Privacy Policy

Consortium e-Learning Network Pvt. Ltd. (“we”, “us”) operates RevuMate AI and is the data controller — or, under India’s Digital Personal Data Protection Act, 2023, the data fiduciary — for the personal data described here.

This policy covers the RevuMate AI platform and the reviewer portal within it. It does not cover the public websites of the individual journals, which publish their own notices, nor any third-party site we link to.

We will update this notice when the platform or the law changes. The date at the top of this page tells you which version you are reading, and we encourage you to look at it periodically.

Where a change materially affects your rights, we will notify account holders by email or in the platform before it takes effect, rather than quietly reposting the page.

Everything below is either given to us by you, generated by your use of the platform, or supplied by an editorial office that nominated you as a reviewer. We do not buy personal data, and we do not scrape it.

Identification and account data

• Name, email address, role and account status.
• Affiliation and country, as given at registration.
• A password, stored only as a scrypt digest. We cannot read your password and will never ask you for it.
• Where you sign in with Google, the fact that you do so and the email address Google confirms. We never receive your Google password.
• Date of account creation and timestamp of last sign-in.

Reviewer profile

Optional, and entirely in your hands — the portal works without any of it, though editors use it when choosing reviewers:

• Designation, affiliation, years of experience, subject expertise, phone number and country.
• Links you choose to add: institutional page, personal page, ORCID, Google Scholar, LinkedIn.
• A CV and a photograph, if you upload them.
• A reviewer code, issued once by the editor who accepts your first application.

Submission and review records

• Manuscripts, their files and their metadata.
• Applications you make to journals, and the decision on each.
• Invitations sent to you, your answer and the date of it.
• Reviews you submit: the scores for novelty, methodology and clarity, your written comments and your recommendation.
• Certificates and empanelment letters issued to you, and your tier, points and reward redemptions.
• Editorial notes that staff record about a reviewer.

Communication records

Correspondence relating to submissions: messages exchanged with editors through the platform, and notifications sent to you.

Technical data

• An audit log of consequential actions, recording who acted, in what role, on what, when, and the IP address the request came from.
• A mail log of platform email: recipient, subject, time and whether it was delivered. We do not store the message body in this log.
• Ordinary server logs — browser, device and usage data — kept briefly for diagnosis and abuse prevention.

Where you are an editor or a reviewer, you will handle manuscript records containing other people’s personal data. You are bound by the confidentiality obligations in our Peer Review Policy when you do.

We process personal data only for the purposes below. Where the GDPR applies the legal basis is named; where the DPDP Act applies, processing rests on your consent or on a legitimate use recognised by that Act.

• Service provision — managing submissions, reviews, decisions and publication, and running your account. Performance of a contract.
• Communication — answering enquiries, issuing invitations and reminders, and keeping you informed about your submissions. Performance of a contract and legitimate interests.
• Recognition — issuing certificates and letters, and maintaining the leaderboard and rewards ledger. Legitimate interests, and your consent for the public elements.
• Improvement and maintenance — keeping the platform working, secure and useful. Legitimate interests.
• Security, integrity and audit — the audit log, abuse prevention and investigating publication-ethics concerns. Legitimate interests and legal obligation.
• Legal compliance — meeting regulatory duties and responding to lawful requests. Legal obligation.

We use the minimum necessary to keep you signed in and to remember a couple of display choices. We set no advertising or cross-site tracking cookies.

Strictly necessary cookies

• Session cookie. Set by our server when you sign in, marked http-only so no page script can read it, and cleared when you sign out. This cookie is what the platform cannot work without.

Local storage on your own device

These never reach our server. They are preferences held in your browser, and clearing your browsing data removes them:

• Your light or dark theme choice for these public pages.
• Small interface preferences, such as whether a list shows as cards or a table.

Signing in with Google involves cookies set by Google on their own domain, governed by Google’s privacy policy rather than this one.

RevuMate AI uses Google’s Gemini API for several editorial features. We would rather be specific than reassuring, so here is exactly what is sent.

• Reviewer matching. A manuscript’s title and abstract, to produce a ranked shortlist of candidate reviewers.
• Manuscript summaries. A manuscript’s title and abstract, to draft a summary, keywords and a note of the methodology.
• Decision letters. The manuscript title, the author name, the editor’s decision and the reviewers’ recommendations and comments, to draft a letter the editor then edits and sends.
• Editorial assistant. The editor’s own question, together with the record they are looking at when they ask it.

Manuscript files are never sent to any AI service. Reviewer profiles, CVs and photographs are never sent. A reviewer’s identity is not disclosed to the AI except where their name appears in the decision-letter prompt described above, which is used to draft a letter for the editor and is not passed to the author.

Reviewers must not put manuscript content into public AI tools; section 8 of the Reviewer Guidelines explains why.

We disclose personal data only as set out here, and only as much as the recipient needs.

Internal teams

Editorial and support staff, for managing the service and assisting users. Access follows the role model: a role that cannot see a journal’s manuscripts cannot retrieve them.

Within the editorial process

• Editors and editorial managers of the journals you have applied to or review for see your profile, your history and your reports.
• Peer reviewers receive the manuscripts assigned to them.
• Authors receive your report, anonymised. Your identity is not disclosed to them unless the journal operates open review or you ask in writing to be named.
• Your name, tier and standing appear on the leaderboard visible to signed-in users of the platform. Ask us and we will remove you from it.

Service providers and connected systems

• Google LLC — the Gemini API, as set out in section 6, and Google Sign-In where you choose to use it.
• Our hosting and database provider — the infrastructure the platform runs on, which holds the data at rest.
• Our email relay — to deliver invitations, reminders and notices.
• A paired manuscript-management system, where the publisher operates one. Manuscripts and reviewer assignments arrive from it, and when you submit a review we notify it that the review has been submitted on that manuscript. This is a disclosure to the publisher’s own system, over an authenticated channel, not to the public internet.

Others

• An author’s or reviewer’s institution or funder, where a publication-ethics investigation requires it.
• Legal authorities — a court, regulator or law-enforcement body, where we are legally obliged to respond or must act to protect our rights.
• A successor entity, if the business or a journal portfolio is transferred. You would be told before it took effect.

A certificate issued to you carries a QR code. Anyone you show the certificate to can scan it, which is the point of it — so treat a certificate as a document you are publishing about yourself.

We use technical and organisational measures to guard against unauthorised access, alteration, disclosure and destruction. Specifically:

• Passwords are stored only as scrypt digests and are never returned by any API.
• Sessions live in http-only cookies. No credential or token is kept in browser storage where a script could read it.
• Access follows the role model, enforced on the server rather than merely hidden in the interface.
• Traffic is encrypted in transit, and the database is access-controlled.
• Administrative action is logged, including signing in as another account.

No system is perfectly secure. If a breach is likely to affect your rights, we will tell you and the relevant authority within the time the law requires. If you think you have found a vulnerability, please write to info@stmjournals.com rather than disclosing it publicly, and we will work with you.

We keep personal data only as long as the purposes above require, unless a longer period is required or permitted by law. In practice:

• Account and profile — for as long as your account is open, then deleted within 90 days of closure, apart from what section 10 explains we keep.
• Reviews and decisions — kept as part of the permanent editorial record of the manuscript.
• Certificates and empanelment letters — kept so they remain verifiable, which is what makes them worth anything.
• Messages and notifications — three years from sending.
• Mail log — two years, for delivery disputes.
• Audit log — five years, as a security and governance record.
• Server logs — 90 days.

Where a period is longer than a purpose requires — an open ethics investigation, a legal claim — we keep the data for that purpose only, and nothing else.

Subject to the law that applies to you, you may ask us to do any of the following. Where the DPDP Act applies you have the rights to access, correction, erasure, nomination and grievance redressal; where the GDPR applies you also have the rights to restriction, portability and objection.

• Access a copy of the personal data we hold about you.
• Correct anything inaccurate or incomplete — much of it you can edit yourself in your account.
• Erase your data. Note the limits below: the editorial record of a review that has been acted on cannot simply be deleted.
• Restrict or object to processing based on legitimate interests.
• Receive your data in a portable, machine-readable form.
• Withdraw consent at any time, where processing rests on consent.
• Nominate someone to exercise your rights if you die or become incapacitated.
• Complain to us, and then to a regulator.

How to exercise them

1. Write to info@stmjournals.com from the address on your account, saying what you want.
2. We may ask for enough information to be sure it is you — we will not hand your record to somebody else.
3. We answer within 30 days. If a request is complex we will tell you, and why, before that runs out.

Unhappy with our answer? In India, complain to the Data Protection Board of India. In the EEA or the UK, complain to your local supervisory authority. We would rather you came to us first.

We are established in India and the platform is operated from there. Your information may be transferred to, and held on, computers outside your state, province or country, where data protection laws may differ from those in your own jurisdiction. Some of the providers in section 7 — Google in particular — process data outside India, including in the United States and the European Union.

Where personal data protected by the GDPR or the UK GDPR is transferred outside those jurisdictions, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, as applicable. Write to info@stmjournals.com for details of the safeguards covering a particular transfer.

RevuMate AI is a professional platform for researchers and editorial staff. It is not directed at children, and we do not knowingly create accounts for anyone under 18. Under the DPDP Act we do not process a child’s personal data without verifiable parental consent, and we do not track or advertise to children at all. If you believe a child has registered, tell us and we will remove the account.

Questions, requests and complaints about privacy go to the editorial office:

Our Terms & Conditions govern your use of the platform generally, and our Accessibility Statement covers access to it.