Privacy & Data Protection
SigmaCV is built on data minimization. It reads only public research metadata, matches your work by identifier (ORCID / OpenAlex ID) — never by name — and logs nothing about your choices unless you explicitly opt in. This notice explains what we process and the rights you have under the EU GDPR and Japan's APPI.
Data controller
SigmaCV is operated by Basile Chrétien (PharmD, MSc, MPH) as an independent personal project — not by, or on behalf of, any university or employer — and he is the sole data controller for the personal data SigmaCV processes. For any privacy question or request, contact him at privacy@sigmacv.org.
What we process
Account data from your sign-in provider (ORCID iD, or email / Google account); the public research metadata used to build your CV (publications, grants, affiliations and metrics from OpenAlex, ORCID, Crossref, DataCite and Open Editors Plus); the CV content and display choices you create; and an optional profile photo you upload. Your CV is private unless you choose to publish a public page.
Purpose & legal basis
We process this data to provide the service you requested — generating and exporting your CV (GDPR Art. 6(1)(b), performance of a contract). Publishing a public CV page happens only on your instruction. We do not sell your data or use it for advertising.
Who receives your data, and where it is stored
We never sell your data or use it for advertising. We share it only to run the service: with our hosting provider in the European Union (Germany), which stores it on our behalf under a data-processing agreement; and, when you sign in or sync, with the public research services we query by your identifier to build your CV (OpenAlex, ORCID, Crossref, DataCite, OpenAIRE, DBLP, ROR and similar), which receive your ORCID iD or name to return your public records and act as independent controllers of that public data. Your account and CV are stored in the EU; the controller is based in Japan, and transfers between Japan and the EU are covered by the 2019 Japan–EU mutual adequacy decision.
Research use (opt-in only)
SigmaCV is also a research project on responsible research assessment and author-name disambiguation. Logging of your curation choices for research is OFF by default and happens only with your explicit, separate consent (GDPR Art. 6(1)(a)). You can withdraw at any time from your account; withdrawal stops future logging and erases the research records already collected. Confirmatory analyses are pre-registered and conducted under an ethics/IRB protocol. If the scope of research logging materially changes, we ask for your consent again.
Retention
We keep your account and CV data until you delete your account. Deleting your account permanently removes your profile, CV, and any research records. Published public pages stop being served immediately when you unpublish or delete.
Security & cookies
We protect your data with HTTPS, access controls, and database-backed sessions (sign-in provider access tokens are dropped, not stored); the code has undergone independent security audits, and we minimise what we hold. We use a single strictly-necessary cookie to keep you signed in, and no advertising, analytics, or tracking cookies — so no cookie banner is needed. No online service can be perfectly secure, but we take reasonable, audited measures.
Your rights
You can access and export all your data (a one-click JSON export), correct it in the editor, withdraw research consent, and delete your account and all associated data at any time — directly from the app. Under the GDPR and APPI you also have the right to lodge a complaint with your data-protection authority.
Contact
To ask a question or exercise your rights, email the data controller at privacy@sigmacv.org or use the contact page. We aim to reply within 30 days.
This notice is provided in several languages for convenience; if the versions differ, the English text prevails.
We may update this notice; material changes to research logging require renewed consent.