Legal
Privacy policy
Version of 21 October 2026
In shortWe collect what we need to publish research, run peer review and pay authors. We never sell your data or use it for advertising. You can download or delete your data from your account at any time.
1. Who we are
Scitrino is run by [Company name], a company registered in England and Wales (number [Company number]), registered office [Registered office address]. We are the controller of your personal data. For anything about your data, email info@scitrino.com.
2. What we collect
- Your account: your email address and password. Passwords are handled by our sign-in provider and stored only in a scrambled (hashed) form.
- Your researcher profile: name, institution, country and, if you add it, your ORCID iD.
- Submissions: manuscripts, figures and supplementary files, titles and abstracts, funding and competing-interest declarations, and messages with the editor.
- Co-authors: the names, emails and affiliations a lead author gives us for each co-author.
- Reviewers: the names, emails and affiliations authors suggest as reviewers, and the reviews and decisions reviewers send.
- Activity on articles: comments you post, articles you like, and reports of comments.
- Earnings and payouts: the points your published papers earn, the payouts we make, and the email address you give our payment provider. We never see or store your bank details.
- Invoices: the institution we invoice for a publication fee.
- Records of what you accepted: which version of our terms and this policy you accepted, and when.
- Article views: to count views without counting the same reader twice, we keep an anonymous code made from your connection and browser, scrambled with a key that changes every day. It cannot identify you and is deleted after two days.
3. Why we use it, and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Running your account; handling submissions, peer review, proofs and publication | Contract: we need it to provide the service you signed up for |
| Awarding points and paying authors | Contract |
| Contacting co-authors and suggested reviewers whose details another author gave us | Legitimate interests: running peer review and confirming authorship. We tell them how we got their details in our first email. |
| Publishing articles with their authors’ names, affiliations and declarations | Contract, and the public interest in a permanent scientific record |
| Keeping invoices, payment and payout records | Legal obligation: tax and accounting law |
| Moderating comments, preventing fraud and misconduct, keeping the site secure | Legitimate interests |
| Counting article views | Legitimate interests, using anonymous data only |
| Keeping records of what you accepted | Legitimate interests: showing what was agreed if there is a dispute |
We do not use your data for advertising, sell it, or make automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
- Editors and reviewers see the manuscripts they handle. Peer review is single-anonymous: authors are not told who reviewed their paper.
- Everyone can read published articles, including the authors’ names, affiliations and declarations.
- Service providers who process data for us under contract: Supabase (database, sign-in and file storage, in the EU (Ireland)), Render (website hosting, in the EU (Germany)), Resend (email delivery, in the USA) and, for payouts, Wise.
- Professional advisers (accountants, lawyers) and authorities where the law requires it.
5. Data outside the UK
Our database, files and website are hosted in the EU (Ireland and Germany), which UK law recognises as giving adequate protection. Email delivery (Resend) takes place in the USA, under the UK–US data bridge and the UK International Data Transfer Addendum in Resend’s data processing agreement.
6. How long we keep it
| Data | Kept for |
|---|---|
| Published articles, their authors and their version history | Permanently, as part of the scientific record |
| Your account and profile | Until you delete your account, or after 3 years without using it. We email you 30 days before; signing in keeps your account. Accounts with earnings still due, or work in progress, are kept. |
| Submissions that were rejected or withdrawn, with their reviews and messages | 2 years after the last activity |
| Reviewer invitations that were never answered | 1 year after they expired; then the reviewer’s name and email are removed |
| Notifications in your account | 1 year after you read them (2 years if unread) |
| Invoices, payment and payout records | 6 years, as tax law requires |
| Records of what you accepted | 6 years after your account ends |
| Anonymous view-counting codes | 2 days |
7. Your rights
You can ask to see, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable form.
- Download your data: from Account settings, at any time.
- Delete your account: also from Account settings. We remove your profile and contact details. Your name stays on articles that are already published, because the scientific record must stay intact; UK GDPR allows this for scientific research and archiving. Invoices and payout records are kept for 6 years because the law requires it.
- For anything else, email info@scitrino.com. We reply within one month.
8. Cookies
We use one essential cookie, which keeps you signed in. It is sent only over secure connections and cannot be read by scripts on the page. We count article views without cookies (see section 2). We use no analytics, advertising or social media cookies, so we do not ask for cookie consent. If you are writing a message to the editor, your browser keeps an unsent draft until you close the tab.
9. Security
Data travels over encrypted connections. Unpublished files are visible only to the people involved in that paper. Database access is restricted to our own servers. If a breach puts your data at risk, we will tell you and the Information Commissioner’s Office as the law requires.
10. Children
Scitrino is for researchers and is not intended for anyone under 18.
11. Complaints
Please contact us first. You can also complain to the Information Commissioner’s Office, the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.
12. Changes to this policy
If we change this policy in a way that matters, we will ask you to read it again the next time you sign in. This is the version of 21 October 2026.