IRPO Logo
IRPOPublishing
Submit

Privacy Policy

Application: IRPO Publishing Platform • Entity: International Research Papers Organisation (IRPO)

Effective Date: October 15, 2026 • Last Updated: October 15, 2026

1. Overview, Scope & Application Identity

This Privacy Policy governs the IRPO Publishing Platform (the "Application" or "Platform"), operated by the International Research Papers Organisation ("IRPO", "we", "our", or "us"), hosted at https://irpo.dpweb.in (and its mirror https://irpo-paper-publication.netlify.app).

IRPO is dedicated to protecting the privacy, confidentiality, and security of authors, peer reviewers, editors, academic conference delegates, and readers. This Privacy Policy comprehensively details the categories of personal data we access, collect, process, store, and share when you interact with our website, create an author or reviewer account, authenticate via Google Sign-In, submit manuscripts, or participate in scholarly peer review.

2. Google OAuth 2.0 & Google User Data Policy Compliance

To provide researchers, authors, and peer reviewers with a friction-free and cryptographically secure single sign-on experience, the IRPO Publishing Platform integrates Google OAuth 2.0 Sign-In.

A. What Google User Data Is Accessed by Our Application

Our application requests access strictly to standard, minimal, non-sensitive OAuth scopes (openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/userinfo.profile). When you choose to authenticate via Google Sign-In, our application accesses and collects the following data from your Google Account:

  • Email Address: Accessed to uniquely identify your author or peer reviewer account. It is used to deliver manuscript submission confirmations, reviewer assignment invitations, peer review reports, editorial decision letters, proof corrections, and account security notices.
  • Full Name (Given Name and Family Name): Accessed to establish your author or reviewer profile, accurately display your academic identity across editorial dashboards, and correctly format author bylines and citation metadata for published papers.
  • Profile Picture URL / Avatar: Accessed to render your personal avatar in the top navigation bar of the authenticated Author and Reviewer Workspace, helping you visually verify your active session.
  • Google User ID (OAuth sub identifier): A unique, pseudonymous alphanumeric string provided by Google to securely bind your authenticated sessions without storing or handling your Google account password.

B. How Our Application Uses Google User Data

We will use your data to provide you with the services you requested. Specifically, Google user data is used solely for the following legitimate academic publishing functions:

  • Creating, authenticating, and maintaining your academic user account on the IRPO Publishing Platform.
  • Providing you with authenticated access to your personal author workspace, manuscript submission dashboard, and editorial tracking tools.
  • Sending transactional editorial emails, such as manuscript receipt notifications, reviewer status updates, acceptance notices, and digital object identifier (DOI) publication alerts.
  • Displaying your name and verified email on peer review correspondence and published article metadata.
  • Preventing duplicate manuscript submissions, credential stuffing, and academic identity fraud.

We will not sell your data to third parties, nor do we use Google user data for commercial advertising, marketing campaigns, or any secondary purpose unrelated to academic publication.

C. With Whom We Share, Transfer, or Disclose Google User Data

We do not transfer or disclose your information to third parties for purposes other than the ones provided in this policy.

We only transmit Google user data to essential, vetted infrastructure partners who operate directly on our behalf under strict data processing agreements and confidentiality obligations:

  • Supabase (Managed PostgreSQL & Auth): Hosts our secure database cluster and handles encrypted session verification within an enterprise-grade cloud environment.
  • Google Cloud Platform: Operates the underlying OAuth 2.0 consent and token exchange infrastructure.
  • Hosting Infrastructure (Netlify / Render): Delivers encrypted HTTPS edge caching and static application routing.

D. Explicit Prohibitions on Google User Data

In strict compliance with Google Developer Policies, IRPO explicitly adheres to the following prohibitions:

  • We never sell, rent, or trade Google user data to data brokers, advertising aggregators, or commercial third parties.
  • We do not use or transfer Google user data for targeted advertising, retargeted advertising, personalized advertising, or interest-based advertising.
  • We do not use Google user data to determine credit-worthiness or for lending purposes.
  • We do not use, transfer, or disclose Google user data or Google Workspace APIs to develop, train, or improve non-personalized or generalized Artificial Intelligence (AI) and Machine Learning (ML) models.

E. Google API Services User Data Policy — Limited Use Disclosure

IRPO Publishing Platform's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Information We Collect Across Our Platform

We may collect, or process on behalf of our academic community, the following categories of personal data when you use or interact with our products and services:

  • Manuscript Submission Data: Article title, abstract, keywords, author institutional affiliations, department, ORCID iD, co-author names and email addresses, uploaded manuscript PDFs, supplementary materials, and editorial cover letters.
  • Peer Review Records: Peer review scores, textual critique, confidential editorial recommendations, and revision timelines. Reviewer identities remain anonymous under our double-blind peer review protocols.
  • Payment & Transaction Data: For Article Processing Charges (APCs) processed through Razorpay, we record transaction identifiers, timestamp, amount paid, and invoice details. IRPO does not collect, process, or store full credit card numbers, CVVs, or online banking passwords.
  • Technical & Diagnostic Data: IP addresses, browser user agent, device operating system, and access timestamps captured in standard web server logs strictly for security auditing, fraud prevention, and uptime diagnostics.

4. Purposes for Which We Process Personal Information

We process personal information exclusively for the following lawful scholarly operations:

  • Administering the submission, peer review, copyediting, and publication pipeline of scholarly research.
  • Publishing accepted articles openly under the Creative Commons Attribution 4.0 International License (CC BY 4.0) with accurate author attribution.
  • Depositing bibliographic metadata and Digital Object Identifiers (DOIs) into scholarly databases and indexing agencies (such as Crossref and Google Scholar).
  • Dispatching essential transactional communications, including submission confirmations, reviewer invitations, decision letters, and conference participation schedules.
  • Maintaining the integrity of the scholarly record in compliance with the Committee on Publication Ethics (COPE) Code of Conduct.

5. Data Protection Mechanisms, Encryption & Security Procedures

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information.

To safeguard personal information and research assets against accidental loss, unauthorized access, destruction, and tampering, IRPO enforces industry-standard technical and organizational security controls:

  • Encryption in Transit: All web traffic and API endpoints are encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS) with modern cipher suites and Strict Transport Security (HSTS) headers.
  • Encryption at Rest: Database tables, user credentials, and authentication sessions are encrypted at rest using AES-256 standard encryption.
  • Cryptographic Token Security: Authentication sessions and JSON Web Tokens (JWTs) are signed with high-entropy cryptographic algorithms (ES256/HS256) and stored securely in protected client state or HTTP-only SameSite cookies.
  • Granular Access Controls: Strict Role-Based Access Control (RBAC) and Row-Level Security (RLS) ensure that manuscripts under review and reviewer evaluations are accessible only to assigned handling editors and referees.
  • Infrastructure Hardening: Automated firewall policies, continuous vulnerability monitoring, isolated virtual private cloud environments, and encrypted database backups.

6. Data Retention and Deletion Policy

We store your personal information for a period of time that is consistent with our business purposes. We will retain your personal information for the length of time needed to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law.

When the data retention period expires for a given type of data, we will delete or destroy it.

  • User Account & Google Data: Retained for the lifetime of your active account. If an account remains inactive for 24 continuous months, we may securely archive or delete the login credentials.
  • Rejected / Withdrawn Manuscripts: Archived in our secure review vault for 12 months following formal decision to verify non-plagiarism and prevent dual submissions, after which manuscript files may be permanently purged upon request.
  • Scholarly Record Notice: In accordance with global digital archiving standards and COPE guidelines, research papers that have been formally accepted, published, and assigned an international Digital Object Identifier (DOI) form an immutable part of the permanent scholarly record and cannot be deleted or altered except via formal editorial retraction or correction notices.

How to Request Account & Personal Data Deletion:

You may request for your data to be deleted at any time. To request permanent deletion of your user account, profile information, and Google user data:

  1. Email our Data Protection Secretariat at editorial@irpo.org or irpo.support@gmail.com with the subject line: Account & Data Deletion Request.
  2. Specify your registered email address and full name.
  3. Upon identity verification, our technical team will permanently delete your Google user profile records, authentication credentials, and account history from our active databases within 30 calendar days.

Revoking Google Account Access Permissions:

You may also revoke IRPO Publishing Platform's access to your Google Account at any time through Google's centralized permissions manager:

👉 https://myaccount.google.com/permissions

Revoking access will immediately prevent our application from receiving any updated profile information or re-authenticating sessions via Google.

7. Cookies & Local Storage Usage

The IRPO Publishing Platform utilizes strictly necessary cookies and local storage tokens strictly required for:

  • Maintaining authenticated author and reviewer sessions across page navigations.
  • Preventing Cross-Site Request Forgery (CSRF) during form submissions.
  • Storing user interface preferences (e.g., table pagination settings, reading preferences).

We do not use third-party advertising cookies, retargeting pixels, or invasive behavioral trackers.

8. Your Privacy Rights (GDPR, CCPA & Global Standards)

Regardless of your country of residence, IRPO extends comprehensive privacy rights to all members of our academic community:

  • Right to Access: Request a full copy of the personal data we hold about you.
  • Right to Rectification: Request correction of outdated or inaccurate personal information in your author profile.
  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to scholarly archiving requirements for published works.
  • Right to Data Portability: Obtain your submission records and review history in a structured, machine-readable format.
  • Right to Withdraw Consent: Revoke consent for data processing at any time without affecting the lawfulness of processing conducted prior to withdrawal.

9. Children's Privacy

The IRPO Publishing Platform is dedicated exclusively to academic scholarly research, university education, and scientific publication. Our platform is not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children under 13 (or under 16 in the European Union). If we become aware that a child has provided us with personal data, we will promptly delete it.

10. Contact Us & Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy, your personal information, or wish to exercise your statutory data protection rights, please contact our Data Protection Secretariat:

International Research Papers Organisation (IRPO)

Application Name: IRPO Publishing Platform

Department: Data Protection & Editorial Secretariat

Support & Google OAuth Inquiries: irpo.support@gmail.com

Editorial Secretariat: editorial@irpo.org

Official Website: https://irpo.dpweb.in

Privacy Policy URL: https://irpo.dpweb.in/privacy-policy

All data protection inquiries and deletion requests will receive an initial response within 24–48 business hours.

← Return to IRPO Publishing Platform Home