Data Processing Addendum

1. Scope and Relationship to Other Terms

This Data Processing Addendum ("Addendum") sets out how XSci — OXSCI LTD (66 Paul Street, London, EC2A 4NA, United Kingdom) — handles the manuscripts and related materials you submit for review ("Submitted Content") and the personal data XSci processes in providing the Service. It supplements, and forms part of, the Terms of Service, and incorporates the Privacy Policy and the AI Usage Disclosure by reference.

Where this Addendum conflicts with the Terms of Service on the handling of Submitted Content or personal data, this Addendum controls. It applies for as long as XSci holds Submitted Content or related personal data.

2. Definitions

• "Submitted Content" means the manuscripts, files, data, and related materials you upload or submit to the Service for review, together with any personal data contained in them.
• "Personal Data", "Processing", "Controller", "Processor", and "Sub-processor" have the meanings given in Applicable Data Protection Law.
• "Applicable Data Protection Law" means the data protection and privacy laws that apply to the processing, including the UK General Data Protection Regulation and the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation.
• "AI Provider" means a third-party provider of artificial-intelligence models or services used to deliver the Service.

3. Roles

You submit Submitted Content to XSci to obtain a review and related services. XSci processes Submitted Content and personal data to provide the Service and for the purposes described in the Privacy Policy and the AI Usage Disclosure. Each party will comply with its obligations under Applicable Data Protection Law, and the allocation of Controller and Processor roles is determined in accordance with that law.

4. Confidentiality and No AI Training on Submitted Content

XSci treats all Submitted Content as strictly confidential and as your intellectual property, whether or not it has already been made public (for example, an arXiv preprint).

Submitted Content is used solely to produce your review and to provide the Service. XSci does not use Submitted Content to train, fine-tune, or improve any AI model, and the AI Providers XSci uses are bound by commercial terms that prohibit training on Submitted Content and that require its deletion from the provider's systems within a limited retention period.

This restriction covers Submitted Content and any data derived from it that still contains or reveals the manuscript. It does not restrict XSci's use of reviewer-authored reports or of your own refinement activity (the comments, edits, and revisions you make to an AI-generated review) to evaluate, develop, and improve XSci's review systems, as described in the AI Usage Disclosure and, for reviewers, governed by the Reviewer Agreement. You may opt out of the use of your refinement activity as described in the AI Usage Disclosure.

5. Sub-processors

XSci uses Sub-processors — including cloud-hosting providers, AI Providers, and payment providers — to provide the Service. XSci imposes on each Sub-processor data-protection obligations no less protective than those in this Addendum, and in particular the prohibition on using Submitted Content to train AI models and the requirement to delete Submitted Content within a limited retention period. XSci remains responsible for its Sub-processors' performance of these obligations.

The categories of Sub-processor are set out in Annex A. A current list of named Sub-processors is available on request at privacy@xsci.com. XSci will make a reasonable effort to give notice before adding or changing a Sub-processor.

6. Security

XSci maintains reasonable and appropriate technical and organizational measures designed to protect Submitted Content and personal data against unauthorized access, loss, alteration, or disclosure. These include access to Submitted Content on a least-privilege, need-to-know basis, encryption of data in transit and, where applicable, at rest, and internal controls governing who may access Submitted Content and for what purpose. A summary is set out in Annex B.

7. Retention and Deletion

XSci retains Submitted Content and related personal data only for as long as needed to provide the Service and as described in the Privacy Policy, and thereafter deletes it or retains it only to the extent required by law. On request, and subject to any legal retention obligation, XSci will delete or return Submitted Content. XSci's AI Providers delete Submitted Content from their systems within a limited retention period, as described in the AI Usage Disclosure.

8. International Transfers

XSci and its Sub-processors may process Submitted Content and personal data in countries other than your own, including the United States. Where such a transfer is subject to Applicable Data Protection Law, XSci relies on an appropriate transfer mechanism or safeguard recognized under that law.

9. Assistance with Data Subject Requests

Taking into account the nature of the processing, XSci will provide reasonable assistance to help you respond to requests from individuals exercising their rights under Applicable Data Protection Law. Individuals may also contact XSci directly at privacy@xsci.com.

10. Personal Data Breach

XSci will notify affected parties of a personal data breach affecting Submitted Content or personal data without undue delay where, and to the extent, required by Applicable Data Protection Law, and will take reasonable steps to mitigate its effects.

11. Term and Survival

This Addendum takes effect when you accept it or first use the Service and continues while XSci holds Submitted Content or related personal data. Sections 4 (Confidentiality and No AI Training on Submitted Content) and 7 (Retention and Deletion) survive termination for as long as XSci or its Sub-processors continue to hold Submitted Content.

12. Governing Law

This Addendum is governed by the laws of England and Wales.

13. Contact

For questions about this Addendum or XSci's data handling, contact privacy@xsci.com.

Annex A — Categories of Sub-processor

A current list of named Sub-processors is available on request at privacy@xsci.com. XSci does not currently use OpenAI in production; if introduced, an AI Provider will be engaged only under terms that prohibit training on Submitted Content.

Annex B — Summary of Security Measures

• Access to Submitted Content is limited to personnel and services that need it to provide the Service, on a least-privilege basis.
• Data is encrypted in transit and, where applicable, at rest.
• Internal controls govern who may access Submitted Content and for what purpose.
• AI processing is carried out through providers bound by the confidentiality and no-training obligations in Section 4.