Privacy Policy

1. Introduction

1.1 · What this policy explains. This Privacy Policy explains how XSci LTD ("XSci," "we," "us," or "our") collects, uses, stores, shares, and protects your personal information when you use the XSci platform at xsci.com (the "Service").

1.2 · The law we work to. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018.

1.3 · Who the controller is. Data Controller: XSci LTD, 66 Paul Street, London, EC2A 4NA, United Kingdom. Contact: privacy@xsci.com.

2. Information we collect

2.1 Information you provide

2.1.1 · Account information. Name, email address, institutional affiliation, and account credentials when you create an account.

2.1.2 · Submitted content. Research papers, manuscripts, and other academic documents you upload through the Service for analysis, review, or related service features.

2.1.3 · Payment information. When you make a purchase, payment data is collected and processed by our third-party payment provider (currently Stripe). We do not store your full credit card number. See Stripe's Privacy Policy: https://stripe.com/privacy.

2.1.4 · Payout and identity information (reviewers receiving payment). If you are a reviewer who receives payment for your work, our third-party payment provider (currently Stripe, through Stripe Connect) collects the information needed to set up payouts and verify your identity. This may include your name, address, date of birth, bank or payout account details, and government identification or tax information, as required to meet identity verification (KYC) and anti-money-laundering obligations. This information is collected and processed directly by the payment provider; we receive only the limited confirmation and status information needed to manage payouts.

2.1.5 · Communications. Information you provide when you contact us for support, enquiries, or feedback.

2.2 Information collected automatically

2.2.1 · Usage data. Pages visited, features used, timestamps, and interaction patterns.

2.2.2 · Device data. IP address, browser type, operating system, and related technical information.

2.2.3 · Cookies. We use essential cookies to operate the Service and analytics cookies to understand usage. See our Cookie Policy for details, and clause 10.

2.3 Information we do NOT collect

2.3.1 · Special category data. We do not intentionally request sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or similar categories of special category data) in order to provide the Service.

2.3.2 · Reviewer identity documents. Identity and verification information required to pay reviewers (such as government identification or tax details) is collected and held directly by our payment provider for KYC/AML purposes and is not stored by us.

2.3.3 · Minors. We do not knowingly collect data from minors. See clause 11.

3. How we use your information

3.1 · Purposes and legal bases. We process your personal information for the following purposes:

(a) Provide and operate the Service — Legal basis: Performance of contract (Art. 6(1)(b)) (b) Process your submissions and generate review-related outputs — Legal basis: Performance of contract (c) Process payments — Legal basis: Performance of contract (d) Process reviewer payouts and verify payee identity — Legal basis: Performance of contract; identity verification (KYC/AML) under Legal obligation (Art. 6(1)(c)) (e) Send transactional emails (receipts, account notices, service notifications) — Legal basis: Performance of contract (f) Respond to support requests — Legal basis: Legitimate interest (Art. 6(1)(f)) (g) Improve the Service and fix bugs — Legal basis: Legitimate interest (h) Evaluate, research, and improve our review systems, including by training and fine-tuning our own models on content published on the Service — Legal basis: Legitimate interest (Art. 6(1)(f)) (i) Evaluate and improve our review systems using reviewer-authored reports, as part of the reviewer engagement — Legal basis: Performance of contract (j) Maintain security, prevent misuse, and enforce our terms — Legal basis: Legitimate interest (k) Comply with legal obligations — Legal basis: Legal obligation (Art. 6(1)(c)) (l) Send marketing communications (only with consent, where required) — Legal basis: Consent (Art. 6(1)(a)) (m) Evaluate, research, and improve our review systems using de-identified private interaction data — how you used a review, and what you wrote about it — including by training and fine-tuning our own models — Legal basis: Legitimate interest (Art. 6(1)(f)). You may object at any time under Art. 21 (clause 4.4).

3.2 · Your right to object where we rely on legitimate interest. Where we rely on legitimate interest, you may object to the processing under Art. 21 (see clause 7).

3.3 · What an objection to 3.1(h) does, and does not, do. Objecting to the use of published content for the purpose in 3.1(h) is an objection to our processing of personal data within that content; it does not withdraw the licence you granted under our Terms of Service to publish and distribute the content itself.

3.4 · What an objection to 3.1(m) does, and does not, do. It stops the use of your interaction data for that purpose from the date we receive it, and excludes it from every later training run. It does not require, and cannot achieve, the retraining of a model already built. It has no effect on your account, on any service you have bought, or on any certification you hold.

4. AI processing disclosure

4.1 · XSci uses artificial intelligence to assist in the review and analysis process. When you submit content through the Service, clauses 4.2 to 4.7 apply.

4.2 · Content you publish on the Service — your public deposit, and the reports and records published alongside it — may be used to evaluate, research, and improve our review systems, including to train and fine-tune our own models.

4.3 · Confidential material — your manuscript and anything else you supply in order to obtain a service and do not publish, including material provided privately to a reviewer — is used only to deliver the service you bought. It is never used to train, fine-tune, or evaluate any model. Your unpublished activity on the Service is not confidential material, and is dealt with in 4.4.

4.4 · Your activity on the Service that is not published. What you did with a review, and what you wrote about it, may be used de-identified to evaluate, research and improve our review systems, including to train and fine-tune our own models. Before any such use, we take reasonable technical steps to remove passages reproduced from your manuscript, which remain confidential material under clause 4.3 and are never used for training. De-identified is not anonymous: this data remains personal data and your rights under clause 7 apply to it. You may object or opt out at any time from your account settings or by contacting privacy@xsci.com. We will stop using your data for these purposes from that moment and exclude it from later training; we cannot remove it from a model already trained, and we do not claim to be able to.

4.5 · Reviewer-authored reports are used to evaluate and improve our review systems as part of the paid reviewer engagement. Reviewers are anonymous, and nothing we publish about review quality identifies them; that anonymity concerns attribution, not internal evaluation use.

4.6 · Third-party AI review providers. Where you choose a third-party AI review provider on the Service, your content is sent to that provider on your instruction and is then handled under that provider's own terms and privacy policy, rather than ours. We identify the provider and link to its policies before you purchase. We do not represent that any third-party provider is contractually barred from training on your content, and you should not assume it.

4.7 · AI-generated outputs may be inaccurate, incomplete, or misleading and should be reviewed with appropriate care.

4.8 · Where to read more. For more details, see our AI and Data Usage Disclosure.

5. How we share your information

5.1 · We do NOT sell your personal information.

5.2 · Who we may share it with. We may share your information with:

(a) Payment providers (currently Stripe / Stripe Connect) — Purpose: process purchases and reviewer payouts, and verify payee identity (KYC/AML) — Safeguard: DPA in place; PCI-DSS compliant (b) Amazon Web Services (hosting) — Purpose: host the Service and store data — Safeguard: DPA in place (c) AI model providers acting on our instructions — Purpose: process submitted content and generate service outputs — Safeguard: DPA in place; they process only on our documented instructions and may not use your content for their own purposes, including model training (d) Third-party AI review providers you select — Purpose: produce the AI review you purchased from that provider — Safeguard: sent on your instruction only; the provider acts as an independent controller under its own terms and privacy policy, which we identify and link before you purchase (e) Law enforcement, regulators, courts, or other competent authorities — Purpose: where required by law or valid legal process

5.3 · Submitted content. We do not share your submitted manuscripts or other submitted content with third parties except as necessary to provide the Service, on your instruction, or where required by law.

6. Data retention

6.1 · The general rule. We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining security, complying with legal obligations, resolving disputes, and enforcing our agreements.

6.2 · In general:

(a) Account information is retained while your account remains active and for a reasonable period thereafter where necessary for legal, compliance, fraud prevention, or operational purposes. (b) Submitted papers and other submitted content are retained for as long as needed to provide the Service, support user access, and maintain backups, unless you request deletion and we are able to delete the data under applicable law and technical constraints. (c) Payment, payout, and accounting records may be retained for longer periods where required by law. (d) Operational logs and support records are retained for limited periods appropriate to security, troubleshooting, and compliance needs. (e) Private interaction data is retained until six years after your last interaction with the Service, after which it is deleted or irreversibly aggregated.

6.3 · Deletion and anonymisation. Where possible, we will delete or anonymize personal data when it is no longer needed.

7. Your rights

7.1 · Under UK GDPR / EU GDPR, you have the right to:

(a) Access your personal data (Art. 15) (b) Rectify inaccurate data (Art. 16) (c) Erase your data ("right to be forgotten") (Art. 17) (d) Restrict processing (Art. 18) (e) Data portability — receive your data in a structured format (Art. 20) (f) Object to processing based on legitimate interest (Art. 21) (g) Withdraw consent at any time (Art. 7(3)) (h) Lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

7.2 · How to exercise them. To exercise any of these rights, contact us at privacy@xsci.com. We will respond within 30 days.

8. International data transfers

8.1 · Where your data is stored. Your data is stored on servers located in AWS ap-southeast-1 (Singapore). This involves a transfer of personal data outside the United Kingdom and the European Economic Area, and we ensure that appropriate safeguards are in place in accordance with applicable data protection law.

8.2 · These safeguards may include:

(a) Standard Contractual Clauses (SCCs) approved by the European Commission; (b) the UK International Data Transfer Agreement (IDTA) or the UK Addendum, where applicable; or (c) adequacy regulations or other lawful transfer mechanisms.

8.3 · Our commitment. We take reasonable steps to ensure that personal data transferred internationally remains protected in accordance with this Privacy Policy and applicable law.

9. Security

9.1 · Measures. We implement appropriate technical and organizational measures to protect your personal data, including:

(a) HTTPS encryption for data in transit (b) Encryption at rest where appropriate (c) Access controls based on the principle of least privilege (d) Backups and recovery procedures (e) Logging and monitoring

9.2 · The limit of that commitment. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

10. Cookies

10.1 · Use and management. We use cookies and similar technologies to operate and improve the Service. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

11. Children

11.1 · The Service is not directed to children, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take reasonable steps to delete it.

12. Changes to this policy

12.1 · How we change it. We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact us

13.1 · Questions about this Privacy Policy, or to exercise your data rights: Email privacy@xsci.com.

13.2 · Supervisory authority. Information Commissioner's Office (ICO) — https://ico.org.uk