Türkçe · KVKK Aydınlatma Metni

Welcome to our Privacy Notice. This document outlines how we collect, use, store, and protect your information on our website, located at https://scimatic.org. SciMatic is a ZincirX product: "we", "us" and "our" mean ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. and ZincirX Inc., and the next section explains which of them is responsible for your data.

Who is responsible for your data

SciMatic is provided by two companies: ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. ("ZincirX A.Ş."), a joint-stock company established in Türkiye, Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye (MERSİS 0999144137300001; Urla Vergi Dairesi 9991441373); and ZincirX Inc., a corporation incorporated in Delaware, United States, with its registered office at c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

The company responsible for your data, the controller (in Turkish law, the veri sorumlusu), depends on how you deal with us:

• If you buy on SciMatic with Türkiye as your billing country (for an institution, the institution's country), ZincirX A.Ş. is the controller of your account and purchase data, because it is the company that sells to you and issues your invoice.
• If you buy with any other billing country, ZincirX Inc. is the controller of your account and purchase data, for the same reason. ZincirX A.Ş. operates SciMatic for both companies and processes that data on ZincirX Inc.'s behalf, only on its instructions, under a data processing agreement between the two companies.
• If we write to an office e-mail address that your institution publishes on its website (see Institution outreach below), ZincirX Inc. is the controller of that address and of our correspondence about it. ZincirX A.Ş. processes them on ZincirX Inc.'s behalf, only on its instructions, under the same data processing agreement.
• In every other case (if you visit our website or apps, have an account without having bought anything, or write to us), the controller is ZincirX A.Ş., which runs the website and the apps.

The two companies are separate controllers, not joint controllers: each is responsible for the data it controls.

For users in Türkiye, the controller named above is the veri sorumlusu under Law No. 6698 on the Protection of Personal Data (KVKK). You can use your rights under Article 11 of the KVKK, and under the EU General Data Protection Regulation (GDPR) where it applies, by writing to info@scimatic.org.

If you are in Türkiye, our Turkish notice under Law No. 6698 (KVKK Aydınlatma Metni), at https://scimatic.org/kvkk, explains how ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. processes your personal data and how to exercise your rights.

How we handle your information

1. Information Collection: We only collect personally identifiable information that you voluntarily provide to us through email or other direct contact, with one exception: the office e-mail addresses that institutions publish on their own websites, described under Institution outreach below. We are the sole owners of this information and will not sell or rent it to anyone.
2. Use of Your Data: We use your information to respond to your inquiries and will not share it with third parties outside of our organization, except as necessary to fulfill your requests or where you have given your consent (see Cookies below).
3. Your Control Over Information: You can opt out of future contacts, review and correct your data, or request its deletion by contacting us through the provided contact details.
4. Where your sign-up came from: When you open an account, we save on it the campaign tags of the link that brought you to our site on that visit (utm_source, utm_medium, utm_campaign, utm_content: for example, which of our ads you came from) and the address of the first page you opened (without its query). We use them only to count which of our promotions work and to take you to the feature you came for. Your IP address and the other sites you visit are not stored, and this information is not shared with anyone.
5. Signing in: On the website you sign in with a one-time link we e-mail to your address, or with Google or Facebook; the website has no passwords. For each link we keep only its fingerprint (a SHA-256 hash), when it was requested and used, and the IP address and browser that asked for it and used it: to show you where a link was asked from and to look into misuse. A link works once, for 15 minutes; these records are deleted 30 days after the link expires. The SciMatic mobile app (from version 1.6) has no passwords either: it signs you in with a 6-digit code we e-mail to you, with Google, or with Sign in with Apple. For each code we keep only a keyed fingerprint (an HMAC), when it was requested and used, how many tries it took, and the IP address and app that asked for it and used it; a code works once, for 10 minutes and 5 tries, and these records are also deleted 30 days after the code expires. If you use Sign in with Apple, we keep the account identifier Apple gives us and, so that deleting your account can also end that sign-in at Apple, Apple's sign-in token (encrypted). Older versions of the app sign in with your e-mail address and a password (stored only as a hash) until that sign-in is switched off.
6. The public blacklist: if you are placed on SciMatic's blacklist under our Publication Terms (for example, as an author of a published article retracted at its authors' request) or as the owner of journals we removed, we publish your name, the date you were listed and the reason. Your e-mail address is never published; we keep it only to match the entry to your account and to send you a notice.
7. CERN (European Organization for Nuclear Research, Switzerland), Zenodo: the published article's PDF with author names, affiliations and article metadata, to register free DOIs. These records are public on Zenodo and permanent.

Google User Data

Our application integrates with Google APIs to provide certain features. This section describes how we handle Google user data in compliance with the Google API Services User Data Policy.

1. Data Accessed: Our application may access the following types of Google user data:
   • Basic profile information (name, email address)
   • Email messages and metadata (when Gmail API scopes are authorized)
   • Calendar events and scheduling data (when Calendar API scopes are authorized)
2. Data Usage: Google user data is used solely to provide and improve the services you have explicitly authorized. Specifically:
   • Profile information is used for authentication and account identification.
   • Email and calendar data is accessed only to deliver the features you have requested within our application.
   • We do not use Google user data for advertising, marketing, or any purpose unrelated to the core functionality of our application.
   • We do not use Google user data to train artificial intelligence or machine learning models.
3. Data Storage: Google user data is stored securely on our servers using industry-standard encryption. Data is retained only for as long as necessary to provide the services you have authorized. You may request deletion of your data at any time by contacting us.
4. Data Sharing: We do not sell, trade, or share Google user data with third parties, except:
   • When required by law or legal process.
   • With your explicit consent.
   • With service providers who assist in operating our application, under strict confidentiality agreements.

Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Institution outreach

We send universities and research institutions a one-time invitation to work with SciMatic: a call for papers for our journals, journal hosting, Thesis Manager and Semester Manager. The controller is ZincirX Inc., which sends these invitations; ZincirX A.Ş. processes the data on ZincirX Inc.'s behalf, only on its instructions, under the data processing agreement between the two companies.

• What we collect: only office e-mail addresses that an institution publishes on its own public website (for example its research office, library, journal office or registrar), the page where the address is published, and the institution's name and country, for institutions on SciMatic's own reviewed list of universities. We do not collect or write to personal addresses of staff or students.
• Who we do not write to: institutions in Türkiye, and institutions in countries whose law requires prior consent for such messages.
• Purpose and legal basis: a single invitation to the office, and our handling of any reply, on the basis of our legitimate interest in introducing our academic services to institutions (Article 6(1)(f) GDPR, where it applies). Each address receives one message; we do not write again unless you reply. The message may mention, as aggregate figures from public bibliographic data, research fields in which researchers of the institution publish; no individual is named.
• Where it is kept: on our server with Hostinger in the European Union (Lithuania) and in our outreach mailbox, which Hostinger also hosts.
• How long: an address we never wrote to, or that did not reply, is deleted at the latest 12 months after we found it. If you opt out, we keep only the address on a do-not-contact list so that we never write to it again. If you reply, we keep the correspondence like any other e-mail sent to us.
• How to opt out: use the one-click unsubscribe link in the message, or reply to it, or write to hello@partners.scimatic.org. The unsubscribe page can also stop our messages to every address at your institution's domain. For your other rights, write to info@scimatic.org.

SciMatic Check

SciMatic Check reads a manuscript before submission: it looks up its references, flags retracted papers and checks it against a journal's rules and the statements it needs. It runs when you ask for it, on a file you upload or a manuscript you are submitting, or when an editor of the journal you submitted to runs it on your submission. If you choose "from now on" when you ask for a check, it also runs by itself on each new version of your manuscripts when you open Submit, until you turn this off on the submission checklist.

• What is processed: the manuscript (its text, references and declarations, including the names and affiliations it contains) and the report made from it.
• Who receives it: the text is sent to Google LLC's Gemini API, which may process it in the United States, to produce the report. We use Gemini's paid service, under whose terms Google does not use the content to improve its products; Google keeps abuse-monitoring logs for up to 55 days. Only the reference strings are sent to Crossref and OpenAlex (both in the United States) to look them up. We never use manuscripts to train AI.
• How long: an uploaded file is deleted within 24 hours, normally as soon as the report is ready. The report holds findings and short quotes, not the full text, and is deleted 12 months after it was made. The record of a purchase (date and price) is kept for accounting, as described under Payments.
• Who sees the report: only you. If you choose to share it with the journal's editors, they see a "Checked" badge on your submission and can open it, until you stop sharing. A check an editor runs on a submission is seen by that journal's editors only.
• Legal basis: providing the service you ask for (Article 6(1)(b) GDPR). For a check an editor runs, the journal's legitimate interest in screening the submissions it receives (Article 6(1)(f) GDPR), which authors agree to when they submit. Before you upload, you confirm that you may share the manuscript for this purpose. The controller is the company named under "Who is responsible for your data".

Payments

When you buy something on SciMatic, who receives your payment details depends on the billing country you choose at checkout (see our Terms of Sale):

• Billing country Türkiye: your name, e-mail address, billing country, the invoice details you give (address; for an institution its name, tax number and tax office) and what you buy go to ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. (Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye), the seller, which issues your e-Arşiv invoice, and to iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), the payment institution that takes your card payment on zincirx.com.
• Every other billing country: your e-mail address, what you buy and the details you enter on the payment page go to ZincirX Inc., a Delaware corporation, the seller, and to Stripe, which takes your card payment.

You enter your card number on the payment provider's page; SciMatic never sees or stores it. We keep a record of each purchase (amount, date, billing country, payment reference) for our accounts.

Security: We take precautions to protect your information both online and offline. Sensitive data is encrypted and transmitted securely. Only employees who require the information for specific tasks are granted access, and our servers are kept in a secure environment.

If you have any concerns about our privacy practices, please contact us immediately via telephone at +90 533 549 9880 or via email at Admin.

By post, write to ZincirX A.Ş., Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye, or to ZincirX Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Registration

To use this website, complete the registration form. While some information is required, providing additional demographic details is optional.

Cookies

SciMatic uses the cookies and browser storage below. The ones that are not strictly necessary run only if you accept their purpose (analytics, advertising or marketing) in the site's cookie banner; until you do, no request is sent to Google, Yandex or Meta.

• Session cookie and XSRF-TOKEN (strictly necessary): carry your session and language and protect forms against cross-site request forgery; they expire with the session.
• Remember-me cookie (strictly necessary; set when you sign in with "Keep me signed in on this device" ticked on the page a sign-in link opens, which it is unless you untick it): keeps you signed in on that browser until you sign out, for up to a year.
• Your cookie choice (strictly necessary; zx_consent in the browser's local storage): your accept or reject for each purpose and its date; you are asked again after 6 months.
• Your marketing choice (strictly necessary; the zx_marketing cookie, only if you accept marketing): tells our server that you accepted marketing, so that it may report the steps below to Meta; it ends with your choice (6 months at most) and is deleted when you withdraw.
• Google Analytics 4 and Google Tag Manager (analytics; Google LLC, USA; only with your consent): the _ga and _ga_<ID> cookies, kept for up to 2 years. They measure the pages you visit (with secret parts of the address removed), when, your browser and device and an approximate location derived from your IP address, plus the sign-up, checkout and purchase steps (amount, currency and order number).
• Yandex Metrica (analytics; Yandex LLC, Russian Federation; only with your consent, and only on the pages that use it): cookies starting with _ym, such as _ym_uid and _ym_d (1 year), _ym_isad (2 days) and _ym_visorc (30 minutes); it measures visits, clicks and link clicks. Session recording (Webvisor) is off.
• Google AdSense (advertising; Google LLC, USA; only with your consent): shows and measures ads; the __gads, __gpi and __eoi cookies are kept for up to 13 months, and Google may also use ad cookies on its own domains.
• Meta Pixel and Meta Conversions API (marketing; Meta Platforms Ireland Ltd., Ireland, and Meta Platforms, Inc., USA; only with your consent): used to measure whether our own ads on Facebook and Instagram lead to sign-ups and purchases, and to improve (optimise) them. The Pixel sets the _fbp cookie and, if you came by clicking one of our ads, the _fbc cookie, each kept for up to 90 days. The ad's click id in the address you landed on (fbclid) is kept in your session on our server and reaches Meta, as _fbc, only if you accept marketing, even on a later page; nothing is written to your browser for it before you consent. It tells Meta the address of the page you view, your browser and your IP address; it runs only on public pages, the sign-up and sign-in pages and the page you land on after signing up or paying, never in the editor or admin areas, and not on pages whose address carries a secret part (such as an e-mailed sign-in link). When you sign up, start a card checkout or complete a purchase, our server also sends Meta, through the Meta Conversions API, that step (for checkouts and purchases, with the amount, the currency and your billing country), your IP address and browser, the _fbp and _fbc values, and SHA-256 hashes of your e-mail address and account number; if you signed up with Google, your e-mail address is not sent. The legal basis is your consent (GDPR Art. 6(1)(a); for people in Türkiye, explicit consent under KVKK Art. 5(1)). Meta may transfer this data to the United States.

You can change your choice or withdraw consent at any time from the "Cookie settings" link at the bottom of the page; withdrawing stops these tools and deletes the _ga, _ym and ad cookies the site can delete, as well as the _fbp, _fbc and zx_marketing cookies, and our server stops sending events to Meta.

This website contains links to other sites. Please be aware that we are not responsible for the content or privacy practices of such sites.