Is Connected Papers GDPR compliant? What universities should check
Connected Papers builds visual graphs of related papers from a single starting article, and it is a common first stop for students starting a literature review. This page sets out what Connected Papers publicly documents about the data it collects, storage, contracts and transfers, and what that means for a university.
Short answer
Connected Papers is a small, focused service that collects little personal data: an account, saved papers, search queries and analytics. Its privacy policy says data is stored in Microsoft Azure and lists the GDPR rights users have, and its terms are governed by Israeli law. A named legal entity, a data processing agreement, a subprocessor list, an Azure region and a transfer mechanism were not found in its public documentation. The tool works on published bibliographic data and we found no generative AI features. For individual use the privacy footprint is small; for an institutional purchase a university should ask for the missing contract documents.
Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers AI research assistance with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data
What Connected Papers documents publicly
Everything in this table comes from Connected Papers' own pages or the European Commission, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and establishment | The pricing FAQ describes the team as "a group of 4 friends" who started the tool as a weekend project. The terms (last updated 21 February 2023) are governed by the laws of the State of Israel. Not found publicly The legal entity, its address and an EU representative (checked 7 October 2026). | [1] [2] |
| Data collected | Mailing list email; username, email and password for accounts; saved papers; search queries and other text typed into the site; settings such as dark mode; clicks and page views through third-party analytics. The terms add log-in dates, page views and opened links, and name Google Analytics. | [1] [3] |
| Where data is stored | Provider named "We store your data securely in Microsoft Azure." Not found publicly The Azure region. | [3] |
| Data processing agreement | Not found publicly A DPA or processor terms for institutions or group plans (checked 7 October 2026). | [1] [3] |
| Subprocessors | Categories only The privacy policy says third-party vendors help with "authentication, email communications, business analytics, data storage, and data processing". Named in public documents: Microsoft Azure, Google Analytics and PayPro Global (payments, which hosts the checkout page). A full list was not found. | [1] [2] [3] |
| International transfers | Not found publicly A transfer mechanism. The European Commission lists Israel among countries with an adequacy decision. Where Azure data is held, and whether it leaves the EU, is not stated. | [3] [4] |
| AI and data sources | Graphs use a similarity metric based on co-citation and bibliographic coupling, built on the Semantic Scholar paper corpus (licensed under ODC-BY). No generative AI or chatbot features were described in the public pages we read. | [1] [5] |
| Rights and retention | The privacy policy lists the GDPR rights of access, rectification, erasure, restriction, objection and portability, with requests to hello@connectedpapers.com. It says no marketing messages are sent and details are not shared with third parties for marketing. A retention period was not found. | [3] |
| Security certifications | Not found publicly SOC 2, ISO 27001 or a security page (checked 7 October 2026). Card details are handled by PayPro Global, and Connected Papers says it does not store card information. | [2] |
| Plans and institution controls | Plan-dependent Free (five graphs a month), Academic and Business individual plans, and group plans in which administrators assign premium seats to members. Academic plans are limited to academic, non-profit and personal use. SSO and other admin controls were not described publicly. | [1] [2] |
Connected Papers deserves credit for collecting very little personal data, a plain statement that it sends no marketing messages and does not share details with third parties for marketing, a clearly explained similarity method rather than an opaque model, and a scholarship programme for researchers who cannot afford a subscription [1].
What this means for a university
Validemic's analysisA small privacy footprint. The graphs are built from published bibliographic metadata. The personal data at stake is a user's account, saved papers and search queries. That is ordinary data, but search history can reveal unpublished research directions or a commercial interest, which some research groups treat as confidential.
Individual versus institutional use. For a student or researcher using the free plan with a personal account, Connected Papers acts on its own behalf and the privacy policy is the relevant document. When a university buys a group plan, assigns seats and creates accounts with institutional emails, it will normally want a written agreement covering roles under Article 28 GDPR [6], subprocessors and transfers. None of that is public, so it has to be requested.
Transfers and the missing pieces. Israel benefits from an EU adequacy decision [4], which may help if the operator is established there. But the public documents name neither the legal entity nor the Azure region, and analytics data goes to Google. A university should get these facts in writing before relying on adequacy. Our transfer mechanism tool can help structure the questions.
Dated documents. The terms and the privacy policy both show a last-updated date of 21 February 2023. Short, older policies are common for small teams and do not mean data is mishandled, but they make it harder for a DPO to document a decision.
DPIA likelihood. Given the limited data and the absence of special category data in normal use, a full DPIA is unlikely to be needed for this tool alone. A brief screening record is still good practice; our DPIA screening tool gives a first view.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Connected Papers before approving it
- Which legal entity operates Connected Papers, where is it established, and does it have an EU representative?
- In which Azure region are accounts, saved papers and search history stored?
- Can you sign a data processing agreement for our group plan, and which transfer mechanism would it use?
- Which third parties handle authentication, email and analytics, and where are they located?
- How long are search queries and usage logs kept, and are they deleted when an account is closed?
- Can analytics be limited for users on our group plan?
- Do you support institutional single sign-on for group plans?
The EU AI Act angle
A similarity graph based on citation overlap is a long way from the uses the AI Act regulates most strictly, and it is not among the education uses listed as high-risk in Annex III of Regulation (EU) 2024/1689 [7]. Whether such a tool even meets the Act's definition of an AI system is debatable, and the answer changes little in practice for a university. The AI literacy measure in Article 4, as amended by Regulation (EU) 2026/1744 [8], is still a useful frame: students should know that a graph shows papers that cite similar work, not papers that are necessarily relevant or reliable, and that it covers only what the Semantic Scholar corpus contains.
Sources
- Connected Papers Pricing and FAQ, retrieved 7 October 2026
- Connected Papers Terms of Service, last updated 21 February 2023, retrieved 7 October 2026
- Connected Papers Privacy Policy, last updated 21 February 2023, retrieved 7 October 2026
- Adequacy decisions, European Commission, retrieved 7 October 2026
- About Connected Papers, retrieved 7 October 2026
- Regulation (EU) 2016/679 (General Data Protection Regulation), Article 28, retrieved 7 October 2026
- AI Act Annex III: High-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 4: AI literacy (as amended), AI Act Service Desk, retrieved 7 October 2026
About this page
We read Connected Papers' privacy policy, terms, cookie policy, pricing FAQ and about page on 7 October 2026, together with the European Commission's adequacy page. Its terms point to Israeli law rather than a US establishment, and a search of the official Data Privacy Framework list for "Connected Papers" returned no result. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it. Confirm the current position with Connected Papers before relying on this page.
This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Connected Papers and see an error, please contact us and we will correct it.
Frequently asked questions
Is Connected Papers GDPR compliant?
No tool is GDPR compliant on its own. Connected Papers collects little personal data, says it stores data in Microsoft Azure and lists GDPR rights in its privacy policy. A data processing agreement, a subprocessor list and a transfer mechanism were not found in public documentation (checked 7 October 2026), so a university licensing it should ask for them.
What data does Connected Papers collect?
According to its privacy policy: email address for the mailing list, username, email and password for accounts, saved papers, search queries typed into the site, and clicks and page views collected with third-party analytics tools. Its terms name Google Analytics and also list log-in dates and opened links as usage data.
Where does Connected Papers store data?
The privacy policy says data is stored securely in Microsoft Azure. The Azure region was not stated in public documentation (checked 7 October 2026).
Does Connected Papers use generative AI?
Its about page says graphs are built from a similarity measure based on co-citation and bibliographic coupling, using the Semantic Scholar paper corpus. We did not find generative AI or chatbot features described in its public pages on 7 October 2026.
Which country's law applies to Connected Papers?
The terms of service, last updated 21 February 2023, say they are governed by the laws of the State of Israel. The European Commission recognises Israel as providing adequate protection, but the public documents do not say which legal entity runs the service or where in Azure the data is held.