Privacy Policy

Version dated 6 September 2026.

This Policy explains which personal data the Alma Mater (Vestnik Vysshey Shkoly) journal website uses, why it is needed and how to contact us about its processing.

1. Data controller

The controller is ООО «ИНОИЦ «АЛМАВЕСТ» (INOIC ALMAVEST LLC), INN 7728782250, OGRN 1117746694548. Address: premises 1B/5, 17B Butlerova Street, Konkovo Municipal District, Moscow 117342, Russia. Privacy contact: almavest@yandex.ru.

This Policy covers visitors, account holders, authors, co-authors, reviewers and people contacting the editorial office. The main website address is www.almavest.ru; during the move, this Policy also covers the working version at new.almavest.ru.

2. Data and purposes

• Accounts and sign-in: email, name, user ID, external sign-in links, a password hash where a password is set, email-verification and session records — for registration, authentication and recovery.
• Purchases: user and article IDs, amount, currency, date, payment reference and status, correspondence — for access, payment records and enquiries.
• Editorial work: author and reviewer names and contacts, affiliations, positions, degrees, scholarly identifiers, co-author information, manuscripts, reviews, decisions and correspondence — for reviewing submissions and preparing publications.
• Scholarly publication: names, affiliations, scholarly identifiers, other bibliographic information and contacts intended for publication — for attribution and dissemination of scholarly works.
• Enquiries and service messages: contacts, message content and delivery records — for replies and notifications about registration, access, purchases and manuscripts.
• Operation and security: IP address, request time and address, browser information, technical identifiers, response status and transferred volume — for operation, diagnostics and abuse prevention.

Data is processed to act on user requests and perform contracts, meet legal obligations, protect legitimate interests without infringing individual rights, and, where necessary, on the basis of separate consent. This Policy provides information; it does not itself constitute consent.

Processing includes collection, recording, organisation, storage, updating, use, access provision, blocking, erasure and destruction, using automated systems and authorised people. Public content is available without an account; withholding data necessary for a particular function may make that function unavailable.

3. Google, ORCID and VK ID

External sign-in is an alternative to email and password. The journal does not receive your external-service passwords.

• Google: openid, email and profile permissions. The account ID, email and name are stored for sign-in and account linking. The standard response may include an avatar URL; the website does not store it. Gmail, Drive, contacts and calendar access is not requested.
• ORCID: /authenticate permission; the website receives your ORCID iD and name if provided. This sign-in does not request your email or permission to modify your ORCID record.
• VK ID: user ID and the first name, surname and email available in the authorised response.

Provider codes and tokens are used to complete sign-in; the website does not retain them for subsequent access to the provider account. Received account information is stored in the journal's account database and used for sign-in, account support and related service functions, not for sale or advertising profiling.

During external sign-in, the browser and server exchange data with the provider, including connection information and authorisation parameters. Google and ORCID are foreign services whose own processing may take place outside Russia. The Google Privacy Policy, ORCID Privacy Policy and VK ID Privacy Policy also apply to their processing.

You can revoke application access in the provider's settings. This does not automatically delete your journal account: contact the Controller to request erasure.

4. Access and publication

Editorial staff, reviewers and technical contractors need access to non-public data within their tasks. The website uses Masterhost hosting, Yandex and Mail email services, external sign-in providers and YooKassa. Staff and reviewers in the editorial process work in Russia; manuscripts are sent by email and working copies are kept locally.

For payments, the website sends YooKassa the amount, order description, return address and internal user and article IDs, and receives the payment reference and status. Full card details and CVC/CVV are not entered in journal forms and must not be emailed to the editorial office.

A registration email does not automatically become public. Published author and article information is accessible to readers, search engines and scholarly directories. Providing co-author data and publishing contact details require an appropriate ground; submitting a manuscript does not authorise publication of all correspondence and attachments. Data is disclosed to public authorities where there is a lawful basis.

5. Cookies and protection

Sign-in uses session cookies: access_token for up to 7 days, refresh_token for up to 30 days, and temporary Google/ORCID sign-in protection cookies for up to 5 minutes. Sessions may end earlier. Disabling necessary cookies prevents sign-in. Browser storage is also used for interface preferences.

ALTCHA verification runs on your device and the website's server. The VK ID widget and navigation to external services generate requests to those services. Protection includes HTTPS, access controls, password hashing and request limits.

6. Retention and erasure

Retention is determined by purpose: account data supports the account; purchase records support paid access, record-keeping and claims; editorial materials support manuscript review, repeat submissions and decision history; technical records support diagnostics and security. Data must not be kept longer than necessary, except where provided by law or contract.

Once the purpose is achieved, the ground ceases to apply or an erasure request is justified, data is erased, destroyed or anonymised unless another lawful ground for retention exists. This also applies to backups under the applicable procedure. Deleting an account does not automatically withdraw a scholarly publication; requests concerning its personal data are considered separately on their merits.

7. Your rights and enquiries

You may request information about processing, correction, blocking or erasure where justified, withdraw consent and complain to Roskomnadzor or a court. Email almavest@yandex.ru with the subject “Personal data”, or write to the address in section 1.

Identify your account and request. Identity verification may be necessary to protect others' data. Do not send passwords, sign-in codes or card details. Requests are handled within statutory time limits; if some data must be retained, the Controller will explain the ground and period.

The website sends only service messages, not advertising mailings, newsletters or subscription offers. The current Policy is published on this page. If a processing change requires fresh consent, publishing an updated text alone is insufficient.

See also the Terms of Use.