This page explains what personal data PeerAI keeps, why, and for how long. The journal follows Malaysia's Personal Data Protection Act 2010. You agree to this policy when you create an account; the version you agreed to is recorded (current version 2026-10-24).
What we keep
- Your account: name, email, affiliation, country, password hash, two-factor settings and, if you link it, your ORCID iD as verified by ORCID.
- Your submissions: details, author list, declarations, files, reviews, decisions and the timeline.
- Payments: the amount, status and the payment provider's reference. Card numbers are never stored.
- Security records: sign-ins, failed sign-ins and significant actions, with time, IP address and browser, in the journal's audit log.
- Visits to the landing page: time, IP address, country, browser and referring page. These are shown only to the Super Admin.
- Emails we send you: the recipient, subject, content and delivery status.
How long we keep it
- Landing-page visits: 12 months.
- Copies of emails sent: 12 months.
- The activity log: 24 months.
- Unpublished submissions (rejected, withdrawn, expired or never paid) with their files and reviews: 5 years after they end. A record of the submission number, its status and dates is kept with any payment.
- Published articles, with their reviews and author names: permanently, as the scholarly record.
- Payment records: 7 years, as financial records.
- Deleted accounts: anonymised at once, and removed 2 years later once nothing refers to them.
Who sees it
- Unpublished manuscripts are visible to their authors and the journal's administrators, and to the Publication Approver while the paper waits for approval.
- Manuscript text is sent to the three AI vendors only to review it.
- When a paper is published, its title, abstract, keywords, author names, affiliations, ORCID iDs, the corresponding author's email, the reviews and the decision history become public.
- Rejected and withdrawn manuscripts are never made public.
Your rights
- Download your data: on your account page, “Download my data” gives you a file with your account, submissions, payments, sessions, activity and the emails we sent you.
- Delete your account: on your account page. The deletion happens 30 days later, and you can cancel until then. It waits while one of your submissions is still under review. Your name, email, affiliation, country, ORCID iD, sign-in methods, unpublished submissions and their files are removed. Published articles keep your name as an author, and payment records are kept.
- Optional emails: you can turn off pre-check results and revision reminders on your account page or with the link in those emails. Emails about your account, payments, decisions and publication are always sent.
- Corrections: you can change your details when you submit, or contact the journal to correct anything else.