Only accepted work is recordedAboutGuidesContactSign in
CitePepCitePep
Privacy policy

Privacy Policy

What we collect, what's public, and what never is.

Last updated 25 September 2026 · Summary first, full text below

DataWhyVisibilityKept
Name, topics, institutionTo build your public profilePublicWhile your account exists + 30 days
Email addressTo sign in and reply to youNever shownWhile your account exists + 30 days
Accepted contributionsTo create the public recordPublicPart of the public record; name removable
Declined contributionsIntegrity and abuse preventionNever shown2 years, then deleted
ManuscriptsTo deliver a review to the authorAuthor and reviewer onlyUp to 12 months, or until you delete them
Review reportsTo give the author their findingsAuthor onlyUntil you delete them
Payout and tax detailsTo pay reviewersNever shownAs tax law requires, usually 6–10 years
Visit countsTo understand site trafficNever shownCounts only · no cookies

1.Who we are

1.1CitePep is responsible for the personal data described here. Where this policy says “we”, it means CitePep.

We are responsible for your data.

1.2Publishers who embed the attribution block are responsible for their own sites. This policy covers only what CitePep collects.

Each publisher has its own policy for its site.

2.What we collect

By account type
AccountWhat we collect
EveryoneName, email, password (stored hashed), sign-in method
ContributorTopics, institution, ORCID if connected, contributions you submit
ReviewerFields, languages, fee, availability, payout and tax details
AuthorManuscripts, abstracts, co-authors and exclusions, payment method
PublisherVerified domains, team members, billing details

2.1We do not buy data about you from third parties. If you sign in with ORCID, Google or Facebook, we receive only your name, email and account identifier.

Only what you give us, or what you choose to connect.

3.What is public, and what never is

3.1Your profile and accepted contributions are public; that is the purpose of CitePep.

Public by design: your profile and accepted work.

3.2Your email, contact details, payout information, the content of any review, which manuscripts you were sent, and declined work are never shown.

Never shown: contact, money, reviews, declined work.

3.3A reviewer’s public profile shows only the number of reviews completed, the on-time rate and typical turnaround: never titles, authors or conclusions.

Reviewers: counts only, nothing about the papers.

4.Why we use it

Purpose and legal basis
PurposeBasis
Running your account and delivering reviewsContract with you
Publishing the public recordLegitimate interest in accurate attribution, which you agree to when you contribute
Paying reviewers and invoicingContract and legal obligation (tax)
Preventing fraud and conflictsLegitimate interest
Product emails you opt intoConsent: you can withdraw it any time

5.Cookies

5.1We use essential cookies to keep you signed in and protect forms, and one preferences cookie to remember your settings. Visits are counted with cookieless analytics. We never use advertising or cross-site tracking cookies.

Essential and preferences only. No ad tracking.

5.2Our payment provider and social sign-in providers set their own cookies only when you use them. Details are in the cookie policy.

Third parties only on checkout and social sign-in.

6.Who we share data with

Service providers
Provider typeWhat they receiveWhy
HostingAll account data, encrypted at restTo run the service
PaymentsName, email, payment and payout detailsTo take and send payments
Email deliveryName and emailTo send account and review emails
Identity checksName and ID document, only if usedTo verify identity when ORCID or email is not enough

6.1Providers act under contracts that limit use to providing the service. We never sell personal data, and never share manuscripts with anyone except the reviewer who accepted.

Never sold. Manuscripts go only to your reviewer.

6.2We disclose data to authorities only when legally required, and tell you unless the law prevents it.

Only if the law requires, and we tell you.

7.International transfers

7.1Some providers process data outside your country. Where that happens, we use recognised safeguards such as standard contractual clauses.

Protected wherever it is processed.

8.How long we keep it

Retention
DataKept for
Account and profileWhile your account exists, then deleted within 30 days
Accepted contributionsAs part of the public record; de-attributed on request
Declined contributions2 years, for integrity checks, then deleted
ManuscriptsRemoved from the reviewer 30 days after delivery; deleted from CitePep on your request or after 12 months
Review reportsUntil you delete them
Payment and tax recordsAs long as tax law requires, usually 6–10 years

9.Your rights

9.1You can access, correct, export or delete your personal data from Settings, or by writing to us. We reply within 30 days.

Do it in Settings, or ask us. 30-day reply.

9.2Accepted contributions remain part of the page’s public history, but can be de-attributed from your name on request. The change itself stays on the record as “by a former contributor”.

Your name can go; the correction stays.

9.3You can object to processing based on legitimate interest, and complain to your data protection authority at any time.

You can object, and complain to a regulator.

10.Children

10.1CitePep is not intended for anyone under 16, and we do not knowingly collect their data.

16 and over only.

11.Changes to this policy

11.1We will email account holders at least 30 days before any change that reduces your rights, and list every change on this page.

30 days’ notice for anything that affects you.

12.Contact

12.1Questions about privacy go to a real person at privacy@citepep.com. Requests are logged and answered by name.

A named person, not a form.