Is ResearchRabbit GDPR compliant? What universities should check
ResearchRabbit is a free literature discovery tool that maps how papers and authors connect. It is widely used by doctoral students and recommended by libraries, so it often reaches a DPO's desk. This page sets out what ResearchRabbit publicly documents about who runs it, where data is hosted, which AI providers it uses and what that means for a university.
Short answer
ResearchRabbit is operated by Litmap Limited (trading as Litmaps), a New Zealand company, but its privacy notice says its servers are in the United States. Transfers rely on the Standard Contractual Clauses, and the company is not on the Data Privacy Framework list. The privacy notice names OpenAI and Databricks as AI service providers, while a help article says AI models are not trained on users' articles or notes. We found no public DPA, subprocessor list or security certification. For literature mapping with published papers the personal data involved is limited; notes and shared collections are where care is needed.
Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers AI research assistance with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data
What ResearchRabbit documents publicly
All sources were read on 7 October 2026. "Not found publicly" means we did not find it in the sources listed at the end of this page; it does not mean the safeguard does not exist.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and establishment | Documented Litmap Limited, doing business as Litmaps, registered in New Zealand (Wellington). The privacy notice names a Data Protection Officer contact at the same address and says the company is "responsible for making decisions" about processing, which makes it the controller for user accounts. Not found publicly An EU representative under Article 27 GDPR. | [1] [2] |
| Where data is stored | Documented "Our servers are located in the United States." The terms add that the services "are hosted in the United States". The hosting provider is not named. | [1] [2] |
| Data processing agreement | Not found publicly No public DPA. The terms of service do not mention data processing for institutional customers. The pricing page offers an Institution plan through the sales team. | [2] [4] |
| Subprocessors and AI providers | Partly documented AI features are provided through third parties "including Databricks and OpenAI", and "your input, output, and personal information will be shared with and processed by" them. Other named recipients: Stripe (payments) and Google Analytics. Other categories: data analytics, finance and accounting tools. Not found publicly A complete subprocessor list. | [1] |
| International transfers | Partly documented The Standard Contractual Clauses are used for transfers between group companies and to third-party providers, and can be provided on request. Not found publicly Data Privacy Framework certification: no entry for Litmap, Litmaps or ResearchRabbit on the official list, active or inactive. | [1] [6] |
| AI model training | Help centre only "We don't train AI models using your articles or notes." A separate help article says large language models do not power the core recommendation algorithms, which use citation and authorship networks. Neither statement appears in the privacy notice or terms. | [3] [5] |
| Retention and deletion | Partly documented No purpose requires keeping personal information longer than the account exists. Data in backups is isolated "until deletion is possible". Users can delete their account in settings or by contacting the company; some information may be kept for fraud prevention or legal reasons. | [1] |
| Security certifications | Not found publicly SOC 2, ISO 27001 or a trust centre. The privacy notice refers to "appropriate and reasonable technical and organizational security measures". | [1] |
| Plans and institution controls | Plan-dependent Free (no charge), ResearchRabbit+ (paid, with more seed articles, projects and alerts) and Institution (managing thousands of users, usage statistics, LibKey integration, dedicated support). Not found publicly Single sign-on. | [4] |
| Age limit | 18. Persons under 18 "are not permitted to use or register for the Services". | [1] [2] |
ResearchRabbit deserves credit for naming its AI providers in the privacy notice, which many tools do not do, for a plain-language help article on how it uses data, for a recommendation engine that does not depend on generative AI, and for a free tier that keeps the core tool available to researchers without a budget.
What this means for a university
Validemic's analysis
What personal data is involved. ResearchRabbit works on bibliographic metadata from Crossref, Semantic Scholar and OpenAlex [7]. Users bring in seed papers, build collections, write notes and may link a Zotero library [8]. Published metadata about papers and authors is low risk for the user's institution. The account, search behaviour and especially notes are personal data, and notes can contain anything: comments on unpublished work, names of colleagues or reflections that touch on participants. The privacy notice states that ResearchRabbit does "not process sensitive personal information" [1], so staff should not put special category data into notes.
Sharing is the main practical risk. Collections can be shared by public link, and anyone a collection is shared with can view its notes [9]. Guidance for researchers should say that shared collections are for literature, not for working notes about people.
Which features use OpenAI is unclear. The privacy notice says inputs, outputs and personal information are shared with Databricks and OpenAI for its AI features, while the help centre says the core recommendations do not use large language models. Both can be true, but a DPO needs to know which features send what data, to which provider, under what retention terms. That is the first question to ask.
The training pledge is not yet contractual. The no-training statement in the help centre is clear and welcome. It is not repeated in the privacy notice or terms, and the terms contain a broad, perpetual licence over "Contributions" posted to the services, which appears to be standard template wording for user-generated content [2]. An institutional agreement should state that notes and collections are not used for training and clarify what the Contributions licence covers.
New Zealand company, US hosting. New Zealand has an EU adequacy decision [10], but the privacy notice says data is hosted in the United States, so the transfer to the US is what needs a safeguard. Without DPF certification, that rests on the Standard Contractual Clauses. For an institutional licence, the university will normally want ResearchRabbit to act as processor under Article 28 GDPR, with a DPA, a subprocessor list and a transfer impact assessment [11].
Students and age. The minimum age of 18 matters for any programme that admits younger students, and for outreach or school partnerships. Recommending the free tier to all students also means each student accepts the consumer terms individually, under New Zealand law.
DPIA likelihood. Literature mapping alone will usually need only a screening. Our DPIA screening tool gives a first view; a fuller assessment becomes more likely if notes will hold research data or if the tool is rolled out institution-wide.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask ResearchRabbit before approving it
- Will you sign a data processing agreement under Article 28 GDPR, including the Standard Contractual Clauses, for an Institution plan?
- Which features send data to OpenAI or Databricks, what data is sent, and what retention and no-training terms apply to those providers?
- Can the commitment not to train AI on articles or notes be written into our contract or your privacy notice?
- Does the Contributions licence in the terms apply to private notes and collections, or only to public content?
- Who hosts the service, in which US regions, and is EU hosting possible?
- Can you provide a complete subprocessor list and notify us of changes?
- Do you hold an independent security attestation, or can you complete a HECVAT or similar questionnaire?
- Can an institution disable public collection links for its users, and is single sign-on available?
- How quickly are deleted accounts removed from backups?
The EU AI Act angle
Recommending related papers from a citation network is not one of the high-risk education uses in Annex III, point 3 of the AI Act, Regulation (EU) 2024/1689 [12]. Those cover AI used to decide admission or access, to evaluate learning outcomes, to assess the level of education a person will receive, or to monitor students during tests.
A university that uses an AI system under its authority is a deployer (Article 3(4)). Article 4 on AI literacy has applied since 2 February 2025. Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since 27 July 2026, amended it so that deployers must take measures to support the AI literacy of their staff and others using AI on their behalf [13]. For a discovery tool, that mainly means helping researchers understand that recommendations depend on citation patterns and database coverage, so a ResearchRabbit search does not replace a systematic search of bibliographic databases. The same regulation moved the application date for Annex III high-risk obligations to 2 December 2027 [13].
Sources
- ResearchRabbit, Privacy Notice (Litmap Limited, last updated 7 November 2025), retrieved 7 October 2026
- ResearchRabbit, Terms of Service (last updated 7 November 2025), retrieved 7 October 2026
- ResearchRabbit Help, "How ResearchRabbit uses your Data", retrieved 7 October 2026
- ResearchRabbit, Pricing, retrieved 7 October 2026
- ResearchRabbit Help, "How ResearchRabbit uses AI", retrieved 7 October 2026
- Data Privacy Framework List (searched for "Litmap", "Litmaps" and "ResearchRabbit", active and inactive participants), retrieved 7 October 2026
- ResearchRabbit Help, "The ResearchRabbit Database", retrieved 7 October 2026
- ResearchRabbit Help, "Using the Zotero Importer", retrieved 7 October 2026
- ResearchRabbit Help, "How to share papers and collections", retrieved 7 October 2026
- European Commission, Adequacy decisions, retrieved 7 October 2026
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 27, 28 and 46, retrieved 7 October 2026
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3(4), 4 and Annex III, Official Journal text read via the Publications Office, retrieved 7 October 2026
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text read via the Publications Office, retrieved 7 October 2026
About this page
We read ResearchRabbit's privacy notice, terms of service, pricing page and help centre, looked for security and subprocessor pages, and searched the official Data Privacy Framework list, all on 7 October 2026. "Not found" means we could not find the information in public documentation; it does not mean ResearchRabbit lacks it, and some of it may be available to institutional customers on request. Plans, terms and features change, so confirm the current position with ResearchRabbit before relying on it.
This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work at ResearchRabbit or Litmaps and see an error, please contact us and we will correct it.
Frequently asked questions
Who runs ResearchRabbit?
ResearchRabbit's terms of service and privacy notice (both last updated 7 November 2025) name Litmap Limited, doing business as Litmaps, a company registered in New Zealand with an address in Wellington. The privacy notice says Litmap Limited decides how personal information is processed.
Where does ResearchRabbit store data?
The privacy notice says its servers are located in the United States, and the terms say the services are hosted there. Transfers from the EEA and UK rely on the European Commission's Standard Contractual Clauses, which ResearchRabbit says it can provide on request.
Does ResearchRabbit use OpenAI?
Yes, according to the privacy notice: it provides its AI features through third-party providers "including Databricks and OpenAI", and input, output and personal information are shared with them. A help article says large language models do not power the core recommendation algorithms. Which features send data to OpenAI is not specified publicly.
Does ResearchRabbit train AI on my notes?
Its help article on data responsibility says it does not train AI models using your articles or notes and does not sell or expose them to third parties. We did not find the same commitment in the formal privacy notice or terms (checked 7 October 2026).
Can students under 18 use ResearchRabbit?
No. Both the terms and the privacy notice say the service is intended for users aged at least 18, and the privacy notice says accounts of younger users will be deactivated.