1. Who is responsible for your data
Editara ("we", "us"), operating editara.com, is the data controller for the personal data processed through the platform, except for manuscript and journal content where we act as a processor on behalf of the journal that manages it. Contact for privacy matters: [email protected].
2. What we collect
- Account data — name, email address, institution, account type, and role, provided at signup.
- Editorial data — manuscripts, author lists and affiliations, reviews, editorial decisions and related correspondence created while using the workflow.
- Published content — journal pages, articles and author names that a journal chooses to make public.
- Technical data — server logs (IP address, timestamps, requested pages) kept for security and debugging.
- Operational records — significant actions taken on the platform (for example a sign-in, an editorial decision, or an evaluation run) are logged with the acting account, to provide the editorial audit trail and to understand how the platform is used.
- Messages — what you send us through the contact or support forms.
We do not run advertising or cross-site tracking, and we do not sell personal data.
3. Why we process it
- To provide the Service — accounts, evaluations, editorial workflow, publication (contract performance).
- To secure the platform and prevent abuse (legitimate interest).
- To send service notifications you can control from your settings, with unsubscribe links in every email (contract performance / legitimate interest).
- To answer your messages (legitimate interest).
- To meet legal obligations where they apply.
4. Who processes data for us
We use a small number of infrastructure providers, each bound by data-processing agreements:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage |
| Anthropic | AI-assisted evaluation of submitted manuscripts |
| Resend | Transactional email delivery |
| Cloudflare | Network security and content delivery |
| Hosting provider (EU) | Application servers |
Where a provider processes data outside the European Economic Area, transfers rely on adequacy decisions or Standard Contractual Clauses.
5. How long we keep it
Account and editorial data are kept while your account is active and deleted or anonymised on verified deletion requests, except where the scholarly record requires retention — published articles and their authorship form part of the permanent academic record. Server logs are kept for a limited period for security purposes.
6. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to [email protected] and we will respond within one month. You can also lodge a complaint with your supervisory authority — in Romania, ANSPDCP (dataprotection.ro).
7. Cookies
The platform uses only strictly necessary cookies (authentication and your cookie notice choice). Details are in the Cookie Policy.
8. Changes
We will post any changes to this policy on this page and update the date above. For significant changes we will notify account holders.