1. Scope
This Privacy Policy applies to:- Visitors to the Bower website
- Users of the Bower platform (including free, student, team, and enterprise plans)
- Anyone who communicates with us (e.g. email, support, research interviews)
2. Data controller
Benenota Pty Ltd 16 Bluejay Street, QLD 4220, Australia Email: [email protected] Data Protection Officer: David Lyon ([email protected])3. Information we collect
3.1 Information you provide
- Name, email address, and affiliation (e.g. university or organisation)
- Account credentials and profile information
- Communications with us (support requests, feedback, surveys)
- Payment and billing details (processed via third-party payment providers)
3.2 Research content and uploads
When you use Bower, you may upload or capture content such as:- Notes, images, audio recordings, transcriptions, and documents
- Experimental observations, methods, and protocols
- Metadata associated with your captures (timestamps, device type)
3.3 Automatically collected information
We automatically collect limited technical data, including:- Device and browser type
- IP address (hashed in logs, stored in audit logs)
- Usage data such as feature usage and session duration (only with analytics consent)
- Cookies and similar technologies (see our Cookie Policy)
4. How we use your information
We do not sell personal information.
5. AI and data processing
Bower uses AI to help organise, analyse, and retrieve research content.- AI features operate only on content you choose to upload or capture. They are not applied automatically without your action.
- Your content is not used to train AI models. All providers are configured with zero-retention or inference-only data processing.
- Where third-party AI services are used, they are subject to contractual confidentiality and data protection obligations.
- AI outputs are generated to assist researchers and should always be reviewed by users before reliance or publication.
6. Sharing and disclosure
We may share personal information only in the following circumstances:6.1 Service providers (sub-processors)
With trusted third-party providers who help us operate Bower. Our sub-processor page lists each provider, the data it processes, and its current DPA or BAA status. Restricted mode blocks protected content from providers without a signed BAA.6.2 Team and collaborative features
If you use team or shared workspaces, content and metadata may be visible to other authorised users in that workspace, according to your role and permissions.6.3 Legal requirements
Where required by law, regulation, court order, or to protect the rights, safety, or security of Bower, our users, or others.7. International data transfers
Bower stores and processes data using cloud infrastructure located in the United States (Google Cloud us-central1 region). The transfer safeguard depends on the provider and the agreement that applies. It may include:- Standard Contractual Clauses (SCCs), where incorporated into an applicable DPA
- The EU-US Data Privacy Framework, where the recipient participates
8. Data security
We take reasonable technical and organisational measures to protect personal information, including:- Encryption in transit (TLS) and at rest (AES-256)
- Workspace-level data isolation at the database layer
- Role-based access control (Owner, Admin, Member, Guest)
- Audit logging of all data access and modifications
- Automatic session timeout after 30 minutes of inactivity
- All secrets stored in Google Secret Manager
- Secure cloud infrastructure with private networking
9. Data retention
- Account and workspace data is retained until you delete it or your account.
- Audit logs, application logs, and backups are retained for limited periods appropriate to their purpose and automatically deleted thereafter.
- Expired share links and invitations are deleted promptly after expiry.
10. Cookies and analytics
We use cookies and similar technologies to maintain sessions, understand product usage, and improve performance. Analytics cookies require your explicit consent. See our Cookie Policy for full details on what cookies we use and how to manage them.11. Your rights
Depending on your location, you may have the following rights:
To exercise these rights, contact us at [email protected].
12. Children
Bower is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact [email protected].13. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify users via email or an in-app notification. The latest version will always be available on this page.14. Contact us
If you have questions or concerns about this Privacy Policy or how we handle personal information:- Email: [email protected]
- Data Protection Officer: David Lyon ([email protected])
- Company: Benenota Pty Ltd, 16 Bluejay Street, QLD 4220, Australia
- Supervisory authority: You have the right to lodge a complaint with your local data protection authority.