Privacy and personal data

cartolex works with public data: the bibliographic records that open services publish about scientific works and their authors. A project still holds personal data: the names of the people it maps, their identifiers, their affiliations and their texts. This page says what leaves your computer while cartolex collects, what never does, what is kept and where, and how to delete it. It describes how the software behaves; it is not legal advice.

What leaves your computer

Only collection from bibliographic services reaches the network (and, if you switch it on, the AI clean-up of keywords, which sends keyword strings only; see Building a project). Importing a list, a folder of documents or a corpus sends nothing.

step	host	why	what is sent
resolution	api.openalex.org	find each person’s author records	the person’s name and its variants, the names of the institutions the list states, the ORCID or OpenAlex id the list gives
resolution	pub.orcid.org	count the works a person declared, to tell records apart	ORCID iDs
harvest	api.openalex.org	fetch the works of the confirmed records	author identifiers, DOIs
harvest	pub.orcid.org	read the works and employments a person declared	ORCID iDs
institution search	api.openalex.org	find the institutions that bear a name, for you to choose	the name you typed
people from institutions	api.openalex.org	read the institutions, the units below them and the works signed there	institution identifiers (OpenAlex or ROR)
collaborators	api.openalex.org	read the works of the seeds and of each round’s collaborators	author identifiers
coverage: retry	as the collection retried	collect again for the people whose collection failed	as that collection
the snapshot	nothing: it is read on your computer	the harvest, the institutions and the collaborators from a downloaded OpenAlex snapshot	nothing to OpenAlex; the ORCID registry still receives ORCID iDs

With every request go, as with any web request, your computer’s network address, and the program’s name (cartolex). If you give a contact address (--contact), it goes to the services in the request headers and, for OpenAlex, as a parameter; if you give an API key, it goes to its service only.

Before a collection, cartolex works out the summary of the planned work: the hosts, why, the kinds of data, the number of requests and, beyond a service’s free allowance, the estimated cost. On the command line it prints it (--dry-run on cartolex collect resolve, harvest, snapshot, institutions, collaborators and coverage --retry; in Python, cartolex.collect.privacy.plan_collection). In the app, the Collect dialog shows it at one of three levels, chosen and enforced by the app’s server:

• No notice when nothing personal is sent (an institution searched or read by its name or identifier) and the work fits OpenAlex’s free daily budget: the collection starts at once, and its message says which services it asks and about how many requests.

• The full notice the first time people’s names or identifiers are sent for a kind of collection (finding identities, harvesting texts, collaborators, a retry), whenever what is sent changes (another service, other kinds of data, a new version of the notice), and whenever the work goes beyond OpenAlex’s free daily budget. The collection starts only once you have confirmed you read it; « Don’t show this again » makes the next ones brief.

• A brief notice for a kind you acknowledged that way: one sentence and a confirmation, the full notice one click away under « Details ».

The acknowledgements are kept on this computer, in the app’s own folder (per person on a hosted service), never in a project. Settings › Privacy lists them and shows every notice in full again.

OpenAlex gives a free daily budget, larger with a free API key. Within it the notice shows no sum. Beyond it, it says what it takes: a free key, or the number of days without one; with a key, the number of days. Above about 10 euros at OpenAlex’s prices, it suggests reading the OpenAlex snapshot on your computer instead, which sends nothing to OpenAlex and costs nothing.

The people of an institution and the collaborators found are people too: what the harvest then sends for them is what it sends for anyone. After a collection, the job’s record in logs/jobs/ names every host contacted and the kinds of data sent, never a name or an identifier.

Files you give an AI assistant yourself. The AI copilot makes a file you give, if you choose, to an assistant you already use; cartolex sends nothing. It says what it holds before you download it. The copilot’s bundle holds the keywords or the theme tree, the keywords’ vectors and each person’s usage as numbered rows in a random order: never a name, an identifier, an organisation or a text; a keyword that holds a person’s name is left out. Only when you ask for them does a keyword bundle add a few lines of text around each candidate, with every name, address and identifier masked (see The AI copilot).

What never leaves your computer

• your texts, titles and abstracts, imported or collected;

• your decisions: roles, identities, merges, keywords, themes;

• the columns of your list other than the names, identifiers and institution names that are searched;

• e-mail addresses: an e-mail column is refused at import and never stored.

What is kept, and where

Everything stays in the project folder:

where	what
sources/tables/	people, organisations, affiliations, texts, their parts, authorships
sources/<slot>/raw/	the imported list (without e-mail addresses), the documents’ text, the service records as received, and the id registry; the tables are rebuilt from them
cache/http/	the services’ answers, each with its lifetime (a person search a few days, a work by DOI three months)
cache/sources/	digests of the harvests’ records, to rebuild the tables quickly; deleting them costs one full reading
decisions/	what people decided, with every earlier version in decisions/history/
logs/jobs/	what each job did: counts, times, hosts and kinds of data

Outside projects, the app’s own folder on your computer keeps its settings of this computer: your keys, the snapshot folder, the notices you acknowledged; never a name, an identifier or a text. Nothing is kept anywhere else: cartolex has no server and sends no usage data.

What a shared site holds

An offline site (the Share screen, outputs/sites/<date>/) is what leaves the project when you send it. Before each build the Share screen says what it will hold and checks it:

• People’s names: a site that shows people asks at each build whether it shows their names or pseudonyms (« Person 12 »); nothing is chosen for you. With pseudonyms, the names are not in the site’s files at all, and people are listed in a shuffled order. Organisations are always named. People placed on the finished map (for example applicants) have their own question and stay pseudonymous unless you choose to name them.

• Texts: none by default, only keywords, themes and places on the map. On request the titles, or the titles and abstracts. Never a full text (a body or full part), never an identifier (ORCID, a service’s id, a project id), never the extra columns of the people’s lists.

• Figures of the map never name people.

Each build is kept in its own folder and never replaced; a build made before a later change of the project is marked stale.

Deleting

• The services’ answers: delete cache/http/. The next collection fetches again.

• Everything collected: delete sources/<slot>/raw/ for the slot, the tables in sources/tables/ and cache/sources/; the project keeps its decisions.

• The whole project: on the start screen (« All projects… » in the project menu), « Remove… » beside it, then « Delete the project’s folder »: a last question names the folder and its size, and everything cartolex wrote in it is deleted for good (not moved to the trash). What cartolex did not write stays, with the folder; a link inside the project is removed, never what it points to. A project open in another application, or busy with a job, is not deleted. « Remove from the list » only takes it out of the list. Copies you made outside the folder (backups, sites and files you sent) are yours to delete.

• Shared sites and files: the Share screen shows what each site build, its zip and each written file take on disk, and deletes them one at a time, or every build but the latest at once.

• One person: set their role to excluded so that nothing uses them. Erasing every trace of one person means removing them from the list you import, deleting the raw runs and the cache, and collecting again; cartolex 1.0 has no single command for it yet.

The legal frame

cartolex is a tool you run. Whoever decides to map a field with it — you, or the organisation you work for — decides why and how people’s data are used, and is responsible for it under the law that applies, such as the European Union’s General Data Protection Regulation (GDPR) or Brazil’s Lei Geral de Proteção de Dados (LGPD). In particular:

• Lawful basis. Choosing and documenting the lawful basis of the processing (for example a task in the public interest, or a legitimate interest weighed against the people’s interests) is yours. cartolex does not choose it.

• Public data, processed locally. cartolex reads bibliographic records that the services publish openly, and processes them on your computer.

• Data minimisation. Only what the mapping needs is sent and kept: names, identifiers and institution names for the searches; e-mail addresses are refused; logs hold no names.

• Transparency and rights. People mapped have rights (to be informed, to access, to rectify, to object, to erasure). Everything cartolex holds about a person is in readable files of the project folder, so you can answer them.

• Retention. Data are kept as long as the project folder is; deleting it deletes them.

• The services. OpenAlex and ORCID receive the requests listed above and apply their own terms and privacy policies, possibly outside your country.