Privacy Policy

WINSOR UK LIMITED (“we”, “us”) operates the RevSphere platform. This policy explains what personal data we process, why, and the rights you have under the UK GDPR and EU GDPR. We are the data controller. It applies to the RevSphere website and the RevSphere mobile app, which share one account. For any privacy request, contact support@revsphere.uk.

What we collect

Account and profile information: your name and email address, and a password that is stored only in hashed form by our authentication provider — we never hold it in readable form. Your researcher profile may also carry optional details you choose to add, such as your institution, specialty, biography, username and ORCID iD.

Images you upload: your profile photo and profile cover image, and — if you sign certificates — the signature image you upload for your own use. These are optional; the product works without them.

Files and documents you upload: manuscripts, citation and reference files, project attachments and other documents you add to a project. We store them so that you and the collaborators you invite can work on them.

Research and other content you create: projects, references, screening decisions, extracted data, risk-of-bias assessments, analyses, study identity decisions, reports, manuscripts, editorial decisions and notes.

Course activity: if you take a course, we record your enrolment, lesson progress, video playback sessions, quiz attempts and scores, completions and any certificate issued to you. This is how the course knows where you are and how a certificate can later be verified.

Authentication, security and service records: the sign-ins and devices on your account, whether a second factor was used, security and audit events, and the minimal server logs needed to operate and protect the service. We do not store your IP address: where a network signal is needed to limit abuse it is irreversibly hashed with a server-side secret first, and a device session is identified by a random identifier we issue, never by a hardware or advertising identifier.

We do not collect your location, your contacts, your calendar, your messages, your browsing history, audio or video recordings, or a list of the apps on your device. RevSphere contains no advertising, analytics, attribution or crash-reporting software, and no advertising identifier is requested or used.

How we use it

We use your data solely to provide the platform: to authenticate you, store and sync your projects, enable collaboration you initiate, run the courses you take and issue the certificates you earn, communicate with you about your account, and keep the service secure. We do not sell your data, we do not use it to train third-party AI models, and we do not serve advertising.

Legal bases

We process account, profile, file, research and course data to perform our contract with you (providing the service), and security, audit and logging data on the basis of our legitimate interest in operating a safe platform and meeting our legal obligations.

Storage and security

Data is stored on secure cloud infrastructure with encryption in transit (TLS) and at rest. Sensitive fields such as authentication tokens are additionally encrypted. UK and EU customer data is hosted in the UK/EU region. Access is restricted by role-based permissions and logged.

Sharing

We share data only with the sub-processors needed to run the service (cloud hosting, and, if you enable them, email delivery and sign-in providers). We do not share your research data with anyone else, and we do not sell or transfer your data to third parties for their own purposes. If you invite collaborators to a project, they can see that project’s contents.

Signing in

You can sign in with an email address and password, or with Google — in which case we receive your basic profile and identifier from Google. If your institution has configured single sign-on, we receive the identifier and attributes your institution releases to us. ORCID is not a sign-in method on RevSphere; you may add your ORCID iD to your researcher profile as optional information, and it is stored as part of that profile.

AI features and our AI sub-processor

RevSphere Intelligence is the AI assistance built into RevSphere. When you use it, the text you submit for that request — together with the instructions RevSphere adds to it — is sent to OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.), which processes it on our behalf and returns a result. OpenAI is a sub-processor for this feature and for no other part of the service. Only the content of that request is sent: not your account identity, your email address, your other projects, your uploaded files or your collaborators.

AI features are off by default and are not active for general accounts; nothing reaches any AI provider until you use a feature that says it uses RevSphere Intelligence. RevSphere asks OpenAI not to store the response for later retrieval through its API. We do not claim Zero Data Retention, and we do not claim that training or data sharing is disabled on our account — those depend on settings and contractual terms we will state here only once they have been independently verified. Everything RevSphere Intelligence produces is labelled as AI-generated: it is assistance, never a finding.

Your rights

You have the right to access, correct, export, or delete your personal data, to restrict or object to processing, and to withdraw consent. You can delete your projects at any time, and you can download a copy of your account, profile, settings and course records from the Security screen. You may also complain to the UK Information Commissioner’s Office (ICO).

How to delete your account

Sign in and open Security, then use “Delete my account” in the “Your data” section. Because this is a sensitive action you will be asked to sign in again if your session is not recent, and to confirm a second time. The public page at https://revsphere.uk/account-deletion explains the same steps and can be read without signing in. If you cannot sign in — you have lost access to the mailbox, or the account is locked — write to support@revsphere.uk and we will verify that the account is yours before acting on the request. Email is an assistance channel, not the only way to delete your account.

A deletion request does not take effect immediately. Your account enters a 14-day grace period, during which you can cancel it yourself from the same Security screen and nothing is removed. After the grace period your request is actioned by an authorised member of our team rather than by an automatic timer, so it is carried out shortly after the fortnight ends rather than at the instant it expires. Write to support@revsphere.uk if you want the request confirmed, or actioned sooner. Deletion is refused, with an explanation, while you are the only owner of a project, the only creator of a course, or the last remaining platform administrator, and it can be paused where a legal or research hold applies.

What deletion removes, and what it keeps

Deleted outright: your public researcher profile and profile photo; your email address, language, timezone, theme and notification preferences; your sessions; your course playback sessions and quiz attempts; your personally generated review artefacts and personal report bundles. Your usernames are released and held unassigned for 90 days so that nobody can immediately take your identity. Each step is recorded, including any that could not be completed.

Kept, with your identity replaced by a stable pseudonym: shared research records — screening decisions, extractions, risk-of-bias assessments, analyses, study identity history, reports and editorial decisions — because they are the scientific provenance of projects other people also rely on, and deleting them would rewrite a shared evidence trail. Course enrolment, progress and completion records are kept on the same basis, and certificates you were awarded are preserved so they remain verifiable, with the name on them replaced and public display switched off. Security, audit and fraud-prevention events, and any record we are required to retain for legal or compliance reasons, are kept for their retention period. We do not claim that everything associated with your account is erased, because it is not: what remains is kept without identifying you.

Data retention

We keep your data while your account is active. When you delete a project, everything it contains is removed from live systems — imported references, screening decisions, studies, extracted data, risk-of-bias and GRADE assessments, analyses, reports and uploaded files. Deletion begins immediately and finishes in the background, usually within minutes; until it finishes the project is marked as being deleted and nobody can open it. When you delete your account, the personal identifiers and personal artefacts listed above are removed from live systems, and the shared, certificate, audit and compliance records listed above are retained under a pseudonym for as long as the purpose or the law requires. Encrypted backups are rotated on a rolling schedule, so a deleted record can persist in a backup until that backup is superseded.

How to contact us

WINSOR UK LIMITED, United Kingdom. Email: support@revsphere.uk.