Privacy Policy
SVELA AI SOFTWARE LABS PRIVATE LIMITED operates RefRight, including its web application, reference API, Microsoft Word add-in and Google Docs add-on. This policy describes the information processed when you use these services.
1. Information processed
- Accounts: your name, email address, organisation details, password hash, session records and API-key records.
- Reference content: reference text, identifiers, bibliographic metadata, and documents you submit to the features you use.
- Saved work: references, collections, formatting preferences and custom styles you save.
- Billing and usage: credit balances, payment/order records, request counts, reference counts, the product surface used (such as Word or web), and account-linked service activity when you are signed in. Usage records do not include the reference text you process.
- Technical information: network and request information used for security, rate limits, diagnostics and service operation. Web and Word authentication use HTTP-only session cookies. The Google Docs add-on stores its RefRight session in Google Apps Script user-specific properties, as described below.
- Support: information you include when contacting us.
2. How information is used
We process information to provide reference parsing, formatting and verification; maintain your account and saved work; manage credits and payments; monitor adoption and service reliability; respond to support requests; and investigate errors or abuse. An access-restricted RefRight administration view shows account and aggregate usage information to authorized staff.
Email verification and password reset use time-limited codes. Pending signup information includes a password hash. Verification codes are stored as keyed hashes; completed or expired challenges cannot be reused.
Google Docs add-on
The add-on requests access to the current document. When you click Use selection, it reads selected reference text; when you click Find in document, it reads text following a References or similar heading in the active document tab. You can also paste or import references. A DOCX import sends that chosen file to RefRight for extraction; text, BibTeX and RIS imports are read in the sidebar before you submit references. It does not list your Drive files or read Gmail.
Formatting sends the references you submit, citation style and chosen options through Google Apps Script to RefRight. Optional identifier lookup, DOI checks, missing-detail enrichment, journal checks and retraction checks send the relevant reference identifiers or metadata to RefRight and its reference lookup providers. Library search sends the search query to RefRight and returns references saved in your account. Insertion adds text at your cursor, appends a bibliography or replaces whole selected reference paragraphs when you explicitly choose that action.
Your RefRight email address and password pass through Apps Script to RefRight for sign-in. The add-on does not save your password. It stores the resulting session identifier in user-specific Apps Script properties and uses it for authenticated requests. Signing out removes that stored session and requests its revocation at RefRight.
Formatted previews, parsed reference details and the originating document and tab identifiers are stored in a user-specific Apps Script cache so that insertion or replacement uses the reviewed result in the same tab. The cache is configured for up to 30 minutes and may expire sooner. The cached result is removed after successful insertion or replacement. The document and tab identifiers used for this check are not included in the add-on's formatting request to RefRight.
3. Service providers and integrations
The data sent depends on the feature you choose:
- Reference lookup services: services such as Crossref, PubMed, arXiv, Open Library and DOI resolvers receive reference identifiers or search text to retrieve or verify bibliographic information.
- Email delivery: Zoho ZeptoMail processes recipient addresses and transactional email content for verification and password reset when email delivery is enabled.
- Payment processing: enabled checkout providers process payment information under their own policies. RefRight stores order and payment-status records; payment-card entry is handled by the provider. The checkout identifies the provider in use.
- Infrastructure: hosting, database and network providers process data needed to run the service. The production service uses a Hostinger VPS in Mumbai, India, with a separate application database.
- Microsoft Word: Microsoft provides the Office host and Marketplace listing for the Word add-in. RefRight processes content sent by the add-in's features.
- Google Docs and Apps Script: Google hosts the document, sidebar and Apps Script execution, including user-specific session properties and temporary preview cache. RefRight processes the reference content you submit for formatting. The add-on uses current-document access, sidebar access and outbound-request permissions for these functions.
External providers apply their own privacy policies. Avoid submitting confidential information that is unnecessary for the feature you are using.
4. Storage and retention
Account and service records are stored in the application's database; saved files and custom styles may also use application storage. Retention depends on the type of record and the service operation. Operational backups are maintained to support recovery. Backup copies may retain records after removal from the active service; contact us for a data-deletion request.
For data access, correction, export or deletion requests, contact support@refright.app. We may need to verify ownership and identify records that must be retained to meet applicable obligations before completing a request.
5. Security
Public hosted access uses HTTPS. Passwords are hashed with scrypt and per-user salts. API keys are hashed before storage. Verification and reset codes expire, have attempt limits, and are single-use. No security measure eliminates every risk; keep your passwords, API keys and verification codes private.
6. Policy updates and contact
Changes will be reflected in this page's last-updated date. Contact us about this policy or your information:
SVELA AI SOFTWARE LABS PRIVATE LIMITED
support@refright.app
Business contact: +91 7358057919
Registered office: No. 1, Emerald Nagar, SIPCOT, Ranipet, Tamil Nadu, 632403, India.