Privacy Notice

We collect information about you when you visit the Service, contact us, submit a quote request, request a checklist or other downloadable resource, or interact with us by other means related to EditorialXML. Information may include:

• Identifiers and contact data. Name, title, institution, journal name, email, telephone or WhatsApp number, country, and ISSN, when you provide them — including when you request a checklist or similar lead-magnet download.
• Information about your project. Publication frequency, number of articles, number of issues to be processed, language, source format, required XML standard, estimated timelines, and any message or additional detail you include in the form.
• Attached files. If you choose to attach a sample (for example, PDF, Word, XML, or ZIP), we receive the file and associated metadata, such as the file name.
• Technical and usage information. IP address, browser type, preferred language, referring site, date and time of access, operating system, server logs, performance metrics, and error or failure data generated when using the website or form.
• Fraud-prevention and abuse-detection data. When the form uses Cloudflare Turnstile, Cloudflare may process technical signals related to your request to help us detect automated or abusive submissions.
• Account and transaction information. If you create an account or purchase a paid report or service, we may collect your account email, user and workspace identifiers, order details, purchased service, amount, currency, payment status, transaction identifiers, report-delivery information, and related support records. Payment-card information is collected and processed directly by our payment provider; we receive only limited payment and transaction information necessary to confirm and manage the purchase.
• Legal acceptance records and browser identifier. When you agree to the Terms of Service or acknowledge this Privacy Notice — for example, when you run a free validation, create an account, or complete a checkout — we record the versions and language of the Terms and Privacy Notice presented to you, content hashes, acceptance or acknowledgment timestamps, the related action, and associated account, browser, validation-request, or order identifiers. So that an acceptance made without an account can still be tied to the action it covered, we store a browser identifier: a randomly generated first-party value we place in a cookie named editorialxml_lid. That value is generated by us at random and is not derived from your device, browser configuration, or any other characteristic, so it is not a device fingerprint.

We do not intentionally collect precise geolocation. We may infer an approximate location from your IP address or the country you indicate in the form.

If during a contracted project you deliver manuscripts, metadata, images, or other editorial materials, that content will be handled under the applicable Service Agreement and, where relevant, additional confidentiality obligations.

Submitted XML and editorial files may contain scholarly article content and metadata, including author and contributor names, affiliations, identifiers such as ORCID, contact information, acknowledgements, funding information, conflict-of-interest disclosures, and other information included in the article.

The free JATS validator runs validation on our servers. We retain limited product analytics designed to minimize the collection of personal information (valid/invalid outcome, validation profile, approximate country when enabled, size and duration buckets, and normalized issue codes derived from validation). These issue codes are not device fingerprints. Browser or device signals used for abuse prevention and rate limiting are not stored in raw form.

By default, we retain content submitted through the free validator in encrypted form to improve EditorialXML products and services, including the development, training, testing, and evaluation of our own automated systems and models. You may turn this option off at any time in Data Controls (editorialxml.com/validator/data-controls). Turning it off affects future free validations: your files will still be processed to generate the validation result, but they will not be retained to improve or train EditorialXML systems. Content already retained may continue to be used to improve or train EditorialXML until the sample expires (generally within 180 days of storage) or is deleted earlier. To request deletion of eligible retained XML linked to your account or this browser, write to [email protected]. Deleting a retained sample does not undo model training that was completed before the deletion request.

The free validator is not intended for content containing directly identifiable patient information or other sensitive personal information. If we identify such information in retained content, we may delete the sample and exclude it from product-improvement or training datasets.

You should submit content only if you are authorized to process and upload it. Do not use the free validator for confidential peer-review materials or content whose submission, retention, or use for product improvement would violate confidentiality, copyright, licensing, embargo, or other contractual restrictions.

For unpublished, embargoed, or otherwise confidential XML, disable product-improvement retention in Data Controls (editorialxml.com/validator/data-controls) or use a private paid validation or professional-service flow.

Retaining encrypted XML does not mean it is automatically used in training. Retention and selection for training are separate steps. Including retained content in a training dataset requires an explicit, audited decision. Content that has been deleted, expired, withdrawn, identified as sensitive or otherwise restricted, or otherwise ineligible cannot be newly selected for training. New free samples are generally retained for up to 180 days; each retained sample is assigned an expiration date when it is stored. A later increase in the configured retention period does not extend samples already stored.

Each free validation also creates a legal acceptance record showing that you agreed to the Terms of Service and acknowledged this Privacy Notice for that validation. That record is described in the section “How long do we retain your information?” and is kept separately from any retained validator content, so deleting or disabling retention of validator content does not delete the acceptance record.

Paid validations and paid report exports are treated as private and excluded from model training: content from those flows is not retained as an improvement sample and is not used to train EditorialXML systems under this free-validator policy.

Optional explicit contributions accepted before Data Controls activation remain under the original consent terms that applied when they were accepted, including any agreed expiration and withdrawal method. We do not reinterpret or expand that legacy consent.

Authorized internal access to retained samples is logged without recording XML content. Files retrieved through internal access tools are not cached for reuse, and access is unavailable after expiration, withdrawal, or deletion.

Deleting a sample immediately removes the active encrypted record. Historical database backups may retain encrypted copies until our hosting provider’s backup-retention cycle completes. We do not promise immediate erasure from those historical backups.

We use your information for the following purposes:

• Operate the Service. Maintain the website, process quote requests, deliver checklist and other lead-magnet downloads, respond to inquiries, provide support, and communicate with you about your request or project.
• Evaluate and prepare proposals. Analyze the information and samples you send to estimate scope, complexity, and feasibility of an editorial project.
• Provide professional services. If you engage our services, we use the information needed to perform the agreed editorial XML production, validation, and delivery.
• Accounts, checkout, and paid reports. Create and manage accounts, process purchases, confirm payment status, deliver paid validation reports, and provide related customer support.
• Security and abuse prevention. Protect the Service, apply rate limits, verify legitimate requests, and detect fraudulent, deceptive, or illegal activity.
• Legal acceptance records. Record and evidence that the Terms of Service were agreed and this Privacy Notice acknowledged for a given action, correlate an acceptance made without an account to the browser that performed it, decide whether a newer version needs to be presented again, and establish, exercise, or defend legal claims about that agreement.
• Service and product improvement. Diagnose errors, understand general site usage, improve how the Service works and, for free-validator submissions subject to Section 1A and your Data Controls preferences, improve our products and automated systems.
• Legal compliance. Comply with legal obligations, enforce our Terms of Service (editorialxml.com/terms), and protect our rights and those of third parties.

We may send you communications related to your request, proposal, or project. We do not sell your personal information or use it for third-party targeted advertising.

We share or disclose your information only in the circumstances described below:

• Service providers. We share information with third parties that provide services necessary to operate EditorialXML, such as hosting, file storage, email delivery, security, fraud prevention, payment processing, and technical support. These providers may process personal information on our behalf and under our instructions. Certain providers may also process limited information for their own legal, regulatory, security, or fraud-prevention purposes, as described in their privacy notices.
• Corporate transfers. We may share information in connection with a merger, acquisition, reorganization, or sale of assets, subject to applicable legal safeguards.
• Protection of rights. We may disclose information when we believe in good faith that disclosure is reasonably necessary to protect our rights, those of third parties, or public safety.
• Authorities and legal compliance. We may disclose information to comply with law, a court order, or a valid legal request.
• With your consent. We may share information when you authorize us or expressly instruct us to do so.

Providers that help us operate the Service include Stripe (payment processing for paid reports and related purchases) and Cloudflare services used for the quote form (including Turnstile, R2 storage, and email sending). These providers process information as described above and in their own privacy notices.

We retain information only as long as reasonably necessary for the purposes described in this Notice, including handling quote requests, preparing proposals, providing contracted services, operating accounts and paid reports, operating the free validator under Section 1A, and complying with legal or contractual obligations.

We generally retain unsuccessful quote requests, checklist and other lead-magnet download records, and associated attachments for 12 months after our last communication about the request, unless you ask us to delete them earlier or we are required to retain them by law. Download links for checklist files generally expire after seven (7) days; link expiration does not, by itself, delete the underlying lead record. If a quote or lead leads to an active proposal or contracted project, we retain related information for the duration of that relationship and for a further period needed for administration, accounting, or dispute resolution.

Free-validator improvement samples retained under Section 1A are generally retained for up to 180 days from the date they are stored, unless deleted earlier in response to a deletion request. Limited product analytics for the free validator are generally retained for up to 180 days, unless a shorter retention period applies.

For paid guest validation reports, submitted XML is processed to generate the deliverable and is not stored as raw XML after that processing. We retain derived report artifacts (such as professional report HTML/JSON and related technical-report data) and order records as needed to deliver the report, support downloads and resends, and handle support, accounting, tax, fraud prevention, and disputes. Download links for generated paid reports generally expire after seven (7) days; when a link expires, further downloads through that link are refused. Link expiration does not, by itself, delete the underlying report artifacts or order records. Authenticated professional exports process submitted XML to generate and return the report in the response. The submitted XML is not retained after that processing, and the report content is not used for product improvement or model training. Paid guest and authenticated professional report content is not used for product improvement or model training under Section 1A.

Legal acceptance records. We record the versions and language of the Terms and Privacy Notice presented to you, content hashes, acceptance or acknowledgment timestamps, the related action, and associated account, browser, validation-request, or order identifiers. We retain these records as evidence of the agreements and notices applicable to your use of the Service and to establish, exercise, or defend legal claims, and for any longer period required by law. These records are append-only evidence: deleting an account or an order does not delete them, and the corresponding account or order reference is removed from the record instead. A browser identifier stored on such a record is a random first-party identifier (not a device fingerprint) and is retained on that same basis, separately from the cookie in your browser, which expires as described in the section “Use of cookies and similar technologies.”

Technical website logs are generally retained for up to 90 days for security, diagnostics, and abuse prevention, and may be kept longer when needed for an active security or legal investigation.

You may request deletion of your information by contacting us at [email protected], unless we are required to retain it by law or to resolve disputes.

We implement reasonable technical, administrative, and organizational measures to protect information against unauthorized access, use, alteration, or disclosure. Among other measures, we use infrastructure hosted with providers that have security controls, attachment validation, form rate limiting, and fraud-prevention verification when enabled.

No transmission or storage system is completely secure. We cannot guarantee absolute security, but we work to mitigate risks associated with the Service.

The Service is primarily intended for institutions, publishers, and professionals acting on behalf of an organization. We do not intentionally collect personal information from children under 13. If you believe that a child has provided us with personal information, contact us so that we can review the matter and, where appropriate, delete the information.

We may use cookies or other similar technologies strictly necessary for site operation, security, abuse prevention, and legal record-keeping — for example, when Cloudflare Turnstile verifies a quote form request.

One of those strictly necessary cookies is a first-party cookie named editorialxml_lid, which stores a randomly generated browser identifier. We use it only to correlate legal acceptance records — such as agreeing to the Terms of Service when you run a free validation — with the browser that performed the action, and to help locate free-validator content linked to this browser when you make a deletion or privacy request.

The identifier is a random value generated by us. It is not derived from your device or browser characteristics, it is not a device fingerprint, and it is not used for advertising, cross-site tracking, or profiling. The cookie is set only for editorialxml.com, generally expires no more than 400 days after it is set or refreshed, and you can delete it at any time in your browser. Deleting it does not delete legal acceptance records that were already created; a new random identifier is generated the next time one is needed.

We do not use cookies for personalized advertising or to build profiles for third-party commercial purposes. You may configure your browser to reject cookies, although some Service features — such as form submission — may stop working correctly.

We do not currently respond to browser Do Not Track signals. Where applicable law requires us to recognize a legally valid opt-out preference signal, we will process that signal as required by law.

If you are located in the European Economic Area, the United Kingdom, or Switzerland (collectively, “Europe”), applicable data protection laws may give you certain rights regarding your personal data, subject to exceptions provided by law, including rights to:

• request access to your personal data;
• request correction or deletion of your personal data;
• object to our use or processing of your personal data;
• request that we restrict our processing of your personal data;
• request portability of your personal data; and
• withdraw your consent at any time when processing is based on consent, without affecting processing carried out before withdrawal.

You also have the right to lodge a complaint with a competent supervisory authority. You may exercise these rights by contacting us at [email protected].

9.1. Legal basis for processing

Where European data protection law applies, we process personal information on the following bases, matched to purpose:

• Contract and pre-contractual steps. Taking steps at your request before entering into a contract, or performing a contract with you — for example, responding to a quote request or providing agreed professional services.
• Legal obligation. Compliance with a legal obligation that applies to us.
• Legitimate interests. Our legitimate interests in operating, securing, and improving the Service, including limited free-validator product analytics, keeping legal acceptance records and the associated browser identifier as evidence that our Terms of Service were agreed and this Notice acknowledged, and, under Section 1A, retaining free-validator content by default to develop, train, test, and evaluate our own automated systems and models, provided your rights and freedoms do not override those interests. You may object to this processing and manage future free-validator improvement preferences in Data Controls (editorialxml.com/validator/data-controls).
• Consent. Your consent, where the law requires it — including optional legacy free-validator contributions accepted under an explicit consent mechanism before Data Controls activation. Consent is not the basis we rely on for default free-validator retention under Section 1A.

9.2. International transfers

Because EditorialXML may be used from different countries, information we process may be stored or processed in the United States or other countries where we or our service providers operate. When we transfer personal data outside Europe, we take reasonable measures to protect it under this Notice and applicable law, including standard contractual clauses or other recognized mechanisms where appropriate.

You may request more information about safeguards applicable to international transfers by contacting us at [email protected].

Some U.S. state laws require informing residents about the categories of personal information we collect, how we obtain it, and with whom we share it. Over the past 12 months, we have collected the following categories of personal information, as applicable to your interaction with the Service:

• identifiers (such as name, email, telephone number, and online identifiers, including the browser identifier described in this Notice);
• professional or employment-related information (such as institution, title, journal, and ISSN);
• commercial information (such as details of a quote request, proposal, or paid order, where applicable);
• internet or other electronic network activity (such as website or form usage logs); and
• limited inferences (such as approximate location derived from IP address).

We collect this information from you directly, from your browser or device, and from service providers that help us operate the Service. We use it for the purposes described in the section “How do we use your information?” and share it with the categories of third parties described in “With whom do we share your information?”

We do not sell or share personal information for cross-context behavioral advertising within the meaning of applicable state laws. Depending on your state’s law, and subject to legal exceptions, you may have the right to request access, correction, deletion, or portability of your personal information, or to object to certain processing.

To exercise these rights, contact us at [email protected]. We will not discriminate against you for exercising your privacy rights.

We may update this Privacy Notice periodically. We will publish the revised version on this page and indicate the “Last updated” date. If we make material changes, we may notify you by email or other reasonable means. Changes apply prospectively from publication, unless we state otherwise.

If you have questions about this Privacy Notice or how we handle your information in connection with EditorialXML, contact us at [email protected]. For personal information for which Lynsoft LLC acts as controller under this Notice, you may contact us at that address. Processor or service-provider processing under a contracted professional service is governed by the applicable Service Agreement or Data Processing Addendum.