Summary
Peer Reviews is run by Metascience Systems Ltd. We use personal data to run peer review: to receive manuscripts, find and invite reviewers, collect reviews, and publish work when authors ask us to.
The points that matter most:
- Published work is public and permanent. If an author chooses publication, the article, author names, affiliations, verified ORCID iDs and the corresponding author’s email address appear on our website and are registered with Crossref. We can correct details, but we can’t usually remove published work.
- Nothing is published unless the author chooses. If the author keeps the work private, or doesn’t answer, the manuscript and its reviews stay private.
- Reviews are anonymous unless the reviewer chooses to sign. A signed review shows the reviewer’s name only. Authors are never told who an anonymous reviewer is.
- AI tools help us, but people make every decision. AI checks manuscripts, helps find suitable reviewers and checks reviews. Manuscripts and reviews are sent to our AI provider, which doesn’t use them to train its models. AI is part of how the service works, so authors can’t opt out of it.
- We look for reviewers on the open web. If you’re a researcher, we may find your published work and professional details and consider you as a reviewer. You can ask us to stop contacting you.
- We don’t sell personal data, and our website uses no analytics or advertising trackers.
- You have rights over your data, including to see it, correct it and object to how we use it. Email hello@peer-reviews.co.uk.
Who we are
Peer Reviews is run by Metascience Systems Ltd, a private limited company registered in England and Wales, company number 17376934. Our registered office is 15 Bedford Court, Grena Road, Richmond, TW9 1XT, United Kingdom.
We are the controller of your personal data. That means we decide how and why it is used, and we are responsible for looking after it. In this notice, “we”, “us” and “our” mean Metascience Systems Ltd.
- Email: hello@peer-reviews.co.uk
- Post: the registered office address above
- ICO registration number: [to be added]
Who this notice covers
This notice covers everyone whose personal data we handle through peer-reviews.co.uk and its subdomains. Many people fit more than one group, so read every section that applies to you:
- Website visitors
- Authors, including co-authors named on a submission
- People who pay for our services, including finance contacts at institutions
- Reviewers who register with us
- Researchers we identify as possible reviewers
- Reviewers we invite, and reviewers who review for us
- Other people: those suggested or excluded as reviewers, people who contact us, and people mentioned in submitted work
The sections after those apply to everyone: what we publish, how we use AI, who we share data with, how long we keep it, and your rights.
1. Website visitors
When you visit our website, our servers record technical information: your IP address, browser type, the pages you request and when. We use this to run the website, keep it secure and investigate problems.
Our forms use Cloudflare Turnstile to check that you are a person rather than an automated program. Turnstile processes your IP address and information about your browser and device for that purpose only.
We use only the cookies our website needs to work, and no analytics or advertising trackers. See Cookies below.
Legal basis: legitimate interests. We need to run a secure, working website.
2. Authors and co-authors
If you submit a manuscript
The person who submits is the corresponding author.
| What we collect | Why | Legal basis |
|---|---|---|
| Your name, email address, phone number (optional) and ORCID iD, which you verify by signing in to ORCID | To identify you, contact you about your submission and credit you correctly | Contract |
| Your institutions: name, department, city, country and ROR identifier | To record your affiliations accurately | Contract |
| Your manuscript and supporting files, title, abstract, subject, article type, and links to earlier versions and data repositories | To review your work, and publish it if you choose | Contract |
| Statements about ethics approval, identifiable data, funding and competing interests | To assess the work and, if published, tell readers | Contract |
| Reviewers you suggest, and people you ask us to exclude | To help us choose reviewers | Contract |
| Your billing details, if you pay personally | To invoice you and keep accounts | Contract; legal obligation |
| Your agreement to our terms, with the version you agreed to and when | To keep a record of what was agreed | Legitimate interests |
| Your choice about publication, and our correspondence with you | To carry out your instructions | Contract |
“Contract” means we need the data to provide the service you asked for under our Terms and Conditions.
Who sees it. Reviewers we invite see your manuscript and the details submitted with it, including author names, affiliations and competing interests statements. They don’t see your phone number, the reviewers you suggested or the people you asked us to exclude. Our AI tools also process your submission (see How we use AI).
We never publish your phone number. If you choose publication, see What we publish for what becomes public.
If someone named you as a co-author
The corresponding author gives us each co-author’s name, email address, affiliations, position in the author list and contribution roles, and sometimes an ORCID iD.
When a manuscript is submitted, we email each co-author we have an address for. The email tells you that you’ve been named, who named you, and how to contact us if anything is wrong. If you weren’t involved in the work, tell us at hello@peer-reviews.co.uk and we’ll act on it.
We use your details to record authorship accurately and, if the work is published, to credit you. We only publish an ORCID iD once its owner has verified it by signing in to ORCID.
Legal basis: legitimate interests. Accurate authorship matters to you and to the research record, and the email gives you a chance to object.
3. People who pay for our services
Usually an author’s institution pays. After submission, our checkout asks for billing details; we then send an invoice by email and are paid by bank transfer. We don’t take card payments.
We collect the billing details entered at checkout or given to us for an invoice: name, organisation, job title, billing address, email address, phone number and purchase order numbers. We also keep invoices and records of payments received. If you are a finance contact at an institution, this is the data we hold about you.
Why: to invoice, take payment and keep our accounts.
Legal basis: contract, where you are the customer; legitimate interests, where you act for an institution; and legal obligation, because company and tax law require us to keep accounting records.
4. Reviewers who register with us
When you register as a reviewer, we collect your name, email address, ORCID iD (verified through ORCID sign-in), career stage, website, institution, city and country. We also record your choices about emails and which version of our terms and this notice you agreed to.
We email you a link to confirm your address. If you don’t confirm within 7 days, we delete your registration details. We keep only your name and email address, for up to 3 years, so that a later registration or invitation doesn’t create a duplicate record.
Why: to consider you for reviews in your field and contact you about them. Our AI tools compare your expertise with new manuscripts (see How we use AI).
Legal basis: contract. You asked to join our pool of reviewers, and we need this data to consider you.
5. Researchers we identify as possible reviewers
To find the right reviewers for each manuscript, we look for researchers with relevant expertise, including people who have never contacted us. If you are a researcher, this may include you.
What we collect: your name, professional email address (where it is published or someone gives it to us), institution, research areas and publications, and links to the pages where we found this. We also record how well your expertise matches the manuscript, why, and whether you might have a conflict of interest with its authors.
Where it comes from:
- Public sources, found by AI-assisted web search. These are mainly scholarly: published papers, institutional web pages, public ORCID records and scholarly databases. Other public web pages may also be used.
- Authors who suggest you as a reviewer.
- Reviewers who decline an invitation and suggest you instead.
- Our own records, if you have registered or reviewed with us before.
Why: to find qualified, independent reviewers for a specific manuscript. We also use it to check for conflicts of interest and to avoid anyone the authors asked us to exclude.
Legal basis: legitimate interests. Peer review depends on finding suitable experts, and researchers expect to be approached to review in their field. We use only professional information, and only to decide whether to invite you.
Profiling. Judging how well your expertise fits a manuscript is profiling. It never leads to a decision with legal or similarly significant effects for you. The only outcome is that our editor, a person, decides whether to invite you. We never invite anyone automatically at an email address we have guessed.
How we tell you. If we invite you, the invitation explains how we found you and links to this notice. If we don’t invite you, we delete your details within one month of finding them. Emailing every researcher we consider, just to say so, would be intrusive, so this notice is how we tell them.
We don’t use details found this way to send you marketing.
Your right to object. You can object at any time to our considering you as a reviewer. Email hello@peer-reviews.co.uk and we will stop. We’ll keep only a note of your name and email address, so that we don’t find and consider you again.
6. Reviewers we invite, and reviewers who review for us
| What we collect | Why | Legal basis |
|---|---|---|
| Your name, email address and ORCID iD, if you verify it | To invite you and identify you | Legitimate interests; contract once you accept |
| Your response to an invitation, and any reason you give for declining | To manage the review | Legitimate interests |
| People you suggest instead: their names, email addresses and your reasons | To consider them as reviewers (see section 5) | Legitimate interests |
| Your conflict-of-interest declaration | To check the review is independent | Contract |
| Your review: scores, comments for the authors, confidential comments for the editor, attachments, and any concerns about misconduct or plagiarism | To provide the review to the authors and assess the work | Contract |
| Whether you choose to sign your review | To publish it the way you chose | Contract |
| The bank details we need to pay you, and a record of the payment | To pay you and keep accounts | Contract; legal obligation |
Your invitation contains a personal link to your review pages. Anyone who has it can open them, so please don’t forward it.
Who sees what:
- The authors receive your comments for them, without your name.
- Your confidential comments are seen only by our editor and our staff. They are never shared with authors or published.
- Your conflict-of-interest declaration is never published.
- Our AI tools check reviews, including confidential comments (see How we use AI).
If the author chooses publication, your review is published with the article. It is anonymous unless you chose to sign it, and a signed review shows your name only.
We delete your bank details once your payment has been made. We keep the payment record (who was paid, how much and when) for our accounts.
7. Other people
People suggested or excluded as reviewers
Authors may suggest reviewers, or ask us not to use certain people. Suggested reviewers are treated as possible reviewers (see section 5).
If an author asked us to exclude you, we record your name or organisation only to make sure we don’t invite you. We keep it confidential, and reviewers never see it. We don’t tell you, because that would reveal confidential information about an unpublished manuscript. Legal basis: legitimate interests, in running a fair review.
People who contact us
If you email us, we keep your name, email address and message so we can reply and keep a record of what was said. Legal basis: legitimate interests.
People mentioned in submitted work
Manuscripts and reviews sometimes contain information about other people. Authors must not include information that identifies research participants unless they have ethics approval and the participants’ consent. If we find identifying information without these, we will ask the author to remove it, or delete it ourselves.
Concerns about research integrity
Reviewers may raise concerns about possible misconduct or plagiarism. Our editor and staff look into every concern. If one seems plausible, we raise it with the authors and, by default, refer it to the research integrity or ethics office at the authors’ institution.
Legal basis: legitimate interests, in protecting the integrity of the research record. We share only what the institution needs to look into the concern.
What we publish, and why it is permanent
We publish only when the author chooses publication after receiving their reviews. If the author keeps the work private, or doesn’t answer, nothing about the manuscript or its reviews is published.
When work is published, we make public:
- the article and its supporting files, with title, abstract, subject, article type and dates
- author names, affiliations and contribution roles
- ORCID iDs, but only those the author has verified by signing in to ORCID
- labels showing whether we have confirmed each author’s email address and ORCID iD
- the corresponding author’s name and email address
- funding and competing interests statements
- the reviews: anonymous unless the reviewer chose to sign, in which case the reviewer’s name is shown
We never publish: phone numbers, reviewers’ confidential comments, reviewers’ conflict-of-interest declarations, suggested or excluded reviewers, payment details, or ORCID iDs nobody has verified.
Licence and DOIs. Published articles carry a Creative Commons Attribution licence (CC BY 4.0), so anyone may copy, share and adapt them. We register each published article and its reviews with Crossref, which gives them permanent identifiers (DOIs). The metadata we send includes titles, author names, affiliations, verified ORCID iDs and the licence. Crossref makes it openly available, and indexing services such as Google Scholar copy it. Crossref’s own privacy policy covers what it does.
Why it is permanent. The research record depends on published work staying available and unchanged. So we don’t delete published articles or reviews. We correct factual errors, and we mark corrections and retractions on the article’s page. We remove content promptly when the law requires it. We can’t recall copies others have made under the CC BY licence or from Crossref’s metadata, but we will update our own pages and Crossref records.
Legal basis: contract. Publication is a service the author chooses under our terms, and reviewers agree to publication of their reviews under theirs. For co-authors, it is legitimate interests: crediting the people who did the work.
How we use AI
AI tools help our editor, but they never make decisions and never write reviews. Human reviewers write every review.
What AI does:
- checks manuscripts for possible problems and flags them to our editor
- finds and ranks possible reviewers, including by searching the web (see section 5)
- checks for conflicts of interest between reviewers and authors
- checks reviews for quality and possible problems
What we send to it: the full text of manuscripts and supporting files, reviews (including confidential comments), and information about possible reviewers.
Our AI provider is Anthropic, which provides the Claude models through its business API. Under its commercial terms, Anthropic:
- doesn’t use our data to train its models
- deletes what we send, and what the model returns, within 30 days
- may keep data for up to 2 years if its automated systems flag it as possibly breaking its usage policy
Anthropic processes data in the United States (see International transfers).
People decide. Our editor reads what the AI tools report alongside everything else, and makes every decision: whether to send a manuscript for review, whom to invite, and what happens next. AI output is never sent to authors or reviewers. No decision with legal or similarly significant effects is made about anyone by automated means alone.
No opt-out. AI checks are part of how our service works, so every submission is processed this way. If your institution or funder doesn’t allow unpublished work to be processed by AI tools, please don’t submit.
Legal basis: contract, for authors and reviewers; legitimate interests, for possible reviewers.
Who we share data with
We don’t sell personal data, and we don’t share it for advertising.
Our team. Our editor, and any staff or contractors who need the data to do their work. They are bound by confidentiality.
Other people in the review. Reviewers see manuscripts and author details as described in section 2. Authors see the reviews of their work, without anonymous reviewers’ names.
Service providers that handle data on our behalf, under contract and only on our instructions:
| Provider | What they do for us | Where |
|---|---|---|
| IONOS | Hosts our website and our server, and our email inbox | UK and Europe |
| Resend | Sends our emails | Worldwide, including the US |
| Cloudflare | Checks that form users are human (Turnstile) | Worldwide, including the US |
| Anthropic | Provides our AI tools | US |
Independent organisations. These decide for themselves how to use what we share, under their own privacy policies:
- ORCID, when you sign in with ORCID or we check an ORCID iD
- Crossref, which registers DOIs for published work and makes its metadata public
- indexing services and the public, for published work
- research institutions, when we refer a research integrity concern (section 7)
- our bank and accountants, for payments and accounts
- professional advisers, regulators, courts and the police, where the law requires it or to protect our legal rights
- a buyer or successor, if our business is sold or restructured, under confidentiality
International transfers
Some of our providers process data outside the UK, mainly in the United States. When personal data leaves the UK, we make sure it stays protected:
- To the European Economic Area: UK law recognises these countries as giving adequate protection.
- To the United States: we use the UK–US data bridge where the provider is certified under it. Otherwise we use contract clauses approved by the UK Information Commissioner.
Published work, and the metadata we register with Crossref, can be read anywhere in the world. Crossref and ORCID are based in the US; sending them details is part of the service authors ask for.
To find out which safeguard applies to a provider, email hello@peer-reviews.co.uk.
How long we keep your data
Most records are kept for 6 years after a manuscript is closed: the period in which legal claims can usually be brought, and long enough to look into later questions about a review. A manuscript is closed when we send the authors their final feedback, or publish the work.
| Information | How long we keep it |
|---|---|
| Published articles and reviews | Permanently, as part of the research record |
| Manuscripts, reviews, confidential comments, conflict-of-interest declarations, excluded reviewers and integrity concerns | 6 years after the manuscript is closed |
| Author and co-author details, invitations, responses and reviewer suggestions | 6 years after the manuscript is closed |
| Invoices and payment records | 6 years after the end of the financial year they relate to |
| Reviewers’ bank details | Deleted once the payment has been made |
| Emails and other correspondence | 6 years after our last contact |
| Registered reviewers’ details | Until 3 years after your last activity with us |
| Unconfirmed reviewer registrations | 7 days, after which we keep only your name and email address, for up to 3 years |
| Possible reviewers we don’t invite | Deleted within 1 month of being found |
| Notes that you have objected, or don’t want to be contacted | As long as needed to respect your wishes |
| Unsubscribe records | Indefinitely, so we never email you marketing again |
| Server logs | Up to 3 months |
| Backups | Deleted data can remain in backups until they are overwritten, within 3 months |
When a period ends, we delete the data or make it anonymous.
Your rights
Data protection law gives you these rights. They apply to everyone, whether or not you have agreed to our terms.
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to correct data that is wrong or incomplete.
- Deletion: ask us to delete your data.
- Restriction: ask us to pause using your data, for example while we check it is correct.
- Objection: object to our use of your data where we rely on legitimate interests.
- Portability: ask for data you gave us in a format you can reuse elsewhere.
- Withdraw consent: where we rely on your consent, such as for marketing, withdraw it at any time.
Your right to object. You can object at any time to our using your data based on legitimate interests. That includes our considering you as a possible reviewer, which involves profiling. We will stop unless we have compelling reasons that outweigh your interests. You can also object to marketing at any time, and we will always stop.
Rights and published work. Some rights work differently for published articles and reviews. You can always ask us to correct inaccurate details. The right to deletion doesn’t usually apply to the research record, because the law protects keeping it for freedom of expression and information. But tell us if you have a concern and we will look at it carefully.
How to use your rights. Email hello@peer-reviews.co.uk. It is free. We may need to confirm who you are, for example by asking you to reply from the email address we hold. We will respond within one month. If a request is complex, we may take up to two more months and will tell you why.
Cookies
We use only cookies and similar storage that our website needs to work. Because they are strictly necessary, the law doesn’t require your consent for them. They:
- keep your place while you submit a manuscript and go through checkout
- remember your cookie choices
- protect our forms from automated abuse (Cloudflare Turnstile)
- let our own staff sign in to manage the website
We don’t use analytics, advertising or tracking cookies. If that changes, we will update this notice.
Emails we send
Service emails are part of running peer review: invitations, reminders, confirmation links, ORCID requests, notices to co-authors, feedback and invoices. They aren’t marketing. You’ll receive them while you are involved in a review, but you can object to being considered as a reviewer at any time.
Marketing emails tell people about our services. We send them only where the law allows:
- you have opted in, for example when registering as a reviewer
- you have used our services before and haven’t opted out
- you are a researcher and we are writing to your work email address about services relevant to your work
Every marketing email has an unsubscribe link, and unsubscribing never affects service emails. We don’t use details found when looking for reviewers to send marketing.
Legal basis: consent, where you opted in; otherwise legitimate interests, in telling people about our services.
Security
We protect personal data with measures suited to what we hold:
- encrypted connections to our website and server
- uploaded files scanned and checked before use
- confidential manuscripts and reviews kept on our own server, never on the public website
- access limited to people who need it
- personal links that are long and hard to guess
- regular backups
No system is perfectly secure. If a breach puts you at risk, we will tell you, and report it to the Information Commissioner where the law requires.
Children
Our services are for adults aged 18 or over. We don’t knowingly collect data about anyone younger. If we learn that we have, we will delete it.
Complaints
If you are unhappy with how we have used your data, please tell us first. Email hello@peer-reviews.co.uk; you don’t need to use any particular words. We will acknowledge your complaint, look into it and tell you the outcome.
You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113. If you live or work in the European Union, you can complain to the data protection authority there.
Changes to this notice
This version took effect on 2026-10-25.
If we make significant changes, we will email registered reviewers and authors with work in progress.