Also available in Spanish.
1. Data controller
The data controller is FIALIA SOLUCIONES INDUSTRIALES, S.L., NIF B85944775, with registered address at calle Ferraz 28, 2.º izquierda, 28008 Madrid. Privacy contact: equipo@revisia.es.
2. What data we process, for what purpose and on what legal basis
- Account (email address, protected password, language, plan, version of the terms accepted and date): to create and maintain your account and to assist you. Legal basis: performance of the contract.
- Purchase (plan, amount, status and transaction identifiers in Stripe): to charge, issue receipts and prevent fraud. Legal basis: contract and legal obligations.
- Project (question, search strategies, references, full-text documents, criteria, decisions, extractions, messages with the assistant, manuscript drafts and activity log): to provide the service. Legal basis: contract.
- Home page box (question, email and language, without an account): to refine the question and, if you confirm the link we send you, to create your account with it. Legal basis: pre-contractual measures taken at your request.
- Use and security (IP address, browser, session, technical logs, artificial intelligence usage, signals of automated use and Cloudflare anti-bot check): to protect accounts, enforce limits and resolve incidents. Legal basis: legitimate interest.
- Audience measurement with Plausible, without cookies: to know what is used. Legal basis: legitimate interest.
- Clicks in our emails (type of email, date and browser; the account if you are signed in): to know whether the notices are useful. Legal basis: legitimate interest.
- Optional campaign measurement (campaign parameters, landing page and Google click identifiers): to attribute a sign-up to a campaign. Legal basis: consent, through a checkbox when you create the account.
- Email notices about your review (reminders, stage-by-stage follow-up, survey at the end): to help you finish what you started. Legal basis: legitimate interest. Each notice includes an unsubscribe link. Account emails (confirming your address, recovering your password, receipts) are part of the service.
- Third-party data that appears in your project: the names of the authors of articles are public bibliographic data that we process as data controller to manage references (legitimate interest; we do not inform each author because of the disproportionate effort it would require, Article 14(5)(b) of the GDPR (Regulation (EU) 2016/679)). The email addresses of the reviewers you invite are processed by us on your behalf, as processor.
Account and purchase data are necessary to provide and charge for the service. Campaign measurement is optional. What we store in your browser is described in the Legal notice and cookies (in Spanish).
3. Who we share data with and where it is located
| Who | What for | Where | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Servers, database and document storage | Database in Western Europe; documents in storage with EU jurisdiction; the company is based in the U.S. | Certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses |
| Anthropic, PBC | Artificial intelligence | U.S. | Standard contractual clauses |
| OpenAI, L.L.C. | Artificial intelligence | U.S. | Standard contractual clauses |
| Cerebras Systems, Inc. | Artificial intelligence | U.S. | Standard contractual clauses |
| Stripe Payments Europe, Ltd. | Payments and receipts | Ireland; its group processes data in the U.S. | Independent controller for the payment; certified under the Data Privacy Framework |
| Resend, Inc. | Sending emails | U.S. | Certified under the Data Privacy Framework |
| Plausible Insights OÜ | Cookieless audience measurement | Estonia (EU) | Data processing agreement, accepted by using the service |
| Hetzner Online GmbH | Backups and alternative access channel to the website | Germany (EU) | Data processing agreement |
| Backblaze, Inc. | Second, encrypted copy of the backups | Data center in the EU; the company is based in the U.S. | Standard contractual clauses |
| GitHub, Inc. | Platform code and list of professional contacts (section 7) | U.S. | Standard contractual clauses |
| Telegram FZ-LLC | Internal notice to the team when an account is created or someone joins the waiting list (email and plan) | Netherlands (EU); the company is based in the United Arab Emirates | Subject to the GDPR as a provider in the EU |
| Tally (Tally BV) | Optional survey at the end of a review | Belgium (EU) | Independent controller for its form |
For transfers outside the European Union we rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses, depending on the provider. You can request a copy of those safeguards at equipo@revisia.es. We send artificial intelligence providers the content needed for the function you request. We will also disclose data when required by law.
4. How long we keep it
- Account and projects: while the account is active. If you request deletion, we delete them within 30 days; until then you can cancel it. Afterwards we keep the data that tax or accounting law requires us to keep and a record of the deletion for a maximum of 24 months.
- Purchase receipts: 6 years (Código de Comercio, the Spanish Commercial Code).
- Security logs: while the account exists.
- Email clicks: 12 months.
- Home page box: 24 hours if you do not confirm; until the process ends if you confirm.
- Professional contacts (section 7): 12 months from when we collect them or from the last contact.
- Audience measurement: aggregated data, 25 months.
- Backups: up to 12 months. Deleted data may remain in them until then.
5. Your rights
You can request access, rectification, erasure, portability, restriction or objection, and withdraw your consent to campaign measurement, by writing to equipo@revisia.es from your account's email address. To delete your account, see Delete your account (in Spanish). We do not make decisions based solely on automated processing that produce legal effects concerning you. You can lodge a complaint with the Spanish Data Protection Agency (AEPD).
6. Age
You must be at least 18 years old to use revisia.
7. Professional contacts obtained from public sources
We may use name, position, organization, field, public academic profiles and institutional email, taken from university websites or professional profiles, to introduce revisia to teaching or research staff. Legal basis: legitimate interest and Article 19 of the LOPDGDD (Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales, the Spanish data protection act). To write the first message we may send that data to our artificial intelligence providers (section 3). You can object at any time by replying "baja" ("unsubscribe") or by writing to equipo@revisia.es.
8. Patient data
revisia processes published literature: do not upload identifiable data of patients or participants. If you use revisia on behalf of an organization and you are going to include personal data of third parties, request our data processing agreement at equipo@revisia.es.
9. Changes
We will publish any change here with its date. If the purpose of any processing changes, we will notify you beforehand.
Last updated: 2026-10-09