Privacy Policy

Last updated: 18 July 2026 · covers Solas Chrome extension v1.11.0 and Solas Marker

This Privacy Policy explains how Solas (“we”, “us”, “our”) handles your information when you use the Solas Chrome extension (the “Extension”) and the website at solastool.com (the “Site”). It applies to everyone who uses Solas, regardless of where you live.

We collect only what we genuinely need to make Solas work, and we tell you exactly what that is in plain English.

1. Who we are

Solas is operated by an independent developer based in the United Kingdom. You can reach us at support@solastool.com for any privacy-related question or request.

For the purposes of UK GDPR and EU GDPR, Solas is the data controller for personal data processed through the Site and the free Extension.

If you are using a build of the Extension that was linked to your university (Solas for Institutions), your institution is the Data Controller for the anonymous module-level event data collected on its behalf. Solas acts as a Data Processor under a signed Data Processing Agreement. See §11 below.

2. What we collect, and why

Solas is designed local-first. The default behaviour collects nothing about you on our servers. The categories below describe data that may leave your browser when you use specific features.

2.1 Citation metadata (when you click “Cite this page”)

When you ask Solas to cite a page, the Extension reads a deliberately minimal slice of the page so it can build an accurate reference. Specifically:

• <meta> tags (Open Graph, Dublin Core, Schema.org, citation_*)
• The page’s <title>, <h1>, and visible byline text
• JSON-LD structured-data blocks
• The page’s URL and host
• Publication date where present

If our local parsers can build the citation from the structured fields above, nothing leaves your browser. If the local parsers can’t (or return suspicious values), Solas falls back to AI extraction (see §2.3).

Solas does not read form fields, cookies, browser history, login state, or anything else on the page beyond what is described above. We do not screenshot or record your screen.

Lawful basis (UK/EU GDPR): performance of a contract / legitimate interest in providing the citation service.

2.2 Saved citations and quotes (when you click “Save”)

When you save a citation to your Library, the resulting reference text, the source URL, and the page metadata used to build it are stored in your browser’s Chrome local storage. This data stays on your machine. Solas has no cloud-sync layer for the student build — we never see your saved sources.

Highlighted passages saved through the “Save quote” shortcut are likewise stored locally alongside their parent citation.

Solas Library on the web (the “My Library” tab at /research/app/) is also local-first: your saved sources live in your browser’s own site storage (IndexedDB) for solastool.com and stay on your machine. There is no account and no cloud sync. Data leaves your device on only four occasions, each one an explicit action: (1) when a source is checked (on saving one you added by hand, on editing its details, or when you click Re-check), Solas sends just that one source’s bibliographic fields to the verification service to confirm it exists — never your whole library; (2) when you use “Use my Library” / “Check this project” in the reading-list check, your reference list for that project is sent to Solas Research to analyse; (3) when you open “Why this paper?” on a result, Solas sends the public registry ids of the results in that group — ids the server itself just returned to you — together with the title of the paper you pasted, so it can fetch those papers’ published abstracts and have our AI helper judge how each relates to yours. They go in one request rather than one per card because the judgement is more reliable when the papers are weighed side by side, and it is a single request instead of a dozen. No text of your own is sent, and the sentence you see is written by Solas, not by the model; and (4) when you choose to Export your library to a file. Nothing else — and no identifier for you — is transmitted.

Lawful basis: not applicable for storage — saved sources never reach Solas’s systems. For the verification and reading-list checks above, the lawful basis is your explicit request (the processing described in §2.3 applies).

2.3 AI extraction data (when fallback is needed)

When the Extension can’t build a complete citation from local parsing alone, it sends a request to our processing server at solas-ai.thomasmulvany1.workers.dev. That request may include:

• The URL of the page being cited
• The page’s title and the metadata fields already extracted
• Up to 24KB of the page’s visible text (the readable body content, never form data or hidden fields)

The processing server forwards the request to OpenAI via API call. OpenAI returns the parsed citation fields, which are then returned to your browser. The request body is not stored by Solas after the response is returned. OpenAI’s API-tier data handling policy applies: per OpenAI’s contractual commitments, API data is not used to train OpenAI’s models and is retained for at most 30 days for abuse-monitoring purposes.

Lawful basis: performance of a contract / legitimate interest in producing accurate citations.

2.4 Citation Integrity verification data (v1.11.0+)

When you save a citation, the Extension also runs a Citation Integrity check to confirm the source actually exists. This sends the following to our processing server’s /verify-citation endpoint:

• The DOI of the source (if present)
• The source URL
• The source type (journal, book, web, etc.)
• The page title and author surnames
• The publication year

The processing server queries one or more academic registries to confirm the source exists:

• CrossRef — for academic articles with DOIs
• OpenAlex — for academic works by title
• Google Books — for books
• A direct HTTP HEAD request to the source URL — for web articles, news, and other web sources

The Extension stores the verdict (verified / unverifiable) locally alongside the citation. The verification request itself is not logged on our server.

Lawful basis: legitimate interest in academic integrity.

2.5 The Audit tab (paste a paragraph)

When you paste a paragraph into the Audit tab, the Extension detects in-text citations and matches them against your local Library. The pasted text never leaves your browser. All detection, matching, and rendering happens locally.

Lawful basis: not applicable — no data leaves your machine.

2.6 Diagnostic data (when you submit feedback)

If you click “Feedback & feature requests” and submit a message, the form is hosted on the Site via Netlify Forms. We receive:

• The category you selected (bug, feature, general)
• The message you wrote
• The URL of the page you had open at the time (only if you explicitly include it)
• The Solas Extension version
• Your email address (only if you provide it)

Lawful basis: legitimate interest in improving the service.

2.7 Demo request data (institutions only)

If your institution submits a demo request through the form at solastool.com/institutions, we receive the email address provided. We use it only to reply to the demo request. We do not add it to any marketing list.

Lawful basis: legitimate interest in business communication.

3. What we don’t collect

To be unambiguous, Solas does not collect:

• The text of pages you visit, except as described in §2.3
• Your browsing history beyond the single tab you actively choose to cite
• Cookies or local-storage values from third-party websites
• Form inputs, passwords, or login state on any site
• Your IP address (beyond what is automatically processed at the network layer by our infrastructure providers for routing — never persisted by Solas)
• Data from sites you have not actively chosen to cite
• The full text of your essay or draft — Solas never uploads the whole document (the web Audit tool’s source-alignment check sends only the sentence around each cited claim to our verification service, never the entire essay or your name)
• Anything for advertising or marketing-profile purposes

The Extension and the Site contain zero advertising trackers, analytics scripts, or marketing pixels.

4. Who we share data with (sub-processors)

We use a small number of trusted infrastructure providers to operate Solas. They act as our data processors and are contractually bound to handle data according to UK/EU data-protection law.

When Solas queries CrossRef, OpenAlex, Google Books, the DOI Foundation (doi.org), Unpaywall, or Companies House, the request is made server-side from Solas infrastructure. Your identity, IP, and any account info are not disclosed to those APIs. The query payload contains only the citation metadata necessary to perform the lookup (typically a DOI, title, or ISBN) — or, for reading suggestions, a short topic phrase of a few keywords.

We never sell your data. We never share it with advertisers or data brokers. We will only disclose data if compelled by valid legal process, and we will notify you if we are legally allowed to.

5. Where your data is stored

For users of the free Extension: your saved citations live on your own machine, in Chrome’s local storage. We have no copy.

For users of Solas for Institutions: anonymous module-level event data is stored on Cloudflare D1 in the UK/EU (Western Europe) region. Backups are encrypted at rest and never replicated to a non-UK/non-EU region. See the Solas for Institutions privacy whitepaper for the full detail.

For the Site: page-level data (e.g. the contact form submissions) is held by Netlify in their EU edge region. We retrieve these submissions to respond to you and do not retain them beyond reply.

If you are outside the UK/EU, your request payload may transit through the UK or US (the region of our AI providers, OpenAI and Anthropic) for processing. We rely on the UK ICO’s adequacy regulations or the EU Standard Contractual Clauses for any cross-border transfer.

6. How long we keep your data

• Saved citations (free build): for as long as you keep them. You can delete individual citations, whole folders, or your entire local Library at any time from the Library tab. We have no server-side copy to delete.
• Citation extraction requests (AI fallback): not stored by Solas. OpenAI retains the request body for at most 30 days for abuse-monitoring, then deletes it.
• Verification requests (v1.11.0+): not stored. The verdict is returned to your browser and then discarded server-side.
• Feedback messages: kept for 24 months to inform product improvement, then deleted.
• Demo requests (institutions): kept until the conversation concludes, plus 12 months for follow-up. Deleted on request.
• Institutional event data: covered separately by the institutional privacy whitepaper.

7. Your rights

Under UK GDPR, EU GDPR, and similar regimes, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (“right to be forgotten”)
• Restrict or object to our processing
• Port your data to another service
• Withdraw consent at any time

To exercise any of these, email support@solastool.com. We aim to respond within 14 days and to fulfil valid requests within 30 days.

For users of the free Extension, the answer to most subject-access requests is straightforward: we hold no personal data about you on our servers. Your saved citations are entirely on your own device.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.

8. Security

Solas uses industry-standard security practices:

• All traffic between your browser and our processing server is encrypted using TLS 1.2+
• Our processing server requires a shared API key in addition to the Chrome-extension origin header for every request — arbitrary external callers receive a 401 or 403
• Per-IP daily rate limits enforced via Cloudflare KV protect against abuse
• Our OpenAI API key never leaves our Cloudflare infrastructure; the Extension never has access to it
• Worker code is open to security review on request under NDA
• The Extension’s source code is shipped as plain JavaScript on Chrome Web Store, inspectable by any reviewer

No system is perfectly secure. If we discover a breach affecting your data, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR.

9. Cookies and similar technologies

The Site (solastool.com) uses only essential cookies required for the page to function. We do not use tracking cookies, analytics cookies, or advertising cookies.

The Extension uses Chrome’s local-storage and session-storage APIs to hold your saved citations, project folders, theme preference, and so on. This data never leaves your browser unless you take an action that explicitly transmits it (e.g. clicking Cite).

10. Children’s privacy

Solas is intended for higher-education students and academic researchers. The Extension is rated suitable for users aged 13 and over on the Chrome Web Store, but our typical user is 18+. We do not knowingly collect data from anyone under 13. If you believe a child has shared data with us, please email us and we will delete it.

11. Solas for Institutions

Solas for Institutions is a separate licensed offering for universities. Under that arrangement, the institution is the Data Controller for module-level event data; Solas is the Data Processor under a signed Data Processing Agreement.

The institutional product is architected so that no student identifier is ever collected. Events arrive with a module code and a verdict type only. The complete details — threat model, retention, audit rights, breach notification — are documented in the Solas for Institutions Privacy Whitepaper.

If your university has not subscribed to Solas for Institutions, none of the institutional-event collection applies to you. You are using the free Extension as described in §§1–10.

12. Solas Marker (formative essay feedback)

Solas Marker gives a student a formative second opinion on a draft before they submit — an indicative mark range (never a single number, never an official grade), examiner-style feedback tied to the student’s own words, and a referencing check. This section describes how it handles data; it applies only if you use Marker.

Stateless by design. Your essay is sent to our server once, marked in memory, and never written to disk or database on our side. The result is streamed back to your browser, where it lives only until you clear your local history. We keep no server-side copy of the essay or the result.

What is processed, and by whom:

• Anthropic, PBC receives the essay text, your rubric, the essay question, and any optional context fields you fill in (such as level, module, discipline, referencing style, lecturer guidance and required readings) to produce the marking. Solas attaches no name, email, or student identifier to the request — but anything you type into the essay itself (for example a name on a cover page) is sent as part of that text, so please leave personal details out of the draft you submit. Anthropic’s training and retention terms for this processing are [to be confirmed against Anthropic’s commercial agreement and stated here before launch]. If you request reading suggestions, Anthropic additionally receives a second, smaller request: the structured feedback being addressed — including the short quoted sentences from your essay that appear in that feedback — your essay question and module details again, and the titles and abstracts of candidate papers retrieved from the public registries. Never the essay itself a second time.
• Reference-checking registries — CrossRef, OpenAlex, Google Books, and the DOI Foundation (doi.org) — receive only reference metadata (a title, author, year, DOI, or ISBN) to confirm a cited source exists; and, if you ask Marker to suggest readings, OpenAlex also receives short search phrases describing the topics your question, module details and feedback identified — a few keywords, which for an unverifiable reference-list entry can include a few title words from that entry — never sentences from your essay. They never receive your essay prose. These requests are made server-side; your identity and IP are not disclosed to them.
• OpenAI is not used by Solas Marker. The OpenAI processing described in §4 applies to other Solas tools (Check, the Audit portal, and the Extension), never to Marker.

Retention. Solas stores nothing from a Marker run. Registry lookups are not retained by Solas. To enforce fair-use limits, a random per-browser token your browser generates is held in memory only (never written to disk) for up to 24 hours to count requests; it carries no personal data and is not linked to your identity. Anthropic’s retention of the marking request is governed by the terms referenced above.

Suggested readings. Results saved in your browser include any suggested readings and the reasons given.

What Marker never does. It never issues an official grade or a single number, never rewrites your essay or produces submittable text, and never attempts to detect whether writing is AI-produced. Marker is formative feedback, not an assessment decision and not an integrity check. A fuller, plain-English account is on the how-it-marks and for-staff pages.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest revision. If we make material changes (a new sub-processor, expanded data collection, or a change to the AI processing path), we will surface the change in the Extension and on the Site before it takes effect.

The current version is always available at solastool.com/privacy.

14. Contact us

For privacy questions, data requests, or anything else:

Email: support@solastool.com
For institutional / procurement enquiries: institutions@solastool.com
Postal: Harrow Rd, Knockholt, Sevenoaks TN14 7JS, United Kingdom

This Privacy Policy is written in good faith and intended to be readable. If anything is unclear, please email us — we’d rather rewrite a paragraph than have you leave confused.