Privacy Policy

The controller of your personal data is Eluctari B.V., registered with the Dutch Chamber of Commerce (KVK) under number 84191554, located at Laan van Meerdervoort 2H, 2517 AJ Den Haag, The Netherlands.

For any question or request about your personal data, email info@referee-project.com.

Account data. When you create an account we process your email address, your name and, if you sign in with Google, the name, email address and profile picture Google shares with us. Authentication is provided by Clerk. Our own databases do not store your email address; they refer to you by an account identifier. We use this data to run your account and control what you may access. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).

Role and profile identifiers. Your account may carry a role (for example hunter, sponsor or reviewer), which we assign, and, where applicable, an ORCID iD, an organisation and its ROR identifier, or a funder identifier, which we associate with your account. We use them to decide which features you can use. Legal basis: performance of contract.

Papers and evidence you upload. We store the PDF you upload, the text extracted from it, file fingerprints (hashes), the analysis results, and a record of the consent you gave at upload (the consent version, the time, your rights attestation and the AI provider you agreed to). We use this to analyse the paper and show you the results. Legal basis: performance of our contract with you. Your per-upload consent authorises us to send that document to the named AI provider (Article 6(1)(a) GDPR).

Personal data inside papers. A paper can itself contain personal data about other people, such as its authors. You cannot consent on their behalf, so we process such data on the basis of our legitimate interest in analysing the methods of scholarly research (Article 6(1)(f) GDPR), and only to analyse the paper. We do not profile the people named in a paper. Do not upload documents containing personal data that is not part of the published research, and in particular no identifiable health, genetic or other sensitive data about individuals, such as unpublished patient records.

Where data we did not collect from you comes from. Besides what you give us directly, we obtain personal data from the documents users upload and from published bibliographic records at Crossref and Unpaywall. This is mainly the names, identifiers (such as ORCID iDs) and affiliations of the people who wrote or are named in the research, but it can include any other personal data an uploaded document contains.

Bounty activity. If you take part in bounties, we store the bounties you create, the claims, submissions, reviews and appeals you make, and the text you write in them, linked to your account identifier. Legal basis: performance of contract.

Technical and security data. Our servers and hosting providers process IP addresses and request details to deliver the site and protect it from abuse. To limit how often public lookups can be made, we store a keyed, one-way hash of your IP address (never the address itself) for 60 seconds. To limit uploads, we store a one-way hash of your account identifier for one hour. Server logs, which can contain IP addresses, are kept for 30 days. Legal basis: our legitimate interest in running a secure, reliable service (Article 6(1)(f) GDPR).

Information about paper authors. To identify papers we retrieve published bibliographic metadata, such as author names and ORCID iDs, from Crossref. This is public scholarly information that we use only to describe the papers analysed. Legal basis: our legitimate interest in accurately identifying the research we analyse.

An email address is required to create an account; without one we cannot provide an account. Everything else is optional: you choose whether to upload papers, take part in bounties or link an ORCID iD. If you do not consent to AI processing at upload, we cannot analyse that document. No law requires you to give us any personal data.

When you consent at upload, the content of your paper or evidence is sent to Google's Gemini AI service, which analyses it for methodological weaknesses. No other AI provider processes your uploads. If we want to use another provider, we will ask for your consent before it processes your content and update this policy first.

The analysis produces findings about research papers, not about you. It is experimental, and we make no decisions based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR).

We use these service providers, who process personal data on our behalf (except where noted):

• Clerk (United States) — account sign-in and authentication, including sign-in emails.
• Vercel (United States) — hosting of the website.
• Oracle Cloud — our application servers and database, located in Amsterdam.
• Cloudflare (United States) — network security and delivery for our API.
• Upstash (United States) — rate limiting: pseudonymous identifiers derived with a keyed hash, request counters and their expiry times, deleted within one hour.
• Google (United States) — Gemini AI analysis when you consent. If you choose to sign in with Google, Google also handles that sign-in under its own privacy policy, as an independent controller of your Google account.

We do not currently process payments. Before we enable any paid feature, we will name the payment provider here and update this policy.

Our servers send Crossref and Unpaywall a paper's DOI or bibliographic details to identify it. Those requests never include your account identifier or your IP address, although bibliographic details can themselves name the paper's authors. We do not sell personal data, and we do not share it with advertisers.

The providers marked United States may process your data there. Each such transfer relies on the provider's certification under the EU–US Data Privacy Framework or, where a provider is not certified, on the European Commission's Standard Contractual Clauses in our data processing agreement with it. You can request a copy of the safeguards that apply to any provider by emailing info@referee-project.com.

• Account data: for as long as your account exists.
• Uploaded papers and evidence: until the analysis or dispute they belong to is finally resolved, plus 90 days. We then delete the PDF and its extracted text.
• Minimal scientific provenance — record identifiers, analysis outcomes and file fingerprints — is kept indefinitely, so that published results stay verifiable and cannot be silently altered. It contains no paper text, name or email address. Legal basis: our legitimate interest in the integrity of research assessments (Article 6(1)(f) GDPR); you can object to it.
• Bibliographic records of analysed papers — title, DOI, and the authors' names, ORCID iDs and affiliations: for as long as the analysis results are kept. They describe published research and are not stored with the account identifier of whoever uploaded the paper.
• Records of the consent you gave at upload: for as long as that upload's provenance is kept, so we can show the processing was authorised. They are linked to you only through a pseudonymised identifier, which can no longer be tied to your account once we erase it.
• Bounty records: while the service operates, or until you ask us to erase them.
• Server logs: 30 days.
• Rate-limiting data: at most one hour.

We use only the cookies needed for you to sign in and stay signed in, which are set by our authentication provider, Clerk. We do not use analytics, advertising or tracking cookies. Your browser's local storage keeps a few interface preferences on your own device, such as which parts of a flaw tree you expanded. Our fonts are served from our own site, so loading a page does not contact third-party font services.

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time; this does not affect processing that already took place.

To delete your account or exercise any of these rights, email info@referee-project.com. We respond within one month.

When we erase your account, we delete your account data and remove your account identifier from our records, including your bounty activity. What remains is the scientific provenance and the bibliographic records described in section 6, which then hold nothing we can use to link them back to your account. Server logs that mention your account expire on their normal 30-day schedule.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

You must be at least 16 years old to create an account. We do not knowingly process data of younger children.

Your browser connects to our website over encrypted HTTPS, and our website reaches our servers over authenticated, encrypted connections. Our database does not accept connections from the internet, and we pseudonymise identifiers where the analysis does not need them.

We will update this policy when our processing changes and show the date of the latest version at the top. Material changes will be announced on the site before they take effect. See also our Terms of Service.