Research79

Privacy Policy

Last updated: October 24, 2026 · Effective: October 24, 2026 (scheduled changes below take effect on the dates shown)

Notice of upcoming changes

Effective October 27, 2026 — The AI we use to suggest variable names and types will change from Google Gemini (Seoul, Republic of Korea region) to Anthropic Claude (United States). From that date, the column names and a portion of observed values used for these suggestions (identifier columns we automatically detect and open-ended text are not sent, and category values that appear only once are grouped) will be sent to the United States and kept by Anthropic for up to 30 days before deletion (not used for training). If you do not agree, you may delete your account or stop using the Service before the effective date.

Effective November 1, 2026 — Sign-in links, verification codes, and notice emails will be sent through Amazon SES (Amazon Web Services Korea LLC, Seoul, Republic of Korea region) instead of Google Workspace email (United States). Amazon SES does not keep message content after sending; only addresses that bounce or are reported as spam are kept, until deleted, so that we do not email them again. This reduces what is retained (§7).

October 24, 2026 update: we gave notice of the change in how we send emails (effective November 1, 2026; see above) and added it to §7. We also corrected §7 to state that emails are currently sent from a Gmail account rather than Google Workspace (a correction of the description, not a change in processing).

October 19, 2026 update: we added service providers we already use but had not listed (Google Workspace email, Upstash, PayPal; NHN KCP for Korean payments) and stated processing locations precisely (Vercel servers in the eastern United States, file storage in Seoul, Google Gemini processing in Seoul) — an omission correction, not a change in processing. We also replaced raw email and IP rate-limit keys with irreversible values, stopped using an external font server, and remove URL parameters from page addresses sent to Google Analytics.

October 18, 2026 update: this update corrects how we describe the handling of uploaded data (temporary storage of the original file, the limits of automatic detection, staff access, and automatic application of AI variable suggestions) and what each overseas provider processes (Vercel file storage added, the Neon entry corrected, Railway computation only, the Anthropic analysis guide not yet launched), along with our deletion, access-log, and security-measure wording, to match what actually happens. The previous update, effective September 30, 2026, added Anthropic, PBC (United States) to §7 for the post-upload analysis guide.

newmean.ai (“Company”, “we”, “us”), operator of research79, respects your privacy and processes personal information as described below. This Policy applies to the research79.com site and global users.

1. Core principle — we automatically remove columns that directly identify people

Your file is stored briefly in private storage while we process it. We automatically look for and remove columns that directly identify people (name, contact number, email, student ID, etc.), and delete the original file right after processing. Detection can miss things, and open-ended answers are kept as written. Columns used in analysis, such as date of birth, age, and sex, are kept.

What we retain is analysis data from which automatically detected identifying columns have been removed. We process it for statistical-analysis purposes only and do not attempt re-identification. We do not create or retain additional information (e.g., an identifier-mapping table) that would link it back to individuals.

Staff access.Routine admin screens don’t show response rows. Staff with admin privileges can access stored data when strictly necessary, for example to fix a problem.

Free-text (open-ended) responses. The text of open-ended survey responses is retained and displayed verbatim as part of the research data. We automatically detect and remove entire identifier columns (name, contact, email, phone), but we do not automatically mask or remove text within the body of free-text responses. Free-text answers may therefore contain identifying or sensitive information, so you must warrant that (i) you obtained the consent or lawful basis needed to collect and use that data, and (ii) you reviewed the free-text responses beforehand so that they do not contain the identifying or sensitive information of respondents or third parties (Terms §4). We treat free-text responses as part of the analysis data and process them for analysis purposes only.

Our role for uploaded respondent data. For the survey-response data you upload about third parties (your respondents), you determine why and how it is processed — you are the controller/business for that data — and we act as your service provider/processor, processing it only to provide the Service to you and on your instructions. We do not use respondent data for our own purposes.

2. Information we collect and how

  • Account (required): Google account email, name, profile identifier — via Google sign-in (OAuth); or your email address — via email magic-link sign-in.
  • Payment: transaction identifier, payment-method type, authorization result, receipt/invoice details — via our payment service provider PortOne (PayPal channel for the US); we do not collect or store original payment-instrument data such as card numbers.
  • Automatically collected: access logs (IP, timestamp), Service-usage records, device/browser information — generated automatically during use.
  • Usage analytics: de-identified interaction events collected via Google Analytics 4 (see §10) — no uploaded data, variable names, response values, or direct identifiers.
  • Inquiries/feedback: the content you submit and (if signed in) your email — via the feedback widget or email inquiry.
  • Free-access applications: your signed-in account email, affiliation, and application details — when you submit the application form.

After processing, uploaded survey data itself is kept only as analysis data, with the identifier columns we automatically detect removed (see §1).

3. Purposes of processing

  • Member identification and login; linking analysis records (“My analyses”) to your account
  • Providing the statistical-analysis service (data cleaning, computation, delivery of results)
  • Processing payments, issuing receipts/invoices, handling refunds and inquiries
  • Reviewing free-access applications, notifying applicants, granting access, and maintaining program records
  • Stable operation of the Service (abuse prevention, incident response) and compliance with legal obligations

We send transactional emails necessary to operate the Service (for example, sign-in links and replies to your inquiries); we do not send marketing email.

4. Retention and use periods

  • Account information: until account deletion.
  • Free-access applications submitted on or after August 27, 2026: retained for two years from the application date, then automatically deleted. Earlier applications follow the retention period disclosed when they were submitted.
  • Guest uploads (no account): automatically deleted 24 hours after upload, unless you sign in and link them to your account (the periods below then apply).
  • Analysis data and results (unpaid): automatically deleted 30 days after upload.
  • Analysis data and results (paid): retained 1 year, then deleted (you may delete earlier).
  • On account deletion: analysis data and results deleted without undue delay.
  • Payment/transaction records: retained separately for the period required by applicable tax and recordkeeping law (at least 5 years), even after account deletion, as permitted by law (see Terms §7).
  • Inquiry/dispute-handling records: retained for the period required by applicable law.
  • Access logs: not stored separately; they remain only in short-term abuse-prevention records (up to 2 days) and in our hosting provider’s server logs (for the provider’s retention period).

5. Deletion procedure

Personal information whose retention period has expired or whose purpose has been achieved is deleted without undue delay. Electronic files are deleted from our live database and storage; copies in short-term database backups expire automatically.

6. Service providers (sub-processors)

We use the following service providers. (Domestic-Korea processing by PortOne for the KR site is described in the KR policy; for the US site, PortOne processes payments via the PayPal channel.)

  • PortOne — payment processing and payment-method authentication (PayPal channel for the US).
  • NHN KCP — card payment processing for the Korean site (Republic of Korea).

7. International data transfer and storage

By using the Service, you understand that your information will be processed in Singapore, the Republic of Korea, and the United States, which may have data-protection laws different from those where you live. We take reasonable steps to protect your information consistent with this Policy wherever it is processed. The Service is not offered or directed to individuals located in the European Economic Area or the United Kingdom.

The Service is operated from infrastructure outside the United States. Data from US (and global) users is processed and stored on cloud infrastructure located in Singapore and (in part) the Republic of Korea and the United States, as described below. We automatically remove the direct-identifier columns we detect and use only the resulting analysis data, but stable statistical computation and service delivery require some processing and storage by overseas cloud providers.

  • Neon (database) — Singapore. Items transferred: account email, Google sign-in tokens, consent and payment records, free-access application details (email, affiliation, application text), uploaded file names, dataset summaries (variable names, types, category labels, summary statistics), and analysis settings and results. Purpose: database storage. Timing/method: real-time over the network during use. Retention: as set out in §4 for each category (for example, analysis data: unpaid 30 days · paid 1 year · deleted on account deletion; payment records: 5 years).
  • Railway (compute) — Singapore. Items transferred: the response values needed for an analysis, converted to numbers (open-ended text is not sent), plus variable display names and bin labels. Purpose: statistical computation (R analysis engine). Timing/method: real-time over the network at upload, during data cleaning, and at each analysis run. Retention: used only for the computation and not kept.
  • Vercel, Inc. — United States (servers in the eastern US; file storage in Seoul, Republic of Korea). Items transferred: Service-usage records, access logs, and account identifiers (email, name); bot-detection signals (BotID — browser and request characteristics); your uploaded file (kept briefly in private storage while we process it and deleted right after); and the response-value rows of your analysis data (including verbatim free-text, in private storage). Purpose: web-application hosting, request processing, and file storage. Timing/method: real-time over the network during use. Retention: analysis data as in §4; server logs for the provider’s retention period; account identifiers until account deletion.
  • Google LLC — Gemini API (Vertex AI), processing region Seoul, Republic of Korea (asia-northeast3) — through October 26, 2026; from October 27, 2026 this processing moves to Anthropic (below) and nothing is sent to Google. Items transferred: survey questionnaire / column-name text and a portion of observed values from the analysis data — identifier columns we automatically detect are not sent. Purpose: at upload, suggesting variable names, variable types, and reverse-scored items (suggested variable names and some types are applied automatically, and you can change them at any time). Timing/method: over the network at upload. Retention: processed immediately and not stored (no training use; Zero Data Retention — caching disabled and abuse-logging opt-out, per the Cloud Data Processing Addendum).
  • Google LLC — Gmail (sending) and Google Workspace email (receiving inquiries), United States. Items transferred: recipient email address and content of sign-in-link and notice emails (sending through October 31, 2026; from November 1, sending moves to Amazon SES below); content of inquiries and feedback and a reply email if you provide one. Purpose: sending service emails and receiving inquiries. Timing/method: when an email is sent or received. Retention: inquiries and feedback for 3 years after handling (consumer-dispute records); other email copies for the mailbox retention period.
  • Amazon Web Services Korea LLC — Amazon SES, Seoul, Republic of Korea region (from November 1, 2026). Items transferred: recipient email address and content of sign-in-link, verification-code, and notice emails, and feedback you send to our inbox. Purpose: sending service emails. Timing/method: when an email is sent. Retention: message content is not kept after sending; addresses that bounce or are reported as spam are kept until deleted so that we do not email them again.
  • Upstash, Inc. — Singapore. Items transferred: email addresses and IP addresses converted with a secret key into irreversible values (the original values are not sent), and request counts. Purpose: rate limiting and abuse prevention. Timing/method: at each request. Retention: deleted automatically within 2 days.
  • PayPal, Inc. — United States. Items transferred: the payer’s PayPal account and payment information. Purpose: payment processing on research79.com. Timing/method: at payment. Retention: per PayPal’s retention policy and the legally required period for transaction records.
  • Google LLC — United States. Items transferred: Google account authentication info (email, name, profile identifier). Purpose: Google account sign-in. Timing/method: over the network at login. Retention: until account deletion.
  • Google LLC — Google Analytics 4, United States. Items transferred: de-identified interaction events (no uploaded file names, variable names, response values, or direct identifiers). Purpose: usage analytics to improve the Service (see §10). Timing/method: over the network during use. Retention: per Google Analytics data-retention settings.
  • Anthropic, PBC — United States (privacy@anthropic.com). Variable suggestions (from October 27, 2026): survey questionnaire / column-name text and a portion of observed values from the analysis data (the same items as the Google entry above — identifier columns we automatically detect and open-ended text are not sent, and category values that appear only once are grouped), to suggest variable names, types, and reverse-scored items (suggested names and some types are applied automatically and you can change them at any time), sent during data cleanup. Post-upload analysis guide (in preparation; nothing is sent until the feature launches): survey questionnaire / column-name text and per-variable summary information (variable type, response counts, missing and outlier counts, rounded summary statistics, category labels) — no individual response values, no original identifiers, and no file name. Purpose: right after upload, describing what the survey measures and outlining cleanup priorities, possible research questions, and candidate scale groupings (an optional analysis aid; nothing takes effect until you confirm it). Timing/method: over the network at upload. Retention (both): inputs and outputs are deleted by Anthropic within 30 days (up to 2 years if flagged by automated policy-violation detection, or where required by law) and are not used for model training (Anthropic Commercial Terms and Data Processing Addendum).

Data reach (important): Analysis microdata (full response-value rows, including verbatim free-text) is kept in Vercel private storage, and only the values needed for computation are sent, as numbers, to the statistical-computation engine (Railway). The LLM providers receive only the survey questionnaire / column names, plus either a portion of observed values from the analysis data (for suggesting variable names, types, and reverse-scored items — Google Gemini through October 26, 2026, Anthropic Claude from October 27, 2026) or per-variable summary information (Anthropic Claude, for the post-upload analysis guide), and identifier columns we automatically detect are not transferred to them. Suggested variable names and some types from AI are applied automatically, and you can change them at any time; the post-upload analysis guide (Anthropic Claude, in preparation) takes effect only after you confirm it. Statistical figures and result sentences are produced by the verified statistical engine and deterministic templates, not by the LLM.

8. Your privacy rights

Today, you can exercise the following through account settings or by contacting contact@newmean.ai, and we will act without undue delay: (i) access and correct your information; (ii) delete analysis data and results (including paid data within its 1-year retention, on your request); and (iii) suspend processing or delete your account. Where we must decline a request because of a legal retention obligation or other unavoidable reason, we will notify you of the reason and how to object.

9. Security measures

  • Automatic detection and removal of identifier columns, and deletion of the original uploaded file right after processing
  • Controls for analysis data: not creating or retaining additional information (e.g., identifier-mapping tables); an internal rule prohibiting re-identification
  • Encryption in transit (TLS); admin screens restricted to designated staff accounts; admin access records (who, when, from where, what) kept for at least 2 years and reviewed regularly
  • No retention of payment-instrument data (handled by the payment service provider)
  • Contractual controls: service providers that store or process analysis data (§7) do so under their data-processing agreements, only to provide their services to us
  • Breach notification: if a security breach affecting your personal information occurs, we will notify affected users and any applicable regulators without undue delay, as required by applicable law

10. Cookies and analytics

The Service uses essential cookies to keep you signed in. We also use Google Analytics 4 (Google LLC) to understand how the Service is used and to improve it. Google Analytics collects de-identified interaction events (for example, screen views and key actions such as trying the demo, signing in, uploading, and paying). We have configured our events so that uploaded file names, variable names, response values, and directly identifying information are not sent to it; Google states that Google Analytics 4 does not log or store individual IP addresses. This usage data is transferred to Google in the United States (see §7). You can opt out by blocking cookies in your browser or by installing Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout).

Do Not Track. Because there is no industry-standard consensus on how to interpret “Do Not Track” (DNT) browser signals, the Service does not currently respond differently to DNT signals. Page addresses sent to Google Analytics keep only the path and campaign markers (utm, c); other URL parameters are removed. Fonts are served from our own servers, so no external font server receives your connection details. Other than Google Analytics as described above, we do not authorize third parties to collect personally identifiable information about your online activities across different websites or over time when you use the Service.

11. Notice for California residents

We are a small business and do not currently meet the thresholds that make the California Consumer Privacy Act (CCPA/CPRA) mandatory for us. Even so, we make the following available to all users, including California residents: you may request to access, correct, or delete your personal information, and you may delete your account at any time (see §8). We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We do not discriminate against you for exercising these rights. To make a request, email contact@newmean.ai.

12. Children’s privacy

The Service is intended for researchers, requires its users to be at least 18 years old (Terms §3), and is not directed to children under 13; we do not knowingly collect personal information from children under 13 as account holders. If you believe a child under 13 has provided us personal information as an account holder, email contact@newmean.ai and we will delete it. Separately, uploaded survey data may include responses from minors; you are responsible for any parental-consent requirements for that data, including under the U.S. Children’s Online Privacy Protection Act (COPPA) where applicable (see Terms §4).

13. Privacy contact

Operator: Newmean AI (뉴민에이아이), a sole proprietorship registered in the Republic of Korea · Address: 708-B99, 100 Crystal-ro, Seo-gu, Incheon, Republic of Korea · Privacy contact: contact@newmean.ai

14. Changes to this Policy

If this Policy changes, we will give notice within the Service at least 7 days before the effective date (30 days for material changes), including the effective date of the change. Material changes will also be announced conspicuously within the Service.