The short version
- This page describes the categories of third parties that process your data, what each category receives, where it runs, and how long it keeps it.
- Manuscript text leaves our server for one reason: to be sent, through a single routing layer, to the third-party AI model providers that help write your review. Nothing else receives it, and no third party analyses it for us; the only analysis is our own, in-house (Section 3).
- No one, including us, trains any AI model on your manuscript. Every provider that receives manuscript text is bound to that by contract.
- Files are encrypted at rest on our EU server, and every open of a file is logged for the author to see.
- We do not sell your data.
1. Is my paper used to train AI?
No. Your manuscript, the text we extract from it, the findings, the reviewed file, your questionnaire answers and your feedback are never used to train, fine-tune, distil or evaluate-for-training any AI model, whether ours or a third party's. When we send sections of your text to an AI model, it is only to generate your review, under a Data Processing Addendum and commercial API terms that forbid the provider from training on the input. If a provider cannot give that assurance, we stop routing manuscript text to it. Providers may keep API inputs for a limited period for abuse monitoring (typically up to 30 days). Our rule library and scoring improve from aggregate statistics (for example how often a rule fires) and from in-house quality reads conducted under confidentiality (Section 3), not from feeding manuscripts into model training.
2. Sub-processors
We share data only with providers that help us run the service, under Data Processing Addenda that restrict them to our instructions. They fall into the categories below.
| Category | Purpose | What it receives | Location | Retention on their side |
|---|---|---|---|---|
| EU hosting provider (virtual server) | Hosts our API, database, file storage, workflow engine and tracing | Everything we store (Privacy Policy, Section 2); manuscripts and reviewed files sit on the volume as AES-256-GCM ciphertext under a key held only in our service configuration | European Union | Our retention schedule applies; the host does not access data and cannot read the files |
| Edge network and DDoS protection (Cloudflare) | DNS, edge network and DDoS protection for waraq.io, app.waraq.io and api.waraq.io; hosting of the website and the app front-end | Traffic in transit; routing-layer metadata only (timing, token counts, cost). Payload logging is switched off, so manuscript text is not stored there | Global edge | Bound by its Data Processing Addendum |
| AI model providers, via a routing layer | Generating your review | Manuscript text sections plus our instructions; no account identity | United States, European Union or Asia, depending on provider | Bound by each provider's Data Processing Addendum and API terms; no training on inputs; inputs may be retained for abuse monitoring, typically up to 30 days |
| Payments (merchant of record) (Polar) | Checkout, payment, tax, invoices, refunds, subscription management | Email, name, billing address, payment method, purchase history | United States | Bound by its Data Processing Addendum; billing records kept as required by tax and payment law (typically 7 to 10 years) |
| Email delivery (Resend) | Transactional email (sign-in codes, review-ready, billing reminders) and newsletter | Email address, subject, message body, delivery metadata | United States | Bound by its Data Processing Addendum; message logs retained briefly for deliverability |
| Product analytics (PostHog) | Product analytics, session replay (inputs masked) and error tracking on waraq.io and app.waraq.io | Page views, clicks, feature events, masked session replays, error stack traces, device and coarse location data, sent via a first-party relay; and your account email, which our server sends as the user identifier | United States | Bound by its Data Processing Addendum; EU/UK visitors can object by email and a tracker blocker stops collection |
| Public bibliographic services | Reference and journal metadata lookups | DOIs, reference titles and journal names only; never manuscript body text or personal data | United States / Europe | Public APIs |
AI model providers. To write your review, parts of your text are sent to third-party AI model providers through a single routing layer, under contracts that prohibit training on your text and limit retention to short abuse-monitoring windows. We do not name individual providers publicly because our review pipeline and model choices are proprietary; the categories and safeguards are the same for every provider. A full list of AI model providers is available to customers on request at privacy@waraq.io under confidentiality.
Self-hosted components (on our own server, not third parties): the database (including the per-paper access log and decision versions); the workflow engine (job payloads may contain manuscript-derived data while a review runs); tracing (model prompts and completions, which include manuscript text sections, stored with restricted access and pruned after 90 days); our rule engine; the file store (manuscripts, reviewed files and exports encrypted at rest, a key per file wrapped by a server key); server and container logs, rotated and pruned within 90 days; and nightly backups, encrypted with a separate key held offline, kept for 14 days.
3. Internal access
Access to production data is limited to key-based SSH, for operations, support you request, security, and quality reads. A quality read is a member of the Waraq team opening one manuscript together with the review we produced for it, to improve the service; it is in-house, under confidentiality obligations, and the paper is never handed to a third party for analysis. Notes contain at most short quotations. Every open of a file, by the pipeline, the author or the team, is written to an append-only access log the author can read on the paper page. Telemetry labels are filtered so manuscript prose does not appear in dashboards or logs.
4. Retention summary
| Data | Retention |
|---|---|
| Original manuscript file | 180 days after last review activity, or until you delete the paper |
| Reviewed file (all variants) | 365 days after the review finished, or until you delete the paper |
| Findings, score, reports, decision versions, access log, assistant memory | Until you delete the paper or account |
| Anonymous trial accounts | 30 days of inactivity |
| Server and container logs, job traces | Rotated and pruned within 90 days |
| Routing-layer payload logs | Not collected (metadata only) |
| Nightly backups (encrypted with a key held offline) | 14 days |
The 180-, 365- and 30-day sweeps run nightly in our retention worker and never touch a review in progress. Self-service deletion of a paper or account takes effect immediately on live systems, removing every file, every saved version and every derived record; a copy can persist in our encrypted backups for up to 14 days and is then gone. Requests by email are completed within 30 days.
5. Changes
We update this page when we add, replace or remove a category of sub-processor. Customers can ask to be notified of sub-processor changes, request the full provider list under confidentiality, or request a signed Data Processing Agreement by emailing privacy@waraq.io.
Contact: Alurood Alilmiyya Company for Education (CR 7037878365), 4309 King Abdullah Al Saud Road, Al Raed, Riyadh, Kingdom of Saudi Arabia · privacy@waraq.io (or support@waraq.io)