Privacy Policy

1. Who We Are (Data Controller)

The data controller is Scholardemia.com. For any privacy question or to exercise your rights, contact admin@scholardemia.com. This address is also our designated point of contact for regulators and authorities.

2. Data We Collect

• Account and profile data: name, email address, username, optional phone number (verified by SMS code), profile and cover images, and profile details you choose to add (biography, career history, education, research keywords).
• Content you create: documents, posts, comments, messages, journal submissions and peer reviews, news articles, project and task data, bookmarks and notes, and files you upload (images, video, audio, documents).
• Learning and events data: course enrollments, submissions, progress and review data, event registrations, check-ins, and related preferences (such as travel or dietary preferences you provide for an event).
• Career data: candidate profiles, job applications, and saved jobs or searches, where you use the careers features.
• Trial, subscription, and payment data: Premium and Teams & Labs trial or preview status and expiry, subscription interval and status, cancellation or lapse dates, Stripe customer and subscription identifiers, and records of purchases, invoices, refunds, and payment status. For a course you buy: the course, its seller, the amount, the references of its receipt and invoice, and any refund. No-card trials do not collect a card. When payment is offered, card details are collected directly by Stripe and never touch our servers.
• Usage and device data: pages visited, actions taken, browser and device metadata, security logs, and crash and performance reports from the mobile app (see Sentry in section 7).
• Communication preferences: notification settings, newsletter subscriptions, and records of the consent you give us.

Please do not submit sensitive personal data or special-category data (for example health information, precise accessibility needs, political opinions, religious beliefs, ethnicity, trade union membership, genetic or biometric data, or information about sex life or sexual orientation) unless it is necessary for the feature you are using or the context in which you provide it. Where you choose to include such data in content, files, event preferences, accessibility requests, profile or career material, or journal/research submissions, we process it only as needed to provide the requested feature, protect users, comply with legal obligations, or support legal claims where applicable.

3. Data Collected from Google

If you connect your Google Calendar, we access:

• Calendar availability ("busy"/"free") via https://www.googleapis.com/auth/calendar.freebusy
• Calendar event metadata (titles, times, attendees, locations) via https://www.googleapis.com/auth/calendar.events

We use this data to:

• Check availability: we call the Free/Busy endpoint to gray-out occupied slots in our scheduler UI, preventing double-booking without exposing event details.
• Synchronize events: we read your existing events so our app mirrors your schedule.
• Manage events: we create, update, and delete events when you book, reschedule, or cancel webinars or meetings in Scholardemia.com, and can request Google Meet links for newly created events.
• Keep calendars in sync: we periodically call the Calendar API to fetch updates made directly in Google Calendar.

Scholardemia.com's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell, rent, or share Google user data with third parties, and we do not use it for advertising.

Zoom integrations

When you connect Zoom, we receive the identity and permissions associated with that connection, including your Zoom user identifier and, for an organiser connection, your account email and account details. We store OAuth credentials so we can perform the actions you authorise.

For linked event rooms, we process meeting or webinar identifiers, schedules, host details, capacity and admission settings, join details, registrant information and attendance. If an organiser enables recordings or transcripts, we also process the recording information and content needed to provide that event's replay. Zoom sends event notifications that keep these records up to date.

We use this information to connect accounts, prepare and join rooms, manage registrations, record attendance and provide organiser-controlled replays. The Companion matches a Zoom meeting and your connected identity to the corresponding Scholardemia session. Your event access determines which discussion tools, materials and notes you can use.

Zoom OAuth credentials and stored webhook payloads are encrypted in our database. Short-lived Zoom Access Keys (ZAKs) are fetched when needed and are not saved to the database. Joining a meeting sends Zoom the information needed for that join, including your display name and, where required for a webinar or registration, your email address.

Disconnecting removes credentials and identity information from the active connection and stops further use of that connection. Encrypted credentials may remain in a restricted retry queue until Zoom confirms revocation. When we receive Zoom's app-removal notification, we disable the matching connection. Existing events, attendance records, messages, notes and saved links are not all deleted by disconnecting; they remain subject to the retention and account-deletion provisions of this policy. Meetings in your Zoom account remain under your control.

For questions about your Zoom data or a deletion request, contact admin@scholardemia.com. You can remove authorisation through Zoom App Marketplace's Manage → Added Apps page.

4. Data from Social and Third-Party Logins

We only read the profile data listed above; we do not post to your social accounts. If you connect Zotero or Mendeley, we access your reference library only to provide the citation features you request.

5. How We Use Data and Our Legal Bases

6. AI Features

Scholardemia includes optional AI writing and assistance features. When you actively invoke an AI feature, the content you select or type for that request is sent to an AI provider to generate the response. If you have saved your own API key in settings, the request goes to the provider you chose (OpenAI, Anthropic, Google, DeepSeek, or Perplexity) using your key; otherwise certain features use a platform-managed provider key. Your saved API keys are stored encrypted and are never shared with other users.

We do not send your content to AI providers except when you use an AI feature, and we do not use your content to train AI models. AI providers process the submitted content under their own terms; consult the relevant provider's privacy documentation before submitting sensitive material.

7. Service Providers, Processors, and Connected Third-Party Services

We do not sell or rent your personal data. We share data with service providers and connected third-party services only as needed to operate Scholardemia or provide integrations you choose. Where we engage a provider as our processor, we use contracts that restrict their use of your data. Where you connect a third-party service or use your own provider API key, that service may also handle data under its own terms.

Content you choose to publish (for example public profiles, posts, published articles, or public event pages) is visible to others according to the visibility settings you select. Workspaces, journals, and labs you join can see the content and profile information you contribute there.

When you buy a course, you buy it from its seller: the teacher, or the journal, lab or conference that offers it. You pay on the seller's own Stripe account, so the seller receives your name and email address through Stripe, with the purchase, its receipt and invoice, and any business name, VAT number or purchase order number you enter at checkout. The seller uses them for their own records, receipts, refunds and tax.

Public content may be indexed by search engines or copied, cached, or archived by third parties outside our control. Deleting public content or your account removes or disassociates it from Scholardemia according to this policy, but it may not remove copies already controlled by search engines, recipients, or other third-party services.

We may also disclose information where required by law (for example in response to a valid subpoena, court order or other legal process) or to protect the rights, property, and safety of Scholardemia.com, our users, or the public.

8. International Transfers

Some of the service providers and connected third-party services above are located in, or store data in, the United States or other countries outside the UK and European Economic Area. Where Scholardemia transfers personal data outside the UK or the European Economic Area, we rely on appropriate safeguards: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or standard contractual clauses / the UK International Data Transfer Addendum included in the relevant data processing agreement where available. User-authorized integrations and user-supplied AI provider keys may involve transfers under that third-party service's own terms.

9. Cookies, storage and statistics

Necessary cookies keep you signed in, protect requests and remember your choices. Interface preferences, such as theme and playback volume, may also be stored locally in your browser.

Anonymous statistics. We count how the service is used. We count things, not people. The counts cover pages opened and the site a visit came from, article views and downloads, event page views, shares and sponsor link clicks, completed sign-ups, the steps of sending a manuscript to a journal, and how fast pages load. In the phone app they cover which screens are opened and whether signing in with Apple worked.

These counts run unless you object. On the website, switch “Anonymous statistics” off under Privacy choices, which you can open at the end of this section or in Settings → Privacy & data. We also treat a Do Not Track or Global Privacy Control signal from your browser as an objection. Your choice applies to this browser on this website. Another device, or a journal on its own domain, has its own choice. In the phone app, switch “Anonymous statistics” off under Settings → Privacy & data.

• Nothing is saved on your device for these counts. They set no cookie and use no browser storage. The only cookie they look at is the one that remembers your choice.
• To count visits, our server works out a visit code from your network address, your browser type, the site and a secret that changes every day. The address and the browser type are then thrown away. They are never stored.
• At the same moment our server looks up the country of your network address in a list held on our own server (DB-IP), and notes whether the count came from a phone, a computer or the phone app. Only the two-letter country code and that one word are kept with the count. Pages that show countries group any country with fewer than five readers.
• The visit code is kept only with page views by visitors who are not signed in. A page view while you are signed in, and every screen count from the phone app, carries no visit code. With an article view or download we keep a code that says only whether the same visitor opened the same article again within the hour. It cannot link two articles to one reader. Until the end of the day our server also remembers the visit code for a short time, so that a repeat is not counted twice.
• The daily secret is deleted after a day and a half. After that nobody, including us, can tell whether two visit codes belong to the same visitor. We can count visits on a day. We cannot follow a person from one day to the next.
• Of a page address we keep only our own section names. An ID, a name, a title or a token in the address is not kept. Of the page you came from we keep only the name of the site, and of the address only three campaign tags.
• No account is attached to a count. Robots are left out. Nothing is shared with any other company.
• Counts are deleted after 25 months. Records of article views and downloads are kept as the journal’s usage figures and have no fixed end date. So are the daily totals that a workspace’s owners and editors see in its Analytics, which hold numbers only.

Optional choices. Two further purposes stay off until you allow them. You can allow or refuse each one separately, and change your mind at any time, under Privacy choices. We ask again after 180 days. We respect Do Not Track and Global Privacy Control signals for these as well.

• Outside statistics: some public event pages use Plausible, an outside statistics service, where the organiser has set it up. If you allow it, Plausible receives the page address, browser information, your network address, the referring site and outbound link activity to produce statistics. It sets no cookies.
• Video diagnostics: if you allow it when you open a video, playback quality information is sent to Mux. Mux analytics cookies are disabled. Withdrawal stops further measurement without stopping playback; the provider may receive the final report for a view measured before withdrawal. Playback, captions, saved progress and requested calls remain available with either choice.

We do not enable advertising pixels through these choices. Embedded media and services you request can receive the network information needed to deliver them; their own privacy terms also apply.

Emails

Emails sent through Scholardemia carry no tracking pixels and no tracked links. That covers messages from your inbox, newsletters, notifications, announcements and invitations sent by organisers and journals.

There is one exception. The invitations to our own webinar series, which we send to academics who may not have an account, measure whether the email was opened and which links were followed. The link to your email preferences in those invitations is never tracked, and you can stop the invitations there.

When an event organiser sends an announcement, the organiser sees how many people visited the event page from it. This is a count, never who. The link to the event page names the announcement, not the person it was sent to.

When you are invited to an event, the organiser sees whether you have opened your own invitation page.

10. Data Retention

11. Security

• Data is encrypted in transit (HTTPS/TLS).
• Saved AI provider API keys are stored encrypted at rest.
• Access to personal data is limited to authorized personnel who need it to operate the service, and we maintain technical and organizational measures appropriate to the risk.

12. Your Rights, Data Export, and Account Deletion

Under UK and EU data protection law you have the right to:

• Access your data and receive a copy in a portable format
• Rectify inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Withdraw consent at any time (for processing based on consent)
• Complain to a supervisory authority

You can export a copy of your data from your account settings (Settings → Privacy & data) and delete your account yourself (see Deleting your account below), or contact admin@scholardemia.com. Requests are addressed within one month, free of charge.

Where fulfilling a request would reveal personal data about another person (for example, the identity of an anonymous peer reviewer), we may withhold that information to the extent permitted by law.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to your local supervisory authority.

Deleting your account

You can delete your Scholardemia account yourself at any time:

• In the Scholardemia app (iPhone and Android): open Settings → Account & security → Delete account, type the confirmation shown, enter your password if you sign in with one, and confirm.
• On the website: sign in at scholardemia.com, open Settings → Privacy & data, and choose Delete account under Danger zone.
• By email: if deletion isn't available when you try, email support@scholardemia.com from the address you sign in with and we will delete the account for you.

If you last signed in a while ago, you will be asked to confirm it's you first, with your password or by signing in again with the account you use (such as Apple or Google).

When you delete your account: your account record, profile, and personal data are permanently removed from our production database, your active sessions are revoked, and content you authored is deleted or disassociated from you. Personal files that are not needed by surviving shared, institutional, or legally retained content (including personal media and previous data-export bundles) are deleted from object storage. Files retained with surviving content are disassociated from your account and their personal uploader attribution is removed. We delete or de-link payment-provider customer records where supported, while the payment provider may retain records it is legally required or permitted to keep for tax, accounting, fraud-prevention, security, or regulatory compliance. We retain financial and transaction records for the statutory period described in section 10 with your account link removed, keep minimal newsletter suppression records so your opt-outs keep being honoured, and retain consent history only in anonymised (hashed) form. Residual copies may persist in access-restricted off-host database backups for up to 35 days; erasure propagates as those backups rotate.

13. Children

Scholardemia is intended for adults in the academic and professional community. It is not directed at children under 16, and we do not knowingly collect personal data from them.

14. Policy Updates

We will notify users of material changes to this policy on this page and, for significant changes, via in-app notice or email. For any questions or concerns, please contact admin@scholardemia.com.