Privacy Policy

Last updated: 8 September 2026.

This policy explains how TCC Tools ("we", "the site") collects, uses and protects information about its visitors. It is written to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018).

1. Your research data is processed locally

This is the most important point in this policy: every file you load (.xlsx, .csv spreadsheets, PDFs) and every statistical computation runs exclusively inside your own browser, through JavaScript executing on your device. No file, dataset, result or generated text is ever transmitted to, stored on, copied by or analysed on our servers. When you close or reload the tab, that data is gone completely. We have no technical means of accessing it at any point.

Consequently, your research data is not personal data that we process, and no data subject request is needed to have it erased — it never left your machine.

2. What we actually collect

• Anonymous usage data: pages visited, time on page, device type, browser, operating system, country and referrer.
• IP address: collected automatically by our hosting provider and by third parties, in anonymised or truncated form where applicable.
• Information you volunteer: your name and email address, if you choose to write to us through the contact form.
• Advertising identifiers and cookies: only after you consent, where consent is required.

We do not collect special categories of data (Article 9 GDPR), we do not create user accounts, and no registration is required to use any tool.

3. Legal bases for processing

• Legitimate interests — Article 6(1)(f) GDPR — for aggregate, anonymous analytics and for keeping the service secure and operational. Our interest is understanding which tools are used so we can maintain and improve them; the impact on you is minimal because the data is aggregated.
• Consent — Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive — for analytics and advertising cookies, and for personalised advertising. You may withdraw consent at any time through the cookie preferences banner or by clearing your browser cookies; withdrawal is as easy as giving consent.
• Performance of a request — Article 6(1)(b) — for replying to messages you send us.

4. Cookies and similar technologies

We use three categories:

• Strictly necessary: store only your choice in the consent banner (via localStorage). These require no consent and cannot be disabled.
• Analytics: measure audience in aggregate. Set only with your consent.
• Advertising: used by Google and its partners to serve ads. Set only with your consent.

Your reference list in the citation generator is also stored in localStorage on your device. It is never transmitted to us and you can clear it with the "Clear" button.

5. Google AdSense and advertising

This site uses Google AdSense to display advertising and fund its free operation. In that context:

• Google, as a third-party vendor, uses cookies to serve ads based on prior visits to this and other websites.
• Google and its partners may use advertising identifiers for personalisation, frequency capping and performance measurement.
• For visitors in the EEA, the UK and Switzerland, advertising and analytics cookies are set only after consent, collected through a consent management platform that implements Google Consent Mode v2 and the IAB Transparency and Consent Framework.
• You can opt out of personalised advertising in Google Ad Settings, or disable third-party cookies via youronlinechoices.eu (EU) or optout.aboutads.info (US).
• See also how Google uses data from sites that use its services.

6. Third-party processors

• Vercel Inc. (United States) — hosting and content delivery; access logs.
• Google Ireland Ltd / Google LLC — advertising delivery.
• Crossref (United States) — public bibliographic metadata. When you use the paper search or the citation generator, your search term or DOI is sent to the Crossref API to retrieve metadata.
• OpenAlex / OurResearch (Canada) — used only when you click "Find free PDF", to look up whether an open-access version of a DOI exists.
• Web3Forms — processes contact form submissions.
• Public CDNs (cdnjs, jsDelivr) — delivery of JavaScript libraries. Loading a resource necessarily discloses your IP address to the CDN operator.

Each of these services has its own privacy policy, which we recommend reviewing.

7. International data transfers

Our hosting and advertising providers process data in the United States and other countries outside the EEA. Where personal data of EEA or UK residents is transferred, those providers rely on the European Commission's Standard Contractual Clauses and, where applicable, on their certification under the EU–US Data Privacy Framework, as set out in their own documentation. Brazil, where the controller is established, has not received an EU adequacy decision; transfers to us therefore rely on the same safeguards or, for the contact form, on your explicit request.

8. Data sharing and sale

We do not sell, rent or trade personal data. For the purposes of the CCPA/CPRA, we note that the use of advertising cookies may constitute "sharing" of personal information for cross-context behavioural advertising. California residents may exercise their right to opt out through the cookie preferences banner or by enabling the Global Privacy Control signal in their browser, which we honour.

9. Retention

Technical logs are retained for our hosting provider's standard period. Contact form messages are kept only as long as needed to handle your enquiry, and no longer than 24 months. Consent records are kept for 12 months, after which the banner will ask again. Research data loaded into the tools is never retained, because it never leaves your device.

10. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you, and obtain a copy;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting the lawfulness of prior processing;
• not be subject to solely automated decisions with legal effects — we make none.

To exercise any of these, write to us through the contact page. We respond within one month, as required by Article 12(3) GDPR. We do not charge a fee and we will not discriminate against you for exercising your rights.

If you believe we have handled your data unlawfully, you may lodge a complaint with the data protection authority of your country of residence — in the UK, the Information Commissioner's Office; in Brazil, the ANPD.

11. Children

This site is intended for undergraduate and postgraduate students and researchers. We do not knowingly collect data from children under 16 (or under 13, where local law sets that threshold). If you believe a child has provided us with personal data, contact us and we will delete it.

12. Security

The site is served exclusively over HTTPS. Because there is no user database and no file upload to any server, the attack surface is substantially reduced by design. No system is perfectly secure, but the data we could lose in a breach amounts to server logs.

13. Changes

We may update this policy. Material changes will be signalled by the update date at the top of this page, and where required by law we will seek fresh consent.

14. Contact

Questions about privacy or requests to exercise your rights: contact page.