Privacy Policy
Effective July 7, 2026
Snizyx Software LLC ("we", "us") operates Research Bounties at researchbounties.com (the "Service") and is the controller of the personal data described here. This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have. It works alongside our Terms of Service.
In short: we collect what we need to run an art-history research marketplace — your account details, the content you post, and payment records handled by Stripe. We do not sell or share your data and run no advertising. We use no tracking cookies and no third-party analytics. The content you choose to publish is public; everything else is private. You can request access to or deletion of your data.
What we collect and why
- Account data — your name, email address, and avatar, provided through your social sign-in and managed by our authentication provider, Clerk. We keep a mirror record (including a public handle) to create and secure your account and to identify your public contributions. Lawful basis: performance of our contract with you.
- Payment data — pledges and payouts are processed by Stripe. We never see or store full card numbers. We store Stripe identifiers, pledge and payout amounts, and transaction history. To pay researchers, Stripe collects and verifies payout identity information (which can include government-issued ID) directly; we receive only the verification status, not the underlying documents. Lawful basis: performance of our contract, and compliance with legal obligations (tax, accounting, and anti-fraud).
- Content you post — artist pages, bounty requests, comments, research submissions, uploaded artwork and document images, reports, and disputes. We store and display this to run the marketplace. Lawful basis: performance of our contract, and our legitimate interest in operating a research marketplace.
- Operational data — server logs, email delivery status, in-app notifications, moderation records, and an automated screening result for each artist submission. We use these to keep the Service reliable, secure, and compliant with our policies. Lawful basis: our legitimate interests in security, fraud prevention, and moderation.
- Analytics — first-party, cookieless page-view counts (see below). Lawful basis: our legitimate interest in understanding aggregate usage.
Automated screening
To enforce our living-subjects policy, new artist submissions are screened automatically using rules and, where enabled, an AI model run within our AWS environment (Amazon Bedrock). The screen receives the submitted artist details and a short excerpt of the request text, and returns a risk assessment. Decisions that block or restrict a submission are not made solely by automated means: flagged submissions are reviewed by a human moderator, and you can appeal an outcome from the artist page.
What is public and what is private
Public: artist pages, bounty requests, comments, published research, and researcher profiles are visible to anyone and may be indexed by search engines. Private: unpublished submission drafts and original uploaded documents are escrow-gated (visible only to moderators, to pledgers whose payment hold is in place, and to everyone only once research is published); reports, disputes, moderation records, notifications, email and payment records, and analytics are internal.
Cookies & analytics
We use only strictly necessary cookies: session cookies from Clerk that keep you signed in, and fraud-prevention cookies set by Stripe on payment pages. Because these are required for the Service to function, no consent banner is shown.
Our page analytics are first-party and cookieless: we record only the page path and the referring site's hostname (and we drop our own domain as a referrer). We store no IP addresses, no user identifiers, no fingerprints, and no cross-site tracking. We use no advertising or third-party analytics trackers.
Who we share data with
We disclose personal data only to the service providers (sub-processors) that run the Service on our behalf, under contract and only as needed for the purposes above:
- Clerk — authentication and account management.
- Stripe — payment processing, payout accounts, and payout identity verification.
- Amazon Web Services (AWS) — hosting and database (RDS), file storage (S3), transactional email (SES), and automated screening (Bedrock).
We do not sell or share your personal information for advertising, and we do not run third-party advertising. We may disclose information if required by law or to protect the rights, safety, and integrity of the Service and its users. Content you post publicly is visible to anyone.
We send transactional email through Amazon SES about your account and activity (review deadlines, payout notices, disputes, and similar); these service messages are part of using the Service. If a message bounces or is reported as spam, we automatically suppress further email to that address. To stop receiving email from us, contact us or delete your account.
Retention and deletion
You can delete your account, or ask us to delete it at dabh@snizyx.com. When you do, we deactivate your profile and show your comments and similar contributions as tombstones rather than under your identity. Research that has already been published and paid remains available under the publication license in our Terms, with your byline. Financial and transaction records are retained for the period required by applicable accounting, tax, and anti-fraud law. Operational logs are kept only as long as needed for security and reliability.
International transfers
We and our providers process and store data in the United States. If you access the Service from outside the US, your information is transferred to and processed in the US.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal data, and to object to or restrict certain processing. If you are in the EU or UK, you also have the right to lodge a complaint with your data protection authority.
If you are a California resident, you have the right to know, access, correct, and delete your personal information, and to opt out of its sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, and we will never discriminate against you for exercising your rights.
To exercise any right, email dabh@snizyx.com. We may need to verify your identity, will respond within the time applicable law allows, and may retain information we are legally required to keep.
Children
The Service is for adults 18 and older and is not directed to children. We do not knowingly collect personal data from anyone under 18; if we learn we have, we will delete it.
Security
We protect data with encrypted connections, a private storage bucket served only through short-lived signed links, scoped access to production systems, and by never storing full card numbers. No system is perfectly secure, but we work to protect your information.
Changes
We may update this policy; we will revise the date above and, for material changes, provide notice through the Service.
Contact
Snizyx Software LLC · dabh@snizyx.com