service-usage records, access logs, and account identifiers (email, name). Purpose: web-application hosting and request processing. Timing/method: real-time over the network during use. Retention: until the service contract ends.
  • Google LLC — Gemini API (Vertex AI), Singapore (asia-southeast1). Items transferred: survey questionnaire / column-name text and a portion of pseudonymized observed values — no original identifiers. Purpose: at upload, suggesting variable names, variable types, and reverse-scored items (an optional analysis aid). Timing/method: over the network at upload. Retention: processed immediately and not stored (no training use; Zero Data Retention — caching disabled and abuse-logging opt-out, per the Cloud Data Processing Addendum).
  • Google LLC — United States. Items transferred: Google account authentication info (email, name, profile identifier). Purpose: Google account sign-in. Timing/method: over the network at login. Retention: until account deletion.
  • Google LLC — Google Analytics 4, United States. Items transferred: de-identified interaction events (no uploaded file names, variable names, response values, or direct identifiers). Purpose: usage analytics to improve the Service (see §10). Timing/method: over the network during use. Retention: per Google Analytics data-retention settings.

Data reach (important): Pseudonymized microdata (full response-value rows, including verbatim free-text) is transferred only to the statistical-computation engine (Railway) and the database (Neon). The LLM provider (Google Gemini / Vertex AI) receives only the survey questionnaire / column names and a portion of pseudonymized observed values (for suggesting variable names, types, and reverse-scored items — suggestions take effect only after you confirm them), and no original identifiers are transferred to it. Statistical figures and result sentences are produced by the verified statistical engine and deterministic templates, not by the LLM.

8. Your privacy rights

Today, you can exercise the following through account settings or by contacting contact@newmean.ai, and we will act without undue delay: (i) access and correct your information; (ii) delete analysis data and results (including paid data within its 1-year retention, on your request); and (iii) suspend processing or delete your account. Where we must decline a request because of a legal retention obligation or other unavoidable reason, we will notify you of the reason and how to object.

9. Security measures

  • Automatic removal of identifier columns before storage, and a no-storage-of-original-identifiers architecture
  • Pseudonymization-specific controls: not creating or retaining additional information (e.g., identifier-mapping tables); internal controls prohibiting re-identification; retention of pseudonymized-data processing records
  • Encryption in transit (TLS); least-privilege and separated access controls
  • No retention of payment-instrument data (handled by the payment service provider)
  • Retention and review of access logs for the personal-information processing system
  • Contractual controls: service providers that store or process pseudonymized data (§7) do so under their data-processing agreements, only to provide their services to us
  • Breach notification: if a security breach affecting your personal information occurs, we will notify affected users and any applicable regulators without undue delay, as required by applicable law

10. Cookies and analytics

The Service uses essential cookies to keep you signed in. We also use Google Analytics 4 (Google LLC) to understand how the Service is used and to improve it. Google Analytics collects de-identified interaction events (for example, screen views and key actions such as trying the demo, signing in, uploading, and paying). We have configured our events so that uploaded file names, variable names, response values, and directly identifying information are not sent to it; Google states that Google Analytics 4 does not log or store individual IP addresses. This usage data is transferred to Google in the United States (see §7). You can opt out by blocking cookies in your browser or by installing Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout).

Do Not Track. Because there is no industry-standard consensus on how to interpret “Do Not Track” (DNT) browser signals, the Service does not currently respond differently to DNT signals. Other than Google Analytics as described above, we do not authorize third parties to collect personally identifiable information about your online activities across different websites or over time when you use the Service.

11. Notice for California residents

We are a small business and do not currently meet the thresholds that make the California Consumer Privacy Act (CCPA/CPRA) mandatory for us. Even so, we make the following available to all users, including California residents: you may request to access, correct, or delete your personal information, and you may delete your account at any time (see §8). We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We do not discriminate against you for exercising these rights. To make a request, email contact@newmean.ai.

12. Children’s privacy

The Service is intended for researchers and is not directed to children under 13, and we do not knowingly collect personal information from children under 13 as account holders. If you believe a child under 13 has provided us personal information as an account holder, email contact@newmean.ai and we will delete it. Separately, uploaded survey data may include responses from minors; you are responsible for any parental-consent requirements for that data, including under the U.S. Children’s Online Privacy Protection Act (COPPA) where applicable (see Terms §4).

13. Privacy contact

Operator: Newmean AI (뉴민에이아이), a sole proprietorship registered in the Republic of Korea · Address: 708-B99, 100 Crystal-ro, Seo-gu, Incheon, Republic of Korea · Privacy contact: contact@newmean.ai

14. Changes to this Policy

If this Policy changes, we will give notice within the Service at least 7 days before the effective date (30 days for material changes), including the effective date of the change. Material changes will also be announced conspicuously within the Service.