Last updated: July 17, 2026
Experts InfoTech (Pvt) Ltd. ("we", "us", "our") operates the xPaperFlow platform ("xPaperFlow", "the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, request a demo, or use the xPaperFlow service.
1. Information we collect
We collect the following categories of information:
Personal information you provide
- Account information: name, email address, phone number, organization, role, and password (hashed) when you create an xPaperFlow account or request a demo.
- Profile information: ORCID identifier, professional biography, subject expertise, reviewer history, and any other information you add to your profile.
- Manuscript and review content: manuscript files, cover letters, reviewer reports, decision letters, and editorial notes you upload or generate within the platform.
- Communications: messages you send us through the contact form, email, or other channels.
Information collected automatically
- Device and usage data: IP address, browser type and version, operating system, referring URL, pages visited, time spent on pages, and click patterns.
- Log data: authentication events, configuration changes, and audit trail entries generated as you use the Service.
- Cookies and similar technologies: see Cookies below.
Information from third parties
If your organization uses single sign-on (SSO) with xPaperFlow, we receive basic profile information (name, email, role) from your identity provider (e.g., SAML/OIDC). We may also receive bibliographic metadata from services you connect, such as ORCID or CrossRef.
2. How we use your information
We use the information we collect to:
- Provide, operate, maintain, and improve xPaperFlow.
- Process manuscript submissions, peer review, editorial decisions, and production tasks.
- Authenticate users, manage roles and permissions, and maintain security.
- Send you transactional notifications (manuscript status, review invitations, decision letters, production updates).
- Send you product updates, security notices, and administrative messages.
- Respond to your comments, questions, and customer support requests.
- Monitor and analyze trends, usage, and activities to improve the Service.
- Detect, prevent, and address fraud, abuse, security, or technical issues.
- Comply with legal obligations and enforce our terms.
3. Legal basis for processing
If you are in the European Economic Area (EEA), United Kingdom, or other jurisdiction with similar laws, we process your personal data on the following legal bases:
- Performance of a contract with you or your organization when you use the Service.
- Legitimate interests in operating, securing, and improving the Service, where these interests are not overridden by your fundamental rights.
- Consent where you have given clear consent (e.g., for non-essential cookies or marketing communications).
- Legal obligation where we need to comply with applicable laws.
4. Sharing of your information
We do not sell your personal data. We share information only as follows:
- Within your organization: manuscript and review content is shared with the journal's editors, reviewers, and production staff according to your organization's configuration.
- Service providers: trusted vendors who help us operate the platform (cloud hosting, email delivery, monitoring, support tools). These vendors are bound by confidentiality and data-processing obligations.
- Integrations: if you connect third-party services (ORCID, CrossRef, DOI registration, plagiarism services), data is shared with those services as configured by your organization.
- Legal and safety: when required to comply with applicable law, regulation, legal process, or government request, or to protect the rights, property, or safety of xPaperFlow, our users, or others.
- Business transfers: in connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections.
- With your consent: in any other case where you have given us clear consent to share.
5. Cookies and tracking
xPaperFlow uses cookies and similar technologies to:
- Strictly necessary cookies for authentication, session management, and security.
- Functional cookies to remember your preferences (language, timezone, display options).
- Analytics cookies (optional) to understand how the Service is used so we can improve it. These are only set with your consent where required by law.
You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.
6. Data security
We protect your information with administrative, technical, and physical safeguards designed for the trust scholarly publishing requires:
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Role-based access control with per-journal and per-section scopes.
- Full audit trail of every action and decision.
- SAML, OIDC, and 2FA for institutional sign-in.
- Regular third-party security reviews and penetration testing.
- Encrypted backups with tested restore procedures.
- Secure software development lifecycle and dependency review.
7. Data retention
We retain personal data for as long as your account is active or as needed to provide the Service. Manuscript and review content is retained according to your organization's configuration and applicable journal policies (typically the lifetime of the journal plus a defined archive period). When personal data is no longer needed, we securely delete or anonymize it.
8. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your personal data, subject to legal and contractual retention requirements.
- Restrict or object to certain processing.
- Receive your data in a portable, machine-readable format.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with your local data protection authority.
To exercise these rights, contact us at info@xpaperflow.com. We respond to verified requests within 30 days.
9. International transfers
xPaperFlow is operated by Experts InfoTech (Pvt) Ltd. in Pakistan, with cloud hosting in regional data centers. When personal data is transferred across borders, we use appropriate safeguards (standard contractual clauses, encryption, access controls) to protect your information in line with this Policy and applicable law.
10. Children's privacy
xPaperFlow is a professional platform intended for academic and publishing use. It is not directed to children under 16, and we do not knowingly collect personal data from children.
11. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when the Policy was last revised. Material changes will be communicated through the Service or by email where appropriate. Your continued use of the Service after a change constitutes acceptance of the updated Policy.
If you have any questions about this Privacy Policy or our data practices, please contact us:
- Email: info@xpaperflow.com
- Phone: +92 (3) 111-222-715
- Mail: Experts InfoTech (Pvt) Ltd., Street # 1, Sajjad Industrial Estate, Behind Govt. Degree College for Women, Millat Road, Faisalabad 38000, Pakistan
