Beta
This Privacy Policy describes how TIKMOON LTD (“TIKMOON”, “we”, “us”) collects, uses, and shares personal data when you visit www.medicrab.com (the “Website”) or use the MediCrab desktop application and its online features (together, the “Service”).
1. Who we are
The data controller is TIKMOON LTD, a private limited company registered in England and Wales (company number 13544903), with its registered office at 61 Bridge Street, Kington, Herefordshire, United Kingdom, HR5 3DJ. You can contact us at contact@medicrab.com.
2. Scope
This policy applies to the Website, to MediCrab accounts, and to features of the application that communicate with our servers. It does not apply to third-party services that you choose to connect to MediCrab using your own credentials. Those services are governed by their own terms and privacy policies.
3. Personal data we collect
Data you provide
- Your email address, when you create an account or contact us.
- The content of messages you send to us.
Data collected automatically
- Technical data such as IP address, browser or device type, and pages requested, processed for delivery, security, and diagnostics.
- Account and usage records, such as sign-in events, your plan and subscription status, usage allowances, and the type and time of online requests made from your account.
- Payment records, such as the amount, date, and a Stripe customer identifier. Card details are collected and stored by Stripe; we do not receive or store full card numbers.
- A language preference stored in your browser.
- Website statistics. When you browse the Website, a statistics service that we run on our own servers records the page visited, the referring website, campaign tags in the link (such as utm_source), browser language, browser and device type, screen size, and approximate location (country, region, and city) derived from your IP address, together with clicks on download links and use of the free tools. It does not use cookies and does not store your IP address; visits are grouped by an anonymous identifier that changes every month. Text and files you enter into the free tools are not sent to us, except as described under “Model option in the abbreviation tool” below.
Content processed by online features
MediCrab stores your project files on your own computer. When you use an online feature, the application sends only the content required to complete that request to our servers and to the service providers described in section 6. MediCrab applies default measures to limit the personal data included in such requests, but you remain responsible for the content you choose to process.
When you use the AI models provided through MediCrab with your MediCrab account, our servers relay your requests and do not store request content or model responses. So that a transfer can resume after a network interruption, a model response is held temporarily in memory and is deleted automatically after no more than 15 minutes. For billing and security purposes we keep request metadata, including the request type, time, model used, amount of usage, app version and operating system, and IP address.
Search queries. When you use literature search or web search, your search terms, titles, or DOIs are sent to public bibliographic databases and search providers (such as PubMed and Crossref); some are relayed through our servers. Our usage records note only the type and time of each search, not the search terms themselves.
Model option in the abbreviation tool. If you choose to have a model provided by MediCrab find missing full terms in the Website’s abbreviation tool, only the sentences shown to you before sending pass through our servers to the model providers described in section 6; we do not store them. To prevent abuse, uses are counted per day against a one-way hash of your IP address, together with the page, language, number of sentences and outcome, never the sentences themselves. The hash records are deleted within 7 days.
Literature cache. To speed up checks, we store public bibliographic facts, such as retraction status and the bibliographic details matching a DOI. We do not store abstracts or full texts, and we do not record who made a lookup.
4. How we use personal data
- To provide, maintain, and support the Service, including account sign-in and online features.
- To operate and secure the Website and our servers, and to prevent fraud and abuse.
- To communicate with you about the Service and respond to your requests.
- To understand how visitors find and use the Website, using the website statistics described in section 3.
- To comply with legal obligations and to establish, exercise, or defend legal claims.
We do not sell personal data. We do not use your project content to train any machine-learning models.
5. Legal bases
Where the UK General Data Protection Regulation applies, we process personal data on the following bases: performance of a contract with you (providing the Service you request); our legitimate interests (operating, securing, and improving the Service), balanced against your rights; and compliance with legal obligations.
6. Sharing of personal data
We share personal data with service providers who process it on our behalf and under our instructions, in the following categories:
- Hosting, content delivery, and network security providers.
- Transactional email delivery providers.
- Our payment processor, Stripe, which handles checkout, subscriptions, invoices, and refunds.
- Bibliographic and web-search providers, to the extent required to complete an online request that you initiate.
Artificial-intelligence model providers
When you use MediCrab models with your MediCrab account, or the model option in a free tool on the Website, the content required to complete each request is sent to the providers listed below. Each provider we use has committed in its applicable terms not to use API request content to train its models. Providers may retain request content to monitor for abuse. The retention period is set by each provider’s terms and is generally no longer than 30 days; content flagged for violating a provider’s policies may be kept longer and may be reviewed by people. Each provider’s handling of data is governed by its own terms.
| GPT models (Luna, Sol) and image generation | Microsoft (Azure) · Data, privacy, and security |
|---|---|
| Claude models | Anthropic · How long do you store my organization’s data? |
If we learn that a provider no longer makes the commitment described above, we will stop using that provider and update this list.
When you use your own API credentials, or a Codex or Claude subscription on your own computer, requests are sent directly from your device to the relevant provider. They are governed by the terms between you and that provider and are outside the scope of this policy.
We may also disclose personal data where required by law, to protect the rights, property, or safety of TIKMOON, our users, or others, or in connection with a merger, acquisition, or sale of assets, in which case you will be notified of any change of controller.
7. International transfers
TIKMOON is established in the United Kingdom. Some of our service providers are located outside the United Kingdom. Where required, we rely on appropriate safeguards recognised under UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses. Some artificial-intelligence model providers process requests in the United States or other countries.
8. Retention
We retain personal data for as long as necessary to provide the Service and for the purposes described in this policy, and afterwards only as needed to comply with legal, accounting, or security requirements. Project files stored on your computer are under your control and are not held by us. We do not retain the content of MediCrab model requests, apart from the temporary in-memory holding described in section 3. Website statistics are kept for no longer than 26 months. Third-party model providers retain data in accordance with their own terms.
9. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data; object to or request restriction of processing; and request data portability. To exercise these rights, or to close your account, contact contact@medicrab.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.
11. Cookies
The Website does not use advertising or analytics cookies; the website statistics described in section 3 work without cookies. Cookies strictly necessary for security and delivery may be set by our infrastructure providers. Your language preference is stored locally in your browser.
12. Children
The Service is intended for adult professional and academic users. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. The effective date at the top of this page indicates when it was last revised. Material changes will be posted on this page.
14. Contact
TIKMOON LTD · contact@medicrab.com · 61 Bridge Street, Kington, Herefordshire, United Kingdom, HR5 3DJ
See also our Terms of Service.