Privacy

Privacy notice

Last updated: 3 November 2026

This notice explains how ResearchCal uses and stores personal data.

Who is responsible

Benjamin Wache, trading as ResearchCal, is the controller of your personal data. ResearchCal is an eenmanszaak (sole proprietorship) registered in the Dutch Business Register under KVK number 42166128. The address is on the provider information page. For privacy questions or requests, email [email protected] or use the contact form.

Information you give us

ResearchCal stores your email address, name if you give it, research and calendar preferences, source requests, feedback, and willingness-to-pay answers.

An email address and enough preferences to provide your calendar are necessary for an account. AI analysis, optional emails, feedback, event tips, and willingness-to-pay answers are optional. Manual preferences work without documents or research links.

Account activity

ResearchCal stores your recommendation choices, events you add, email-delivery records, sign-in-link records, your private calendar links with the names, colors and rules of your calendars, and your plan and its end date. When your calendar app fetches your private calendar, ResearchCal stores the time of the first and the latest fetch and the type of app (Google, Outlook, Apple or other); it does not store your IP address or the app's user agent. These records operate your account, calendar, and email, and show whether your calendar is connected.

Visit information

ResearchCal can store campaign labels and limited information about how you found the site. ResearchCal does not use a tracking cookie or browser storage for this information.

Why we use your data and the legal basis

• Your account and calendar. ResearchCal uses your email address, preferences, recommendation choices, events you add, sign-in links, and private calendar link to provide the service you ask for. This includes sign-in and welcome emails, emails about changes to events in your calendar, and, on a paid plan, reminders 7 days and 1 day before deadlines in your calendar close (you can stop them in Preferences or with the link in each email). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Recommendation emails and reminders. ResearchCal sends account holders emails with new event recommendations about every two weeks, and reminders to finish setting up or return to your calendar. These emails are about ResearchCal's own service. At signup, the box for these emails is already ticked, and you can untick it. Legal basis: legitimate interest in informing users about the service they signed up for (Art. 6(1)(f) GDPR), together with the existing-customer exception in Article 11.7(4) of the Dutch Telecommunications Act, where its conditions are met. ResearchCal records your choice, its time and where you made it. You can stop these emails at signup, in Preferences, or with the stop link in each email. Stopping is free. This does not stop a sign-in link that you request or close your account.
• Optional AI-assisted personalization. If you choose this feature, ResearchCal analyzes your CV, working papers, or research source links. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by removing your sources in Preferences. This does not affect processing that happened before you withdrew your consent.
• Feedback, source requests, and willingness-to-pay answers. ResearchCal uses these answers to improve the service. Giving them is optional. Legal basis: legitimate interest in improving the service (Art. 6(1)(f) GDPR).
• Plan reservations. If you reserve a plan, ResearchCal stores your email address, the plan, your billing choice, and for a program its name, approximate size and your message. ResearchCal uses them to plan the paid service and to email you when payment opens. Reserving is optional and creates no payment duty. ResearchCal keeps a reservation until 12 months after payment opens, or deletes it earlier on request. Legal basis: legitimate interest in planning the service (Art. 6(1)(f) GDPR).
• Event tips. ResearchCal uses the tips you email to it to find, check, and add research events, and to send you one automatic reply. Legal basis: legitimate interest in keeping the event calendar complete and correct (Art. 6(1)(f) GDPR).
• Public professional information. ResearchCal uses necessary names, roles and source links to identify events, check sources and explain listings. Legal basis: legitimate interest in a reliable event directory (Art. 6(1)(f) GDPR).
• Visit information, analytics, and system logs. ResearchCal uses campaign labels, aggregate traffic data, and system logs to understand how people find the site and to keep the service reliable and secure. For public pages, ResearchCal also keeps daily counts of visits that come from AI assistants (for example ChatGPT or Perplexity) and of visits by search and AI crawlers. These counts hold only the day, the name of the assistant or crawler, the type of page and a number; no IP address, user agent, URL or other personal data is stored, and the counts are deleted after 400 days. For public calendars, ResearchCal keeps daily counts of fetches by calendar apps; these hold only the day, the calendar, the type of app and a number, and are deleted after 400 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Where ResearchCal relies on legitimate interest, you can object to the processing. Email [email protected].

ResearchCal does not make decisions based only on automated processing that have legal or similarly significant effects for you. Personalization only changes which events ResearchCal recommends, and you can edit your preferences.

Optional AI-assisted personalization

If you choose this feature, ResearchCal extracts text from the first 10 pages of your CV and the first 5 pages of each of up to 5 working papers. Each AI request uses at most 100,000 characters of source text. The text is not anonymized and can include names and contact details.

ResearchCal uses only Mistral's text API for this step and does not use Mistral tools or web search. Mistral returns document-based suggestions. ResearchCal does not separately send your account ID, sign-in records, filenames, file hashes, private calendar link, or activity history.

Mistral Zero Data Retention is active, and API training use is disabled. Mistral does not use the input or output to train its models. Mistral does not keep the API input or output after it returns the response. ResearchCal keeps limited technical records, such as the provider, model, request time, token counts, and estimated cost. These records do not contain document text or suggestion text.

Only supply material you are allowed to share for this analysis. Do not supply confidential or embargoed material if its terms prohibit this use. Remove unnecessary information about other people, private contact details and sensitive information. A research topic does not necessarily describe the author's personal health or beliefs. ResearchCal does not intend to infer sensitive personal traits.

Event tips

You can email event tips to ResearchCal. ResearchCal stores your email address, the recipient addresses, the subject, the message text, and the links in the message. ResearchCal sends one automatic reply to your address.

To classify the tip, ResearchCal sends the subject, the first 2,000 characters of the message text, and the links to TypeSafe. If your message text contains your name or signature, that text can be part of what is sent. To find an official event page, ResearchCal's research routine, which runs on Anthropic's Claude, receives only the tip's links, its date and an internal number. It does not receive the subject, the message text, your email address or the recipient addresses. Links can sometimes contain personal information. ResearchCal does not send your email address or the recipient addresses to TypeSafe either. Calendar entries made from a tip do not show your name or email address.

90 days after ResearchCal receives a tip, it selects the addresses, subject, links, message text, raw classification and notes for purge. Limited tip identifiers, result labels and times are kept for up to 180 days from receipt for replay prevention and review of processing. These records are not described as anonymous. Work in progress must finish or be stopped before cleanup can safely clear it.

AI assistant connector

ResearchCal has a public connector for AI assistants (the MCP server at mcp.researchcal.com, see AI assistants). It needs no account. ResearchCal keeps a log of tool calls. A record contains only the number of results, whether the request failed, the time, and a request reference. ResearchCal does not store or log the tool name, the search text, the filters or other arguments of the request. The connector uses the search text only in memory to answer the request. ResearchCal does not attach IP addresses, user agents, session identifiers, client identifiers or account identifiers to the query-log record. ResearchCal generates the request reference; it is also returned in the response and appears in ResearchCal's own application logs. Your AI assistant chooses the text it sends. Do not put personal information in questions about events.

If you find a security weakness in the connector or the website, see Report a security issue.

ResearchCal uses these records to count connector use and to find and fix failures (to keep the connector reliable). Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can object at any time on grounds relating to your particular situation.

The service is configured to delete active records older than 30 days through an hourly deletion job. Until 21 October 2026 the records also held the tool name and the request text; those columns were removed on that date. ResearchCal has no database backup schedule, so it keeps no backup copy of the removed columns. The records are stored with Railway in the United States under Railway's data processing agreement with standard contractual clauses. Backups and provider logs are covered under "Storage and deletion" and keep their own retention periods. Railway and Cloudflare also process network traffic to the connector, including IP addresses. This traffic processing is separate from the query log. See the service-provider section and the Railway and Cloudflare privacy notices.

To ask for access to or deletion of a record, email the privacy address under "Who is responsible" ([email protected]). The request reference and the time help us find the record, but they are not a condition. We may ask for proportionate information to check your identity and your entitlement to the relevant personal data, and to protect other people's data. Your AI assistant provider processes your conversation under its own privacy notice (OpenAI, Anthropic, Meta, and others).

Public event and research information

Information comes from organizer websites, conference and call pages, public research sources and tips checked against sources. Entries link to their sources. ResearchCal uses necessary professional names and roles, not unrelated private profiles. Source imports can identify authors and coauthors.

Public source material can also be checked with AI tools, including Mistral, Anthropic's Claude and TypeSafe, in a separate editorial workflow. Private CVs and manuscripts supplied for personalization are not sent through that workflow. If a source names you, contact [email protected] to ask what we hold, correct an error, request removal or object. Include the entry or source if possible.

Storage and deletion

ResearchCal keeps your account data until you delete your account. When you permanently delete your account, ResearchCal deletes your active account data, including your preferences, recommendation choices, email-delivery records, sign-in-link records, matching stored private sessions, private calendar link, and signup records. ResearchCal selects abandoned unverified signups and linked unused accounts for deletion after 30 days from creation. Verified accounts and accounts with evidence of use are excluded from this cleanup.

You can also submit supported public profile and paper links. ResearchCal reads supported sources and sends bounded extracted content to the same Mistral text service. To read these sources, ResearchCal sends the link or identifier you submit to OpenAlex, HAL, or the source website. These sources can process request information under their own notices. OpenAlex and HAL imports require an author confirmation and use up to 50 dated works from the last five years. Website imports read the submitted page and up to five directly linked research documents. arXiv imports are currently off. Existing saved-only RePEc links do not import content.

For these imports, source links, publication titles and identifiers, content fingerprints, and generated evidence remain until source removal. Raw files and extracted text are deleted after processing. Unprocessed content expires seven days from submission, or after 35 days when waiting for the monthly AI budget. Accepted preferences remain when a source is removed. Generated profile information can affect matching before you accept visible preference suggestions. Removing a source stops further work and removes its generated contribution and pending suggestions. It cannot recall a request already sent to a provider. Information supported by another source can remain. Limited cost records without account or source identifiers can remain for budget accounting.

For the previous document import feature, ResearchCal deletes uploaded files, filenames, file hashes, and extracted text after successful processing. Failed or replaced input expires after seven days. These previous imports can be removed as one group. The research source retention periods above apply to new imports under the new acknowledgement.

ResearchCal ordinary system logs are designed to exclude uploaded document text and generated suggestion text. Provider logs have separate retention rules; see Provider logs and backups.

You can delete your documents and document-based suggestions in Preferences. You can permanently delete your active account data on the account deletion page.

Public event facts and necessary source evidence remain while useful for the directory, correction history and source checks. We review the need for personal details when listings become obsolete. Support, privacy and complaint messages remain while the matter needs action and for a limited period needed to show the response or address a specific dispute.

Provider logs, email and backups follow separate retention rules. They may not be deleted at the same time as your active ResearchCal data. Your calendar provider may retain entries or downloaded copies. We cannot delete copies from an account that we do not access.

Service providers and transfers outside the EEA

ResearchCal uses these service providers. Their role depends on the purpose and agreement. Some also use account, security or legal records for their own purposes:

• Railway hosts the application and its database in the United States.
• Resend delivers account, digest, reminder, and tip-reply email and receives event tips, from the United States.
• Cloudflare provides DNS, network delivery, and security for all website traffic. It processes IP addresses and request data for this purpose. It also provides cookieless web analytics on public pages.
• Google Workspace receives and stores email sent to ResearchCal contact addresses, such as privacy and support requests.
• TypeSafe classifies event tips and helps assign research fields to public event pages (United States).
• Anthropic runs the Claude routines that research and review public event pages, which can contain professional names, and receives the links in event tips (United States).
• Mistral AI (France) provides optional private source analysis and separate public-event analysis.
• OpenAlex, HAL and source websites receive source identifiers, links and network requests for imports you request.
• Your calendar provider receives the feed link and content when you subscribe through it.

Some providers process information outside the European Economic Area. Railway hosts the application and database in the United States. Its signed data-processing agreement includes European Commission standard contractual clauses. The table below identifies the countries and transfer safeguards for each further international transfer made by ResearchCal. You can contact [email protected] for a copy of the relevant safeguards.

Mistral AI processes in France, inside the European Economic Area. OpenAlex, HAL, source websites and your calendar provider receive requests that you start; their location depends on the service.

Provider logs and backups

No backup schedule is configured for the ResearchCal database on Railway, so ResearchCal keeps no database backups. Railway application logs expire after 7 days. Cloudflare does not publish a fixed period for the request records of this service: under its data processing addendum it keeps them only as long as needed to provide the service, and at the latest until the end of the agreement. ResearchCal does not export Cloudflare logs, and the Cloudflare dashboard shows security events for 24 hours.

ResearchCal uses necessary session and security cookies for private access and form protection. The configured public-page analytics beacon does not use tracking cookies or browser storage.

Cloudflare Web Analytics is not loaded on account pages, sign-in links, private calendar links, or internal tools. ResearchCal does not send email addresses, preferences, recommendation choices, private calendar links, or URL query strings to this service.

ResearchCal does not sell your data. ResearchCal does not access your Google, Outlook, or Apple account.

Your rights

You can ask to access, correct, delete or restrict your personal data, and object to processing based on legitimate interest. Portability applies where its legal conditions are met. Where processing is based on consent, you can withdraw your consent at any time. To use these rights, email [email protected]. ResearchCal normally answers within one month. If a lawful extension is needed for complex or multiple requests, we will explain it within that month. We may need proportionate information to check your identity. If a request cannot be met, we will explain the reason and how to challenge it.

You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or another competent EEA supervisory authority. You do not have to contact ResearchCal first.

Changes

We update this notice when our use of data changes and give appropriate notice of material changes. A notice update does not supply consent for a new optional purpose.