Licklider / Legal
Privacy Notice
Version 1.1 · Updated (UTC)
This notice covers the Licklider website, authorized SciGround access, support and privacy requests. It takes effect when published. It explains information handling; reading it is not consent to optional analytics or separate model training. Access-specific processing agreements may provide additional information and obligations.
1. Who is responsible
Responsible entity: 株式会社リックライダー (Licklider, Inc.), N&E BLD.7F, 1-12-4 Ginza, Chuo-ku, Tokyo, Japan. Representative: 小林奨 (Tasuku Kobayashi). Contact: contact@licklider.ai.
U.S. correspondence: c/o Momiji, 6080 Center Dr, Suite 600, Los Angeles, CA 90045. The responsible entity remains the Japanese company above. The initial SciGround offering is for individuals and organizations in Japan and the United States.
For research materials processed on an institution’s instructions, the institution may determine the purposes and respond to research-subject requests. Our role and processing terms depend on the actual relationship and applicable law. We remain responsible for duties that apply to our own handling.
Privacy representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:
- United Kingdom (UK)
- European Union (EU)
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/12677048463.
2. Information, sources and purposes
| Information | Source | Purpose |
|---|---|---|
| Account and authentication information, including the user identifier, login information and profile/contact fields supplied by the selected login method | You, your organization and the authentication provider | Authenticate access, issue tokens, apply study permissions and communicate about your access |
| Submitted research designs, files, settings, assumptions and instructions | You or an authorized user or connected tool | Perform requested analysis and verification, preserve the research version and deliver outputs |
| Results, claims, evidence, approvals and version/change history | Your instructions and service processing | Preserve what was checked, support authorized revisions, sharing and verification |
| Operational and security information, such as request timing, outcome/reason categories, protected actor/resource references and authentication/security events | Service operation and infrastructure providers | Deliver, monitor and protect the service, diagnose errors and investigate unauthorized activity |
| Optional UX events, such as workflow steps, completion or failure, and consent state | Consented service interactions | Understand usability and improve the research workflow |
| Contact details and the communications you choose to send | You or your authorized representative | Answer inquiries, provide support and handle complaints |
| Privacy requests, proportionate identity/authority checks, decisions and response history | You, an authorized representative, your institution or Prighter | Exercise rights and document the response |
| For a future paid purchase: customer/order and subscription references, payment status, transaction and purchased-credit balance/ownership records | You, the payment flow and Stripe | Complete the accepted purchase, manage renewals and cancellations, meet applicable accounting duties and preserve/restore an unused purchased balance |
Information needed for authentication, permission checks or a requested operation is necessary for that function. Without it we may be unable to provide the requested access or result. Optional UX analytics and separate training permission are not conditions of ordinary service use. Do not include original research files, credentials or participant identities in a support email.
The initial research intake is non-identifying, non-re-identifiable and non-clinical data with confirmed rights and external-use conditions. Synthetic and public datasets must meet those conditions too. Account, authentication and request records may still be personal information. A sample ID, public source or “metadata” label does not by itself establish anonymity. See the Terms before submission.
3. Research content and optional uses
We process submitted research materials for the requested service. Submission does not authorize publication of unpublished research, sale of research data, or a separate training or evaluation-dataset program. Original research files are excluded from Licklider’s model-training program.
Any separate use of eligible derived task, error, correction or verification evidence requires completed, explicit terms and permission for the applicable organization or workspace before collection for that purpose. Those terms must identify fields, purpose, access, retention, stopping and legal rights, and any model or recipient effects. There is no retroactive reuse of past uploads or automatic third-party or successor permission under this notice. You can use the service without that permission. This notice itself grants none.
UX analytics consent is separate. Declining or withdrawing it stops optional collection under that choice; it does not disable operational/security records needed for the service. Legal access, erasure and withdrawal rights are handled separately from a prospective collection stop.
4. Providers, recipients and sharing
| Provider or recipient | Function and information |
|---|---|
| Google Cloud | Runs the SciGround API, analysis and verification; stores research designs, submitted materials, results, Records, user identifiers and study permissions; supplies logging, monitoring and secret management |
| Auth0 / Okta | Authenticates users and issues access tokens; handles user, login and configured profile information |
| Vercel | Hosts the public website; handles web requests and technical delivery/security information, including information ordinarily supplied by a browser such as IP address, requested URL and browser headers |
| Google / YouTube | Supplies the homepage film thumbnail; after you activate the player, supplies video playback and related requests/storage as explained in the Cookies notice |
| Stripe, for a future paid purchase | Processes credit-card payments; exchanges customer/order references, subscription and transaction status and the information needed for authorized purchases. The actual Stripe agreement, entity, locations and processing disclosures must be checked before live payment collection |
| Prighter and its local partners | Representation and privacy-request handling when you use that route; handles request/contact and necessary verification information |
| Authorized recipients | Receive the research packages or access you choose to share, which may include evidence beyond a summary |
| Authorities or other recipients where legally necessary | Receive information necessary to comply with a verified lawful obligation, protect legal rights or respond to a legally justified demand |
Provider functions above identify actual service groups, not a universal contractual sub-processor authorization. If your institution requires a DPA, approved-provider list or transfer instrument, request it before affected processing. We do not treat a public provider policy as proof that every contract requirement for your use is complete.
Licklider personnel do not routinely read original research data, including for support or security troubleshooting. Automated processing, access to minimum account/case records, and infrastructure-provider handling are distinct. Necessary handling of a verified lawful demand is subject to authority/scope checks, minimization and notice where lawful and appropriate. This is not a claim of zero-access encryption or a guarantee that no provider can ever access data.
Your selected AI environment has its own terms, permissions, retention and locations. Materials already pasted into a chat or read by that AI, and results returned to it, can be handled under those terms. A direct upload route does not prevent later authorized outputs from containing research evidence. A recipient’s downloaded copy is not automatically recalled when SciGround access is revoked.
5. Countries and processing arrangements
The primary Google Cloud infrastructure running SciGround and storing research data is configured in the United States. The primary Auth0 authentication region is also the United States. Licklider operates from Japan. These primary regions do not mean that every backup, operational log, provider sub-processor or support access is confined to the United States. Website delivery and external media involve their providers’ distributed infrastructure. Your selected AI environment follows its provider, contract and settings.
Contact us for the applicable provider entities, other processing locations, backup arrangements and safeguards before submitting materials that require a particular country, transfer instrument or supplier arrangement. Required contracts and safeguards must be in place before the affected processing. This notice does not itself create them, a HIPAA BAA or EU/UK standard contractual clauses.
6. Retention and deletion
| Category | Retention rule |
|---|---|
| Research materials, results, history and Record master | Agreed service/Record contract period, until a valid earlier deletion request, subject to applicable processing terms and legal restrictions |
| Research exit | 14 calendar days for export from effective termination, then active erasure within 14 more calendar days, no later than day 28 |
| Valid earlier research-erasure request | 14-day active-system target, subject to any earlier legal deadline and applicable processing duties |
| SciGround operational telemetry | 30 days |
| Optional UX analytics | 90 days; collected only with consent |
| SciGround security audit logs | One year |
| Privacy-request and response records | 24 months after final case closure, with specific justified legal-retention exceptions |
| Purchased-credit ownership and balance records after account closure, if applicable | Only the minimum records needed to honor and restore the preserved balance, subject to applicable privacy rights and justified legal/accounting obligations. This is not research-data retention |
| Account, support, agreement and incident records | Only as needed for the relevant access, inquiry, agreement, security/legal purpose or required retention obligation; these are separate from research-data retention |
The log periods apply to SciGround-collected observation records, not every record independently maintained by hosting or sign-in providers. Normal observation records exclude original files, Record contents, prompts, tool inputs/outputs and credentials. A legal-hold extension must be specifically authorized, recorded and restricted to its necessary purpose.
The research-erasure target covers active systems. It is not an all-copy backup-expiry guarantee. Backup and provider-copy periods require the applicable provider/configuration information and, where needed, processing terms. Ask for that schedule before submitting data that requires a fixed backup-erasure deadline. Legal retention exceptions do not authorize unrelated use. A required earlier erasure or completed applicable DPA takes precedence.
An unused purchased-credit balance is preserved after subscription cancellation and account closure. Identity/authority verification is required for restoration after re-registration; deleted research data are not restored. Keeping a minimum balance record does not automatically exempt it from privacy rights.
There is no routine upload-age expiry during the agreed research-retention period and no 24-month research archive after cancellation. A valid earlier erasure can end export availability. Study withdrawal, disconnection, revocation and erasure are different actions; external copies already delivered are not automatically erased.
7. Safeguards and privacy requests
Our handling requirements include authenticated access, study-level authorization, controlled administrative access, separation of research content from service observations, restricted diagnostics and confidentiality, and procedures for requests, incidents and lawful demands. We do not claim absolute security or a certification merely from these requirements. Information about applicable safeguards, including foreign-processing arrangements, is available through contact@licklider.ai. A specific agreement must describe any measures on which your processing depends.
To request access, correction, deletion, cessation of use or disclosure, or other rights available under applicable law, email that address or use the Prighter portal. Describe your relationship to us and the requested action without sending unnecessary sensitive documents. We may request proportionate evidence of identity or authority and a secure route where necessary. An authorized representative can contact us; we verify their authority.
We respond without undue delay and within the period required by the law that applies to the request. Verification does not automatically restart a statutory deadline. If a request is refused or restricted, we explain the applicable reason and available next steps where required. Any charge must be legally permitted and explained in advance; a published fixed fee is not imposed by this notice. Contact us with a complaint; you may also complain to the relevant authority, including Japan’s Personal Information Protection Commission, and the appropriate EU/UK supervisory authority where applicable.
Where your institution controls the research processing, we may direct or forward a request to it and assist as required, rather than disclose another party’s data without authority. Customer responsibilities do not transfer Licklider’s own duties. Rights depend on the actual data, role and applicable law; a non-identifying research-intake rule does not remove rights concerning account or other personal data.
8. Website technologies and browser signals
See the Cookies and similar technologies notice for website delivery, the YouTube thumbnail and activated player, authentication and browser controls. Our site code does not implement cross-site advertising profiles or a special response to the legacy Do Not Track signal. Third-party media may process browsing/playback information under its own policy, including through its wider services; we do not promise that a browser signal stops those requests. This does not waive any legally required opt-out or consent right. Contact us to exercise a right that is not available in an interface.
9. Age, changes and versions
SciGround users must be at least 18, including organizational users. If you believe an underage user supplied information, contact us so we can stop the affected access and address the data under applicable law. This user-age restriction does not establish the age of every person mentioned in research materials.
We identify substantive revisions by version and date, retain the version history, and notify affected account contacts or present a prominent service notice where appropriate. Where a change requires consent or an amended agreement, we obtain it before that new use. An update to this notice does not itself authorize training or a charge.