Privacy Policy

1. Introduction

1.1 · What this policy explains. This Privacy Policy explains how XSci LTD ("XSci," "we," "us," or "our") collects, uses, stores, shares, and protects your personal information when you use the XSci platform at xsci.com (the "Service").

1.2 · The law we work to. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018.

1.3 · Who the controller is. Data Controller: XSci LTD, 66 Paul Street, London, EC2A 4NA, United Kingdom. Contact: support@xsci.com.

2. Information we collect

2.1 Information you provide

2.1.1 · Account information. Name, email address, institutional affiliation, and account credentials when you create an account, and any profile details you choose to add (such as a bio, research fields, keywords and links). What of this is shown publicly is set out in clauses 5.4 to 5.8.

2.1.2 · Submitted content. Research papers, manuscripts, and other academic documents you upload through the Service for analysis, review, or related service features.

2.1.3 · Payment information. When you make a purchase, payment data is collected and processed by our third-party payment provider (currently Stripe). We do not store your full credit card number. See Stripe's Privacy Policy: https://stripe.com/privacy.

2.1.4 · Payout and identity information (reviewers receiving payment). If you are a reviewer who receives payment for your work, our third-party payment provider (currently Stripe, through Stripe Connect) collects the information needed to set up payouts and verify your identity. This may include your name, address, date of birth, bank or payout account details, and government identification or tax information, as required to meet identity verification (KYC) and anti-money-laundering obligations. This information is collected and processed directly by the payment provider; we receive only the limited confirmation and status information needed to manage payouts.

2.1.5 · Communications. Information you provide when you contact us for support, enquiries, or feedback.

2.2 Information collected automatically

2.2.1 · Usage data. Pages visited, features used, timestamps, and interaction patterns.

2.2.2 · Device data. IP address, browser type, operating system, and related technical information.

2.2.3 · Cookies. We use essential cookies to operate the Service and analytics cookies to understand usage. See our Cookie Policy for details, and clause 10.

2.3 Information we do NOT collect

2.3.1 · Special category data. We do not intentionally request sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or similar categories of special category data) in order to provide the Service.

2.3.2 · Reviewer identity documents. Identity and verification information required to pay reviewers (such as government identification or tax details) is collected and held directly by our payment provider for KYC/AML purposes and is not stored by us.

2.3.3 · Minors. We do not knowingly collect data from minors. See clause 11.

2.4 Where we hold information about you that you did not give us

2.4 · Personal data we did not obtain from you. (This clause was revised in November 2026: it now describes the licensing of commissioned assessments as a corpus, why we do not write to authors individually, and how to object.) We hold information about you that you did not give us in two cases: where someone other than you uploads your publicly available paper in order to obtain an expert assessment of it, and where XSci itself obtains publicly available papers, in volume, to have them assessed by experts so that the assessments can be licensed as a corpus for research and technological development. In both cases the source is the public record: the version of your paper that anyone can read. What we hold is a copy of that paper, with your authorship details as published, which is confidential material under the AI and Data Usage Disclosure (4.4) and is never licensed to anyone; and in due course a reviewer's assessment of your work, with the records of how it was drafted.

(a) We do not write to you individually, and here is why. Your paper and your name on it are already public. The assessments are licensed as a corpus of hundreds or thousands of papers, each treated in the same way, and nobody is singled out. What leaves XSci carries no field that names you (see (d)). And this clause, together with AI and Data Usage Disclosure 5.5.7, describes the processing publicly. This is the public statement that Article 14(5)(b) of the UK GDPR allows in place of individual notice, where notice would be a disproportionate effort and the purpose is research with the safeguards in Article 89(1). The person who commissioned the assessment may ask us to tell you that it exists and to offer you the report (AI and Data Usage Disclosure 4.7(d)). You may also ask us at any time what we hold about you (clause 7). (b) The basis, and the interest. The basis is legitimate interest, and the interest is this: XSci pays subject experts to assess public papers, and licenses the assessments, as a corpus, for research and technological development, to organisations that research, develop and evaluate AI systems. Expert assessment is expensive, and licensing helps to pay for it and to improve the systems that produce it; those we licence to have an interest of their own in systems measured against genuine expert judgement. (c) You may object, at any time, whether or not you have been told. Write to support@xsci.com, or see 3.5. From the moment we receive your objection, nothing arising from the assessment of your paper enters any dataset built thereafter; we tell every licensee that has already received it, and our licence requires the licensee to delete it from the copies it holds. An objection cannot reach a model already trained, and we will not tell you otherwise. Objecting changes nothing else: your paper, and anything about it that is already public, are unaffected. (d) What leaves XSci, and what never does. A licensee receives the public identifier of your paper, the reviewer's report and the records of how it was drafted, and nothing that names you. A licensee may use the corpus only for research and technological development; may not use it to make decisions about you or to build a profile of you; may not try to identify anyone beyond resolving the identifier; and may not pass it on (clause 5.2(f)). Your paper is not licensed in any case, and is never used to train any model.

3. How we use your information

3.1 · Purposes and legal bases. We process your personal information for the following purposes:

(a) Provide and operate the Service — Legal basis: Performance of contract (Art. 6(1)(b)) (b) Process your submissions and generate review-related outputs — Legal basis: Performance of contract (c) Process payments — Legal basis: Performance of contract (d) Process reviewer payouts and verify payee identity — Legal basis: Performance of contract; identity verification (KYC/AML) under Legal obligation (Art. 6(1)(c)) (e) Send transactional emails (receipts, account notices, service notifications) — Legal basis: Performance of contract (f) Respond to support requests — Legal basis: Legitimate interest (Art. 6(1)(f)) (g) Improve the Service and fix bugs — Legal basis: Legitimate interest (h) Evaluate, research, and improve our review systems, including by training and fine-tuning our own models on content published on the Service — Legal basis: Legitimate interest (Art. 6(1)(f)) (i) Evaluate and improve our review systems using reviewer-authored reports, as part of the reviewer engagement — Legal basis: Performance of contract (j) Maintain security, prevent misuse, and enforce our terms — Legal basis: Legitimate interest (k) Comply with legal obligations — Legal basis: Legal obligation (Art. 6(1)(c)) (l) Send marketing communications (only with consent, where required) — Legal basis: Consent (Art. 6(1)(a)) (m) Evaluate, research, and improve our review systems using de-identified private interaction data — how you used a review, and what you wrote about it — including by training and fine-tuning our own models — Legal basis: Legitimate interest (Art. 6(1)(f)). You may object at any time under Art. 21 (clause 4.4). (n) Show your public profile page (clauses 5.4 to 5.8) — Legal basis: with Public Profile off, Legitimate interest (Art. 6(1)(f)): the page only brings together, under your name and the ORCID iD on your account, the public preprints you submitted, each of whose own pages already shows that you submitted it, so that readers can find that work in one place. You may object (clause 3.2): to have the page hidden, contact us at support@xsci.com; we deal with each request individually. With it on, Consent (Art. 6(1)(a)), which you give by turning it on and withdraw at any time by turning it off. When you turn it on, and when you turn it off, we record the time, the version of this Privacy Policy then in force, and the wording of the setting as it was shown to you. (o) Licence content relating to public manuscripts to third parties, including organisations that research, develop and evaluate AI systems: the publicly deposited version, reviewer reports and the drafting records behind them, certification records and author responses, and de-identified structured interaction data. For a paper assessed at someone else's request, or at XSci's own (clause 2.4), only the paper's public identifier, the report and its drafting records, with no author fields. Applies only where the manuscript is public. Legal basis: Legitimate interest (Art. 6(1)(f)); the interest pursued is XSci's in funding and improving expert review by licensing the material it produces for research and technological development, and the licensee's in systems measured against genuine expert judgement. You may object at any time under Art. 21 (clause 3.5). Reviewer-side processing of a reviewer's own personal data in connection with this purpose remains Performance of contract, under the Reviewer Agreement.

3.2 · Your right to object where we rely on legitimate interest. Where we rely on legitimate interest, you may object to the processing under Art. 21 (see clause 7).

3.3 · What an objection to 3.1(h) does, and does not, do. Objecting to the use of published content for the purpose in 3.1(h) is an objection to our processing of personal data within that content; it does not withdraw the licence you granted under our Terms of Service to publish and distribute the content itself.

3.4 · What an objection to 3.1(m) does, and does not, do. It stops the use of your interaction data for that purpose from the date we receive it, and excludes it from every later training run. It does not require, and cannot achieve, the retraining of a model already built. It has no effect on your account, on any service you have bought, or on any certification you hold.

3.5 · What an objection to 3.1(o) does, and does not, do. It stops reviewer reports on your manuscripts, the records behind them, and your structured interaction data being included in any dataset built after we receive it. We tell every licensee that has already received that material, and our licence requires the licensee to delete it from the copies it holds and to confirm that it has. It does not withdraw the licence you granted under our Terms of Service to publish content you deposited publicly, and it does not affect anything that is already public on the platform. It does not require, and cannot achieve, the retraining of a model already built.

4. AI processing disclosure

4.1 · XSci uses artificial intelligence to assist in the review and analysis process. When you submit content through the Service, clauses 4.2 to 4.7 apply.

4.2 · Content you publish on the Service — your public deposit, and the reports and records published alongside it — may be used to evaluate, research, and improve our review systems, including to train and fine-tune our own models. Where your manuscript is public, it may also be licensed to third parties, including AI developers, under 3.1(o). Where your manuscript is not public, it is not licensed to anyone.

4.3 · Confidential material — your manuscript and anything else you supply in order to obtain a service and do not publish, including material provided privately to a reviewer — is used only to deliver the service you bought. It is never used to train, fine-tune, or evaluate any model. Your unpublished activity on the Service is not confidential material, and is dealt with in 4.4.

4.4 · Your activity on the Service that is not published. What you did with a review, and what you wrote about it, may be used de-identified to evaluate, research and improve our review systems, including to train and fine-tune our own models. Before any such use, we take reasonable technical steps to remove passages reproduced from your manuscript, which remain confidential material under clause 4.3 and are never used for training. De-identified is not anonymous: this data remains personal data and your rights under clause 7 apply to it. Where it relates to a manuscript that is public, this data may also be licensed to third parties in de-identified, structured form under 3.1(o). You may object or opt out at any time by contacting support@xsci.com. We will stop using your data for these purposes from that moment and exclude it from later training; we cannot remove it from a model already trained, and we do not claim to be able to.

4.5 · Reviewer-authored reports are used to evaluate and improve our review systems as part of the paid reviewer engagement. Reviewers are anonymous, and nothing we publish about review quality identifies them; that anonymity concerns attribution, not internal evaluation use. Where the manuscript is public, a report on it may also be licensed to third parties under 3.1(o), on the basis described there. Where the manuscript is not public, the report is not licensed to anyone. Licensed reports carry the same anonymity: nothing supplied to a licensee identifies the reviewer.

4.6 · Third-party AI review providers. Where you choose a third-party AI review provider on the Service, your content is sent to that provider on your instruction and is then handled under that provider's own terms and privacy policy, rather than ours. We identify the provider and link to its policies before you purchase. We do not represent that any third-party provider is contractually barred from training on your content, and you should not assume it.

4.7 · AI-generated outputs may be inaccurate, incomplete, or misleading and should be reviewed with appropriate care.

4.8 · Where to read more. For more details, see our AI and Data Usage Disclosure.

5. How we share your information

5.1 · We do not sell your personal information to data brokers or advertisers. We do not and will not. The only commercial sharing we do is the licensing described at 3.1(o), which applies only to manuscripts that are public, and never covers confidential material. Some US state privacy laws define "sale" and "sharing" broadly enough to reach that licensing. Where you are covered by such a law, you may opt out by contacting support@xsci.com.

5.2 · Who we may share it with. We may share your information with:

(a) Payment providers (currently Stripe / Stripe Connect) — Purpose: process purchases and reviewer payouts, and verify payee identity (KYC/AML) — Safeguard: DPA in place; PCI-DSS compliant (b) Amazon Web Services (hosting) — Purpose: host the Service and store data — Safeguard: DPA in place (c) AI model providers acting on our instructions — Purpose: process submitted content and generate service outputs — Safeguard: DPA in place; they process only on our documented instructions and may not use your content for their own purposes, including model training (d) Third-party AI review providers you select — Purpose: produce the AI review you purchased from that provider — Safeguard: sent on your instruction only; the provider acts as an independent controller under its own terms and privacy policy, which we identify and link before you purchase (e) Law enforcement, regulators, courts, or other competent authorities — Purpose: where required by law or valid legal process (f) Organisations we licence content to: those that research, develop and evaluate AI systems. Purpose: research and technological development, including the development, training and evaluation of AI systems. Safeguard: written licence restricting use to that purpose, prohibiting decisions about or profiling of individual researchers, re-identification attempts and onward transfer, requiring deletion of copies on notice and confirmation of deletion, and ending on breach; for assessments under clause 2.4 the material supplied carries no field naming an author; where the licensee is outside the United Kingdom, a transfer mechanism under clause 8; the licensee acts as an independent controller

5.3 · Submitted content. We do not share your submitted manuscripts or other submitted content with third parties except as necessary to provide the Service, on your instruction, or where required by law, and except that content relating to a manuscript that is public may be licensed under 3.1(o). Nothing relating to a manuscript that is not public is ever licensed, and your submitted manuscript file is never licensed. We do not share a manuscript uploaded for a commissioned assessment with anyone beyond the reviewer engaged to assess it, and we do not licence it. Where the purchaser asks us to offer the assessment to the paper's authors (AI and Data Usage Disclosure 4.7(d)), we do so on anonymous terms (Peer Review Policy 3.3.3).

5.4 · Your public profile page. Your account has a profile page on the Service, which anyone can open without signing in. What it shows depends on the Public Profile setting in your account settings, which is off until you turn it on.

5.5 · With Public Profile off. If you have submitted preprints that are published on the Service, your profile page shows your name and ORCID iD as on your account (the iD you linked by signing in with ORCID) and the public preprints you submitted — each of which already shows, on its own page, that you submitted it — and nothing else from your profile. If you have none, the page says only that the profile is private, not whose it is. In both cases we ask search engines not to index the page.

5.6 · With Public Profile on. Everything on your profile is shown to everyone: in addition to the above, your affiliation (institution, department and position), bio, research fields, keywords, the links you added (such as a website, Google Scholar, X or LinkedIn), and the number of reviews you have completed on the Service. That number does not say which manuscripts you reviewed (clause 4.5). Once you have at least one public preprint, your profile page may be indexed by search engines such as Google and is listed in our sitemap, so it can appear in search results, including for your name.

5.7 · Turning it off. You can turn Public Profile off at any time in your account settings. Your page changes immediately, and from then on we ask search engines not to index it. Search engines, and anyone else who has already copied the page, decide when their copies are updated or removed; we cannot control that.

5.8 · What a profile never shows. Your email address, and whether you are willing to review, are never shown on your profile. An account created for you (for example by an invitation or a form) that you have not claimed, and a closed account, have no profile page.

6. Data retention

6.1 · The general rule. We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining security, complying with legal obligations, resolving disputes, and enforcing our agreements.

6.2 · In general:

(a) Account information is retained while your account remains active and for a reasonable period thereafter where necessary for legal, compliance, fraud prevention, or operational purposes. (b) Submitted papers and other submitted content are retained for as long as needed to provide the Service, support user access, and maintain backups, unless you request deletion and we are able to delete the data under applicable law and technical constraints. (c) Payment, payout, and accounting records may be retained for longer periods where required by law. (d) Operational logs and support records are retained for limited periods appropriate to security, troubleshooting, and compliance needs. (e) Private interaction data is retained until six years after your last interaction with the Service, after which it is deleted or irreversibly aggregated. (f) Papers obtained for a commissioned assessment (clause 2.4), the reviewer's report and the records of how it was drafted are retained until six years after the report is delivered, after which they are deleted or irreversibly aggregated.

6.3 · Deletion and anonymisation. Where possible, we will delete or anonymize personal data when it is no longer needed.

7. Your rights

7.1 · Under UK GDPR / EU GDPR, you have the right to:

(a) Access your personal data (Art. 15) (b) Rectify inaccurate data (Art. 16) (c) Erase your data ("right to be forgotten") (Art. 17) (d) Restrict processing (Art. 18) (e) Data portability — receive your data in a structured format (Art. 20) (f) Object to processing based on legitimate interest (Art. 21) (g) Withdraw consent at any time (Art. 7(3)) (h) Lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

7.2 · How to exercise them. To exercise any of these rights, contact us at support@xsci.com. We will respond within 30 days.

8. International data transfers

8.1 · Where your data is stored. Your data is stored on servers located in AWS ap-southeast-1 (Singapore). This involves a transfer of personal data outside the United Kingdom and the European Economic Area, and we ensure that appropriate safeguards are in place in accordance with applicable data protection law.

8.2 · These safeguards may include:

(a) Standard Contractual Clauses (SCCs) approved by the European Commission; (b) the UK International Data Transfer Agreement (IDTA) or the UK Addendum, where applicable; or (c) adequacy regulations or other lawful transfer mechanisms.

8.3 · Our commitment. We take reasonable steps to ensure that personal data transferred internationally remains protected in accordance with this Privacy Policy and applicable law.

9. Security

9.1 · Measures. We implement appropriate technical and organizational measures to protect your personal data, including:

(a) HTTPS encryption for data in transit (b) Encryption at rest where appropriate (c) Access controls based on the principle of least privilege (d) Backups and recovery procedures (e) Logging and monitoring

9.2 · The limit of that commitment. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

10. Cookies

10.1 · Use and management. We use cookies and similar technologies to operate and improve the Service. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

11. Children

11.1 · The Service is not directed to children, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take reasonable steps to delete it.

12. Changes to this policy

12.1 · How we change it. We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact us

13.1 · Questions about this Privacy Policy, or to exercise your data rights: Email support@xsci.com.

13.2 · Supervisory authority. Information Commissioner's Office (ICO) — https://ico.org.uk