Locus Privacy Policy

Effective date: October 12, 2026

1. Platform and Personal Information Handler

Welcome to Locus.

Locus (the “Platform” or “we”) is an online intelligent assistance service for researchers, students and prospective doctoral applicants. It provides academic background analysis, research direction exploration, doctoral opportunity searches and application assistance tools.

Official website: https://app.locusairesearch.com/.

Locus is operated by an individual. Operator: Hou Fangyu; country/region of operation: China; correspondence address: Fengxiang East Street, Yangsong Town, Huairou District, Beijing, China (北京市怀柔区杨宋镇凤翔东大街). In this Policy, “we” refers to that operator and “you” refers to a user of Locus.

Privacy, customer support and security contact: alexneely936@gmail.com

This Policy explains the processing of personal information associated with the Locus website, accounts, academic background analysis, research direction generation and opportunity exploration. Reading this Policy does not replace consent, separate consent or other authorization required by law.

We respect and protect your personal information rights under applicable law. This Policy does not exclude or restrict data protection rights that cannot lawfully be excluded.

2. Information We Process

2.1 Accounts and Authentication

Email addresses, usernames, password hashes used for authentication, email-code verification records, and authentication and sending-rate records for registration, login and account recovery. Usernames for new email registrations normally derive from the portion before @, with system rules distinguishing collisions. We do not ask you to send plaintext passwords or verification codes to customer support.

The current code verifies passwords using hashes rather than reversible password encryption. Compatibility handling for existing accounts depends on the actual system. Phone authentication has not been publicly enabled and is not described here as a currently available authentication method.

2.2 Research Materials and Feature Data

We process the academic background, education, grades and research interests you provide, together with submitted queries, selected regions or schools, AI analysis and search results, favorites, saved results and usage-limit records. The information involved depends on the features you use.

Uploaded resumes are used to extract information and generate structured profiles. Locus does not retain original uploaded resume files as persistent materials; it retains structured results. Original files and extracted text must still be processed temporarily during parsing and AI requests. Not retaining the original file does not mean that resume content is never processed or transmitted to the AI interfaces required to provide the service.

Remove identification numbers, financial accounts, health information and other sensitive details unrelated to academic matching where possible, and avoid uploading others' materials without authorization. Processing information requiring special protection must be preceded by necessary disclosures and appropriate authorization.

Independent search-history archiving is currently disabled, but existing saved results and favorites may still store information. Disabling that feature does not mean that no search results are saved.

2.3 Payments and Communications

Order numbers, associated accounts, plans and access periods, amounts, currencies, payment status, channel transaction identifiers and necessary billing verification information. Support communications include your email, problem description and attachments. Do not email full card numbers, CVVs or passwords.

Card input in the proposed Waffo-hosted checkout is handled by the payment provider. Locus is not designed to collect or retain full card numbers or CVVs. Payment providers process necessary information through the channels actually enabled. This Policy is not a claim of Locus PCI-DSS certification.

2.4 Logs and Local Storage

To provide the service, restrict abuse and diagnose faults, servers may process IP addresses, request paths, request times, HTTP status, errors and performance information. Some authentication rate-limiting records store email or IP digests. Digests may still be associated with accounts and are not the same as anonymous information.

Login uses session cookies. Browser local storage may hold form drafts and interface state; drafts may contain research materials you enter. Clear browser data as appropriate on shared devices.

The current code inspection did not find common Google Analytics, Meta Pixel or Clarity integrations, but a complete review of dependencies and supplier tracking has not been performed. We therefore do not guarantee the absence of all tracking or claim that a cookie management center exists.

3. Purposes and Grounds for Processing

Necessary information is processed for account verification, requested AI analysis and searches, favorites and saved results, plan permissions and usage limits, payment reconciliation and support, security and legal obligations.

Grounds for processing must be determined according to the operator's location, users served and actual activities. They may include contractual necessity, legal obligations or valid consent; not all processing can be characterized as legitimate interests. Consent-based non-essential uses, sensitive information or cross-border activities require appropriate separate consent and a withdrawal mechanism where applicable.

This Policy does not authorize additional advertising, marketing or model training. Aggregated or de-identified analysis remains subject to applicable protections; data is described as anonymized only when individuals can no longer be identified.

4. Cookies, Browser Storage and Choices

Session cookies maintain authentication and core features. The current code sets HttpOnly and SameSite=Lax, with Secure configured for the production HTTPS environment. Browser storage holds drafts and interface state. You may clear or block these through browser settings, but doing so may prevent continued login or draft restoration.

If non-essential analytics or marketing tracking is added, this description must be updated, providers and purposes disclosed, and appropriate choices provided as required by law. This Policy does not claim that such disabled features already exist.

5. Service Providers and Data Flows

These deployment and official-interface arrangements reflect information confirmed by the operator. Resume or background information may become AI request context, so not all materials are processed solely on Locus servers. A third party's processing of information it receives is also subject to its relevant policies.

Where disclosure of specific recipients or separate consent is required, it must be completed before enablement or processing. Information may also be disclosed to competent authorities as required by law or shared for other purposes under valid authorization. This Policy does not authorize selling personal information.

6. Security Measures

Production services use HTTPS. Accounts use password hashing, session validation, permissions and user data isolation, and deployment restricts access to relevant databases, configuration and backups. These measures are not a guarantee of zero risk.

We do not claim unverified ISO 27001, SOC 2 or PCI-DSS certifications or an established fixed frequency of independent audits. In a security incident, remedial steps, user notices and reports will follow applicable law and actual risk. No universal 72-hour commitment is invented here.

7. Retention and Deletion

Information should be kept only as long as necessary for specified processing purposes; legally required records follow the relevant obligations. Membership expiration does not automatically close an account or delete data.

The monthly backup arrangement for resume-related data applies only to saved structured results, not original uploaded resume files. Backing up once per month does not mean that data is retained for only one month or that accounts, results, favorites or orders are automatically deleted monthly.

You may request deletion of structured materials or account closure through the contact email. Necessary transaction, security and legal-obligation records are handled for their respective purposes. Where deletion requests involve backups, mandatory retention or technical limitations, restrictions and subsequent arrangements should be explained and unnecessary use stopped.

8. Your Rights

Email alexneely936@gmail.com to request access, correction or deletion of personal information or account closure. Where applicable law provides for them, you may also request withdrawal of consent, restrictions on processing, refusal of non-essential uses or a portable copy. Necessary and proportionate identity verification will be carried out, with requests processed and outcomes explained within applicable legal deadlines.

Withdrawal of consent does not affect earlier lawful processing. Refusal to process data necessary for a core feature may affect that feature, but cannot be used to force consent to unrelated purposes. You may complain to a competent regulator as permitted by law. Requests may be submitted through the contact email.

9. Email Notices

Verification codes, account security and necessary service notices must be distinguished from marketing. This Policy does not authorize marketing emails, SMS or tracking advertisements. Future marketing requires appropriate authorization and an actual unsubscribe mechanism. Stopping marketing does not stop necessary account notices.

10. Cross-Border Processing

The Tencent Cloud service used by Locus is deployed in Hong Kong. Official Gemini, email and payment service providers may process information necessary to provide services in other countries or regions. Hong Kong deployment does not mean that all third-party processing occurs in Hong Kong.

Cross-region or cross-border processing requiring separate consent, assessments or other procedures must meet the applicable disclosure and legal requirements. This Policy is not evidence that a particular certification or cross-border procedure has already been completed. Personal information requests may be sent to the contact email above.

11. Minors and Third-Party Links

The service is available only to users aged 18 or older. If you identify an account below that threshold or minors' materials provided without appropriate authorization, contact the email address. Necessary action will be taken after verification in accordance with law.

Schools, job listings, payment checkouts and other external sites may have their own policies. We remain responsible for our own data activities; consult external policies for independent activities on those sites.

12. Updates and Contact

Important changes will be notified through website announcements or usable registered email addresses, with the version date updated. Renewed consent will be requested separately when legally required, rather than uniformly inferred from continued use.

Contact: alexneely936@gmail.com. The operator's name and correspondence address appear in Section 1. This Policy describes personal information processing arrangements and is not a certification of legal compliance.