Privacy Policy

Who we are

Retrievals is a UK-based project that operates a semantic search service over curated National Gallery of Art images. Retrievals is responsible for the processing described here. This policy explains how we handle personal information. Contact us at mmohamoud01@qub.ac.uk about privacy or account deletion.

Account information

Search requires an account. Clerk handles account creation, sign-in, credentials, session cookies, and security information such as device details and IP addresses. We receive your account identifier and can administer your account. Our Convex database stores a limited copy of your Clerk identifier, primary email address, name, profile image URL, and account update information. We do not copy your password into Convex.

Public collection pages, blog posts, and these policies can be read without an account. If you contact us, we also receive the information you include in your message. Do not send sensitive personal information in search queries.

Search queries and browser storage

Your browser sends query text through our Next.js server to Modal. A quantized EmbeddingGemma 2 model runs on CPU there and compares your query with the artwork index. We run the model ourselves on Modal; search does not send your query to a Google-hosted model API.

We do not maintain account search history in our database. The app saves your current query, results, and query vector in browser session storage to restore the search. Cached search data has a 12-hour freshness limit and is normally cleared when the browser session ends. The query also appears in the search page URL and may appear in your browser history and hosting request logs.

Modal may retain Function inputs and outputs for up to seven days. Application log retention depends on the Modal plan. Our search logs record request identifiers, result counts, timing, and errors. See Modal's retention policy. Optional analytics and search tracing can also contain query text when you consent, as described below.

Optional analytics and error reports

If you accept analytics, PostHog can receive page visits, interactions, search queries, browser and device information, and your signed-in account identifier and name. This can include session recordings when enabled. Google Analytics, Vercel Analytics, and Vercel Speed Insights may also receive usage and performance information when configured. Providers may process IP addresses and estimate general location.

Sentry browser error reports and browser performance traces require analytics consent. Sentry server error reports can run without that consent to diagnose failures and can include the affected account identifier. Server-side search traces include query text only with analytics consent. We configure server telemetry to exclude automatic collection of cookies, request headers, request bodies, and URL query parameters.

Cookies and your choice

Clerk uses necessary sign-in cookies. A first-party cookie remembers your analytics choice for up to one year, and local storage remembers it in your browser. Optional analytics stay off until you accept. Rejecting analytics does not prevent search. We do not use advertising cookies or sell personal information.

Use this button to withdraw consent or choose again. Withdrawal stops future optional collection; it does not automatically erase data already collected. You can also request deletion by emailing mmohamoud01@qub.ac.uk.

Service providers and international processing

We use these providers to operate the service:

• Clerk for accounts and sign-in.
• Convex for the limited account profile copy.
• Vercel for hosting and optional analytics and performance measurement.
• Modal for query processing and search compute.
• Cloudflare for artwork thumbnail storage and delivery.
• PostHog for optional product analytics, recordings, and error tracking.
• Google Analytics for optional website measurement.
• Sentry for error reports and consented search tracing.

These providers may process data in the United States and other countries outside your country of residence. Contact us for information about processing locations and the transfer safeguards applicable to your data. We may also disclose information when legally required or necessary to address fraud, security incidents, or legal claims.

Retention and deletion

We retain your account profile while your account exists. Clerk deletion events remove the Convex profile copy. A deletion marker holds the Clerk identifier and deletion timestamp with a 30-day expiry to prevent delayed events from restoring deleted profiles. Periodic reconciliation removes expired markers. Webhook delivery and provider backups can delay complete removal.

Operational logs, analytics, recordings, and error reports have separate provider retention settings. We use them to measure usage, investigate faults, and protect the service. Contact us for the current retention periods or to request deletion. We retain correspondence while needed to answer your request or meet legal obligations. Deleting an account does not by itself clear browser history or local browser storage.

Purposes and legal bases

Where the UK GDPR or EU GDPR applies, we process account details and queries to provide the service you request. We rely on consent for optional analytics and on legitimate interests for service security, fraud prevention, and diagnosing server failures. We may also process information to meet legal obligations. Required account information is necessary to sign in; optional analytics are not.

Your rights and complaints

Depending on applicable law, you can request access, correction, deletion, restriction, or a portable copy of your personal data. You can withdraw analytics consent at any time without affecting the lawfulness of earlier processing.

You can object to processing based on legitimate interests. Email mmohamoud01@qub.ac.uk to exercise your rights or raise a concern. We may need information to verify your identity and will respond within the period required by applicable law. You can also complain to your local data protection authority, including the UK Information Commissioner's Office where UK data protection law applies.

Search ranks artworks automatically. It does not make decisions about you that have legal or similarly significant effects.

Payments

Paid credit packs are not currently available. We will explain payment processing and any related personal data before introducing paid features.

Children

Retrievals is not intended for children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and remove it where appropriate.

Changes to this policy

We update the date above when this policy changes. This update describes CPU query processing, browser search storage, and the distinction between optional analytics and operational server reports.