Privacy policy

Who we are

This site and the services on it are run by Science Publications, registered in Dubai, United Arab Emirates, licence no. 710490. Our office is at Level 20, 48 Burj Gate Tower, Sheikh Zayed Road, Dubai, United Arab Emirates.

For anything about your personal data, write to [email protected] with “Personal data” in the subject, from the email address on your account if you have one.

What we collect

Your account: your name, email address, password (stored only as a hash), affiliation, country, ORCID iD if you connect it, subject areas and roles (author, reviewer, editor).
Manuscripts: the files you upload; every author’s name, email address, affiliation and ORCID iD; the declarations, the cover letter and the history of the manuscript. If you name someone else as corresponding author, we email them a personal link to confirm it.
People you name: in a submission, the reviewers you suggest and the people you ask us not to invite, with their email addresses and your reasons; in a special issue proposal, the guest editors’ names, email addresses, affiliations and short biographies. We use these only for that manuscript or that special issue.
Peer review: invitations, reports, recommendations and messages, and the names and email addresses of reviewers, including reviewers an editor found and invited directly.
Reviewers’ records: for each reviewer, the invitations answered, the reviews in hand, the response and on-time rates, the editor’s rating of each report, and the certificates and any vouchers issued.
Editors’ records: if you apply for an editorial role, your application (your statement and CV); if you hold one, the board listing you agreed to (your name, institution and country, confirmed each year), your term, your contract and any honorarium, your conflict-of-interest declarations, and your handling record (assignments, response times and decisions).
Testimonials and responses: if you give a testimonial (we ask once, 7 days after publication), your words, the name form and affiliation you choose, any rating, which stays with the office, and your consent, with its date and the exact sentence you agreed to: publication on our website only. If you respond to an article, your response with your name and affiliation.
Email alerts and news: for email alerts, with or without an account, your email address, the journals you follow and any saved search words, used only for those alerts; if you agree to receive news, the date and the wording you agreed to, and the date you withdraw it.
Payments: the tax invoice and the receipt (billing name and address, amounts, VAT) and the payment reference. Card payments are made on the card processor’s secure page and PayPal payments on PayPal: we never see or store card numbers.
Print subscriptions: the order, with the billing and delivery addresses, and its invoices.
Messages: what you send through the contact and feedback forms or by email, which becomes a help-desk ticket.
Using the site: a sign-in session cookie and a security token that protects forms; server logs (IP address, pages, time) for security; a sign-in log (when and how each account signed in) and an audit log of changes to accounts and manuscripts (what changed, when and by whom, an Admin signed in as you included); searches that find nothing, recorded without who made them, to improve the search (a search containing an email address or a number of 7 or more digits is never stored).

What we use it for

Running peer review and publishing: sending manuscripts to editors and reviewers, deciding, producing and publishing articles.
Your account, and the emails about your manuscripts, your reviews and any editorial role you hold (these are part of the service and cannot be switched off). Co-authors are told, view only, when a manuscript is submitted, decided, withdrawn or closed, and published, and can read its proof.
Choosing reviewers and keeping reviews on time and useful, from the reviewers’ records.
Running the editorial boards: considering applications, listing the members who agreed, terms, contracts and honoraria, conflicts of interest, and each journal’s handling times.
Invoices, payments, print subscriptions and the records tax law requires.
Answering your messages.
Keeping the site secure and improving it, from the logs.
News about our journals and calls for papers, only if you agreed to receive them; they come from our marketing domains, never from thescipub.com, and every one has an unsubscribe link. Replies to marketing emails go to the marketing address they were sent from. Addresses on our old mailing list do not count as agreement: each receives one email asking whether it wants our news, and an address that does not answer receives none.
Email alerts that you asked for. One email on Monday when there are new articles in your chosen journals or saved search; nothing in a week with none. Every alert has a link to change what you follow or to stop. Citations of your own articles are shown in My SciPub; we do not email them.

Editors and reviewers of a manuscript see it with its authors’ names. Peer review is single-anonymised: reviewers’ names are never shown to authors.
Editors and the office see the reviewers’ records before inviting and when rating reports; authors and the public never see them.
Editors’ records: an application is read by the journal’s editor-in-chief and the office; an editor’s handling record is seen by the office and, for their journal, its editor-in-chief; contracts, honoraria and conflict-of-interest declarations only by the office.
The public: a published article shows its authors’ names, affiliations and ORCID iDs, permanently, as part of the scholarly record. A published testimonial appears only on our website, with your words and the name form and affiliation you chose (never the rating); a published response shows your name and affiliation; a special issue’s call for papers shows its guest editors’ names and affiliations; the editorial board page shows members’ names, institutions and countries, with their agreement.
Crossref registers each article’s DOI with its metadata (authors, affiliations, ORCID iDs, abstract, references, licence); Portico preserves published articles; indexing services read the published pages.
ORCID, when you connect your iD and ask us to add an article or a review to your record.
iThenticate (Turnitin) compares the text of a submitted manuscript with published work to check for similarity.
Payment processors: Telr for cards and PayPal, under their own privacy policies; we receive the result of the payment and a reference.
Service providers who host the site, its files and our email in [hosting region], only to do that work.
Authorities, when the law requires it.

We do not sell, trade or rent personal information.

Cookies and analytics

We set a session cookie when you sign in and a security token that protects the forms you send. We use no advertising cookies and no third-party analytics: article views and downloads are counted on our own servers.

How long we keep it

Published articles, their metadata and the record of their review: permanently.
Manuscripts that are not published, with their reviews: 5 years after the final decision, then deleted.
Messages, help-desk tickets and feedback: 3 years.
Server, sign-in and audit logs, and searches that find nothing: 12 months.
Invoices, receipts and payment records, print subscription orders included: 5 years after you ask for your data to be erased, as tax law requires.
Accounts, with a reviewer’s or an editor’s records: until you ask us to close yours. The board listing: while you hold the role and confirm it each year. Email alerts: until you stop them. Testimonials: until you withdraw them.

Your rights

You can ask for a copy of your personal data, for a correction, for your account to be closed and your data deleted, and you can withdraw a testimonial, stop your email alerts or withdraw your agreement to news emails at any time. We answer within 30 days. We cannot delete what the scholarly record and the law require us to keep: published articles, the record of their review, and invoices.

To ask, write to [email protected] or use the contact form (“Your personal data”).

Security

Passwords are stored only as hashes, every page is served over an encrypted connection, and only the staff who need it can see your data.

To help with a problem, an Admin of the office may sign in as you, or email you a sign-in link, which works for 24 hours; a sign-in link an Admin copies works once and for 15 minutes only, and is logged under the Admin’s name. Everything done while an Admin is signed in as you is recorded under the Admin’s name.

If you have two accounts, the office may merge them into one; each merge is logged under the name of the staff member who made it and can be undone for 30 days.

Changes to this policy

The date of the last update is shown at the top of this page; we tell account holders by email about any important change.

In short