Widget & Embed Data Processing

This page describes exactly what the ResearchBunny widget does when it runs on a publisher's website. It is written for the people who have to sign off on embedding us — data protection officers, IT security reviewers, and the researchers and publishers responsible for their own privacy notices.

If you are looking for how ResearchBunny handles data on researchbunny.com itself, see the Privacy Policy.

1. Roles

When you embed the widget on your site, you are the controller for the personal data processed on your pages, and ResearchBunny acts as a processor on your behalf for the widget's analytics and content requests. We determine the means of processing (how the widget works), you determine the purpose (that it runs on your article pages at all).

2. What the widget collects

Analytics events

The widget records product-usage events so you can see how readers engage with your research. Each event is a row containing:

• the event name (for example WIDGET_LOADED, DRAWER_OPENED, OPEN_ON_RB)
• a small metadata object (the paper involved, which format was opened, counts)
• a session identifier (see section 3)
• the embedding origin (the scheme and domain of your page), which is how events are attributed to your account
• a country, derived server-side from the network request, not from any device API. We do not derive or store a finer-grained location.
• the widget identifier configured in the embed

WIDGET_LOADED fires when the widget mounts. Every other event requires a reader action.

Ask the paper (chat)

If a reader uses the chat panel, the question text is sent to ResearchBunny, answered against the paper, and stored with the session identifier so we can improve answer quality. Do not encourage readers to enter personal data in this field; it is a research question box.

Format feedback

If a reader gives feedback on an audio brief, video or infographic, we store the verdict, any note they typed, the session identifier, the origin and country, an optional email address if they supply one so we can reply, and — for abuse prevention — the IP address and user agent of the submission. The form says so at the point of collection.

What the widget does NOT collect

The widget does not read cookies on your site, does not fingerprint the device, and does not collect browser language, timezone, screen dimensions, referrer or user agent from the page. It contains no advertising, tag-manager or session-replay code.

3. Identifiers and the cookieless default

By default the widget writes nothing to your visitors' browser storage. It generates a session identifier that lives in memory for a single page load and is gone when the reader navigates away. Analytics still work in this mode; you simply cannot distinguish a returning reader from a new one.

A persistent identifier — a random value in localStorage on your domain, used to recognise a returning reader — is written only after consent is signalled.

4. Consent API

The widget takes a consent signal from the host page, so it can sit behind your existing consent management platform.

Declaratively, on the embed element:

<div class="researchbunny-widget" data-paper-id="..." data-consent="granted"></div>

Or at runtime, once your CMP resolves:

ResearchBunnyWidget("consent", "granted"); // or "denied"

The call applies to every widget instance on the page, and takes effect immediately — including after the widget has already loaded, which is the normal case for a CMP.

Browsers sending Global Privacy Control need no special handling: they receive the cookieless default like everyone else.

5. Network requests and CSP

In its default configuration the widget makes no third-party requests. Fonts are self-hosted by ResearchBunny rather than loaded from Google Fonts, so no reader IP address is disclosed to a third party.

The origins the embed needs:

6. Retention

Analytics events and chat messages are retained while your account is active, so that historical engagement reporting remains available to you. Format feedback is retained until it has been acted on and is periodically reviewed. Deleting your ResearchBunny account removes the associated records — see the Data Deletion Policy.

7. Sub-processors

The widget's processing involves the following sub-processors:

Chat questions are sent to our model provider to generate an answer. Under our API agreement with them, content submitted through the API is not used to train their models.

8. Questions and requests

For a data processing agreement, a completed security questionnaire, or to exercise a data subject request relating to the widget, contact support@researchbunny.com. Include the domain the widget is embedded on so we can locate the relevant records.