Privacy Policy
What we collect, why we collect it, and the control you have.
Last updated: 2026-08-22
1. Controller and scope
Probatus operates this platform and processes personal data under the GDPR and the Brazilian LGPD. This policy covers accounts, review activity and payments.
2. Data we collect
Account data (name, email, institution, country, ORCID), professional data (disciplines, keywords, price, capacity), activity data (requests, invitations, reviews, ratings, reputation events), financial data (ledger entries, payouts, payment status) and technical logs.
3. Manuscripts
Manuscript files are stored in private storage and are accessible only to the requesting editor and reviewers with an accepted invitation, through short-lived signed links.
4. Legal bases
Performance of the contract (running the marketplace), legal obligation (tax and accounting records), and legitimate interest (fraud prevention, platform integrity and security).
5. Processors
Supabase (database, authentication and storage) and Stripe (identity verification, payments and payouts). Payment credentials are handled by Stripe and never stored by Probatus.
6. Retention
Account data is kept while the account is active. Financial records and verified review records are retained for the period required by law and for verification integrity, in anonymized form after account closure.
7. Your rights
You can access, correct, export and request deletion of your data from the privacy section in Settings. Export returns a machine-readable JSON file. Deletion anonymizes your profile while preserving the accounting and verification records the law requires.
8. International transfers
Data may be processed outside your country by the processors listed above, under standard contractual clauses.
9. Security
Row-level security on every table, role separation, server-side business rules, private storage and encrypted transport.
10. Contact
Privacy requests can be sent through the contact page.