Privacy Policy

1. Data Controller

The data controller (Responsable del Tratamiento) is:

This policy applies to personal data processed through getpeeranha.com and is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Ley Orgánica 3/2018 (LOPD-GDD).

2. Data We Collect

• Account data: name, institutional email address, institution name, ORCID identifier (reviewers).
• Manuscript data: uploaded PDFs, titles, abstracts, topic summaries, and scientific field tags (submitted by journals).
• Review data: scores, comments, and recommendations written by reviewers.
• Payment data: journal payments are processed via Stripe, Inc. We do not store card numbers. We retain transaction records for legal and accounting purposes.
• Reviewer payout data: bank account number (or IBAN), bank name, BIC/SWIFT code, account holder name, and - only where required by the destination country's banking regulations (e.g. China) - bank branch address and national ID number. Used solely to pay reviewers directly for completed reviews; never shared with the submitting journal.
• Usage data: server logs, IP addresses, and browser information, collected automatically for security and performance.

3. Legal Bases for Processing

We do not use your data for marketing, profiling, or automated decision-making with legal effects.

4. Manuscript Confidentiality

Uploaded manuscripts are stored securely and accessible only to the submitting journal and selected reviewers. We treat all manuscript content as strictly confidential and do not use it for any purpose other than facilitating the review process.

5. Data Processors and Transfers

• Railway (hosting, EU West region) - servers located in the European Union.
• Cloudflare R2 (file storage, Ireland) - within the EEA.
• Resend (transactional email, EU region) - within the EEA.
• Stripe, Inc. (payment processing) - transfers to the USA are covered by standard contractual clauses (SCCs).

No data is sold, rented, or shared with third parties for marketing purposes. All processors are bound by data processing agreements.

6. Data Retention

• Account data: retained for as long as the account is active, plus 1 year after closure.
• Financial records: retained for 6 years in accordance with Spanish tax law (Ley 58/2003 General Tributaria).
• Manuscript files and reviews: retained for a minimum of 3 years to support editorial records.
• Server logs: retained for up to 90 days.

7. Cookies

We use only essential session cookies required for authentication and CSRF protection. We do not use tracking, analytics, or advertising cookies. No cookie consent banner is required for strictly necessary cookies under the Spanish Ley 34/2002 (LSSI).

8. Your Rights

Under the GDPR and LOPD-GDD you have the right to:

• Access - obtain a copy of the personal data we hold about you.
• Rectification - correct inaccurate or incomplete data.
• Erasure (derecho al olvido) - request deletion of your data, subject to legal retention requirements.
• Restriction - ask us to restrict how we use your data.
• Portability - receive your data in a structured, machine-readable format.
• Objection - object to processing based on legitimate interest.

To exercise any of these rights, email privacy@getpeeranha.com. We will respond within 30 days.

If you believe we have not addressed your concern adequately, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

9. Security

We apply technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including encrypted storage, access controls, and HTTPS enforcement.

10. Changes to This Policy

We may update this policy periodically. When we make a material change, registered users must explicitly re-accept the updated Privacy Policy (together with the Terms of Service) before continuing to use the platform - you will be prompted to do so the next time you log in. The current version is always available at getpeeranha.com/privacy.