Paaplish

Privacy

What we store when you join, why, for how long, and your rights. In plain words.

Who we are

Paaplish is run by ScienceBacker AB (org. no. 556960-1585), Dalaresan 38 a 1303, 757 55 Uppsala, Sweden. ScienceBacker AB is the data controller: responsible for your personal data under the EU General Data Protection Regulation (GDPR). Questions about your data: contact@paaplish.com.

What we collect

What you type into our forms:

  • Reviewers: name, email, organization, department, country, current position, main research field and, if you give them, your institutional email, your ORCID iD, your ResearchGate and Google Scholar profile addresses, and your own description when you choose “Other”.
  • Editors and organizations: name, work email, organization, role, website, country, organization type, research field and your answers about your reviewer needs.
  • Beta access requests: first name, surname and email, from the form on our sign-in page.

We also record when you give your consent and whether you confirm your email addresses.

Our server keeps short technical logs (time, page, response code, IP address) to keep the service running and to stop abuse. We use no advertising or tracking cookies. The only cookies are sign-in cookies: for the closed beta, and for our own team’s admin pages.

Our forms carry Cloudflare Turnstile, which checks that a person, not a bot, is sending them. When you open a form, your browser loads it from Cloudflare and it looks at technical signals from your browser (such as how it runs a small task); usually you see nothing, sometimes a box to tick. Our server then asks Cloudflare whether the check passed. Apart from this, the site loads nothing from other companies.

We count visits to the site without cookies: how many people open it, open a sign-up form, press Send and sign up, per day (on the closed beta’s sign-in page, how many opened it, opened the request form, sent a request or signed in). To tell visitors apart, the server turns your IP address and browser name into a code with a key that is never saved and is replaced every day. We store that code, not your IP address, so it can’t be traced back to you or linked across days.

To protect the site, we keep a record of suspicious attempts: a failed sign-in, a request for an admin sign-in link, a form filled in by a bot, or too many requests in a short time. It holds the IP address, the browser name, the time and what was tried (such as the username or email address typed in).

Why, and on what legal basis

To build the Paaplish reviewer network, to understand the demand for reviewers, and to contact you about Paaplish as it develops. We rely on your consent (GDPR art. 6(1)(a)), which you give with the checkbox on the form and can withdraw at any time. We ask you to confirm your address within one week with the link in our email, so we know it is really you.

A beta access request is used only to answer it and to send you a sign-in if we approve it. That relies on our legitimate interest (art. 6(1)(f)) in answering the people who ask.

The technical logs rely on our legitimate interest (art. 6(1)(f)) in keeping the site secure and working, as does the record of suspicious attempts, and the visit counts on our legitimate interest in knowing whether the site and its forms work for the people who find them. We make no automated decisions about you.

How long

  • We keep your details until you withdraw, or until we close the interest list.
  • If you don’t confirm your address within one week, we may delete your registration.
  • Every email we send contains your personal link. Withdrawing through it deletes your details immediately. Encrypted backups are overwritten within 60 days.
  • If our team removes a registration or a beta sign-in, it stays in an internal trash for 30 days so that a mistake can be undone, and is then deleted. If you ask us to delete your data, we delete it from there at once.
  • We keep a beta access request until the closed beta ends, or until you ask us to delete it, which we do at once.
  • Technical logs are overwritten automatically, within a few weeks.
  • Visit counts are deleted after 90 days, and the record of suspicious attempts after 30 days.

Who sees it

Only the Paaplish team. We never sell your data. These suppliers process it on our behalf, under data processing agreements:

  • OVHcloud hosts our server and database, in the United Kingdom. The EU recognizes the UK as protecting personal data to the same standard (an adequacy decision).
  • Cloudflare protects the site against attacks and passes every visit on to our server, so it handles what you send us on the way; it also runs the bot check on our forms (Turnstile). It does so at its data centre nearest to you, in Europe for visitors in Europe. Cloudflare is a US company; transfers to the US are covered by the EU–US Data Privacy Framework.
  • Resend delivers our emails, from its EU region in Ireland.
  • Zoho hosts our mailboxes, in its EU data centres, if you write to us.
  • Backblaze stores our nightly backups, in its EU data centre in the Netherlands. They are encrypted on our server before they leave it, so Backblaze cannot read them.

Your rights

You can ask to see the data we hold about you and get a copy, have it corrected or deleted, restrict or object to its use, and withdraw your consent at any time; withdrawing doesn’t affect what we did before. Use the link in our email, or write to contact@paaplish.com. We answer within one month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the data protection authority where you live.

Last updated 6 November 2026.