Privacy policy
Last updated September 2026. How iJournalPro collects, uses and protects personal data, in compliance with the EU General Data Protection Regulation (GDPR) and Swedish data protection law.
Who we are
iJournalPro provides journal management software and publishing services from Stockholm, Sweden. For the personal data described in this policy, iJournalPro is the data controller. Contact us about privacy at any time at [email protected].
We are not required to appoint a Data Protection Officer, but privacy questions are handled by a named person in our team who will reply within one month.
Our role
We play two different roles, depending on the data:
- Controller for data about our customers and website visitors, such as contact details, account and billing information, and support correspondence.
- Processor for data stored in a journal on our platform, such as authors, reviewers, editors and manuscripts. Here the journal or publisher is the controller and decides how that data is used; we process it only on their documented instructions and under a data processing agreement (GDPR Article 28).
If you are an author or reviewer with a question about your data in a specific journal, please contact that journal first. We will help them respond.
Data we collect
- Contact and account data: name, email address, institution, role, username and password (stored hashed).
- Journal data: manuscripts, reviews, correspondence and profile details entered into a journal, including ORCID iDs where users connect them.
- Technical data: IP address, browser and device information, log and error records needed to run and secure the service.
- Billing data: invoicing details and payment records. Card payments are handled by our payment provider; we do not store full card numbers.
Most data comes directly from you. Some comes from the journal you work with, for example when an editor invites you to review. We do not collect special categories of personal data unless a journal requires it for its own work, in which case the journal is responsible for it as controller.
Purposes, legal bases and retention
This table shows why we use personal data, the GDPR legal basis for each use, and how long we keep it.
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Providing the platform and publishing services | Contact and account data, journal data, technical data | Contract (Art. 6(1)(b)) | For the life of the account or customer contract |
| Answering enquiries and demo requests | Name, email, institution, message | Legitimate interests (Art. 6(1)(f)): responding to people who contact us | Up to 24 months after the last contact, unless you become a customer |
| Security, fraud prevention and troubleshooting | Technical data such as IP address and logs | Legitimate interests (Art. 6(1)(f)): keeping the service secure | Kept for a limited period, then deleted or anonymised |
| Invoicing and bookkeeping | Billing data | Legal obligation (Art. 6(1)(c)), Swedish Bookkeeping Act | 7 years, as required by Swedish law |
| News and product updates | Email address | Consent (Art. 6(1)(a)) or, for existing customers, legitimate interests | Until you unsubscribe |
| Optional cookies and analytics | Browser and usage data | Consent (Art. 6(1)(a)) | Until you withdraw consent, and no longer than 13 months |
Providing account and contact data is necessary to use the platform; without it we cannot create an account. Everything else is optional unless stated.
Sharing and service providers
We do not sell personal data. We share it only with:
- Service providers (sub-processors) that host and operate our infrastructure, bound by GDPR Article 28 data processing terms
- Scholarly services a journal chooses to enable, such as Crossref (DOI metadata), iThenticate (similarity checks), ORCID and indexing databases
- Authorities, where the law requires it
Published articles and their metadata are public by design, as decided by each journal.
International transfers
Where personal data is transferred outside the EU/EEA, we rely on an EU adequacy decision or the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the safeguards that apply.
Security
We use technical and organisational measures appropriate to the risk (GDPR Article 32), including encryption in transit, role-based access control, the principle of least privilege, regular backups and monitoring.
Cookies
Our website and platform use essential cookies to keep you signed in and keep the service secure. These do not need consent. We use analytics or other optional cookies only after you have given consent, and you can change your choice at any time.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy (Article 15)
- Correct inaccurate or incomplete data (Article 16)
- Have your data erased (Article 17)
- Restrict processing (Article 18)
- Receive your data in a portable, machine-readable format (Article 20)
- Object to processing based on our legitimate interests, and to direct marketing at any time (Article 21)
- Withdraw consent at any time, without affecting earlier processing
Write to [email protected] to use these rights. We reply within one month, and may ask you to confirm your identity first. We do not make decisions about you based solely on automated processing, including profiling.
You also have the right to complain to a data protection authority, such as IMY in Sweden.
GDPR compliance for journals and publishers
When your journal runs on iJournalPro, you are the controller of your journal's data and we act as your processor. We support your GDPR obligations as follows:
- Data processing agreement. Every customer receives a data processing agreement meeting GDPR Article 28, stating the hosting location and the security measures in place.
- Sub-processors. We keep a list of the sub-processors we use, share it on request, and tell customers in advance before adding or replacing one, so you can object.
- Personal data breaches. If a breach affects your journal's data, we notify you without undue delay so you can meet the 72-hour reporting deadline in Article 33.
- Data subject requests. We help you answer requests from authors, reviewers and editors for access, correction, export or erasure.
- Privacy by design. The platform collects only the data a journal workflow needs, and access to it depends on each user's role.
- Records of processing. We maintain records of our processing activities as required by Article 30.
- End of contract. When the service ends, we return your journal's data in a standard export format and then delete it, unless the law requires us to keep it.
To request our data processing agreement or sub-processor list, email [email protected].
Changes to this policy
We may update this policy. We will post the new version here with a new date, and tell customers about significant changes in advance.