SecretWrite

Datenschutzerklärung

Zuletzt aktualisiert: 2026-10-26

Diese Dokumente werden in englischer Sprache bereitgestellt. Die englische Fassung ist rechtsverbindlich.

1. Data controller and contact

This Privacy Policy explains how SecretWrite ("we", "us") collects and uses personal data when you use the Service. We are the data controller for that processing.

For any privacy question or to exercise your rights, contact us at support@secretwrite.com.

2. Data we collect

We collect only what we need to run the Service:

  • Account data: your email address and language preference, managed through our authentication provider.
  • Usage metadata: counts of words processed, the type of action (humanize, detect, generate), model identifiers, and timestamps. We do not store the text you submit (see "Your submitted text").
  • Billing data: your subscription and payment status. Card and payment details are handled by Stripe as Merchant of Record; we do not receive or store your full card details.
  • Technical and security data: IP address, request metadata, rate-limiting signals, and CAPTCHA results, used to keep the Service secure and prevent abuse.
  • Product analytics: four first-party events that measure how new visitors become customers: your first visit (including how you reached us, such as the campaign link or referring website), your first view of the sign-in page, the creation of your account, and your first subscription. We do not record the pages you browse or what you do in the tools. Before you sign in this is not linked to your identity; once you sign in it is associated with your account (see "Cookies and analytics").

3. Your submitted text

When you use the Humanizer, Detector, or Generator, your text is processed in real time by a third-party artificial-intelligence processing provider in order to produce your result.

We do not store the text you submit or the Output after your request is served; we keep only the usage metadata described above. Your text is not used to train artificial-intelligence models, and it is processed subject to the provider's confidentiality terms.

4. Service providers

We use a small number of trusted service providers that process data on our behalf, under contracts that require appropriate safeguards:

  • Supabase: database and authentication.
  • Stripe: payments and Merchant-of-Record services.
  • Resend: transactional email.
  • Cloudflare: content delivery, security, and CAPTCHA.
  • Sentry: error monitoring.
  • PostHog: first-party product analytics.
  • A third-party AI processing provider: generates your Output. For competitive reasons we identify this provider by category rather than by name.

6. International transfers

Some of our providers process data outside the European Economic Area. Where they do, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. How long we keep data

We keep your account data for as long as your account is active, and delete it on account closure or on your request, subject to the exceptions below.

  • Invoices and accounting records are kept for the period required by Spanish tax and commercial law (generally between four and six years).
  • Security and error logs are kept for a short period (around 90 days).
  • The text you submit is not retained.

8. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any of these rights, contact us at support@secretwrite.com.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or with your local supervisory authority.

9. Communications

We currently send only transactional emails (such as sign-in links, receipts, and account or service notices), which are necessary to provide the Service. We do not send marketing emails. If we introduce marketing communications in the future, we will ask for your consent first, and you will be able to opt out at any time.

10. Cookies and analytics

We use essential cookies and a small number of first-party cookies for analytics and attribution, to measure how the Service is used and how visitors reach a subscription. All of them are first-party: we do not use advertising or cross-site tracking cookies, we do not sell your data, and we do not share it for advertising.

  • Authentication cookies: keep you signed in.
  • Security cookies: protect against fraud and abuse, including our CAPTCHA.
  • A first-party analytics identifier: a random id kept for up to 12 months, used to measure how the Service is used and to connect your first visit to your account once you sign in, so we can understand the path from landing page to subscription. A small companion cookie, kept for the same period, only notes which of those first-visit steps were already counted, so each one is counted once; it holds no personal data. Both are first-party and are not used to track you across other websites.
  • A first-party attribution cookie: set on your first visit to record how you found us (for example the campaign parameters in the link you followed, an ad click identifier, or the website that referred you), kept for up to 12 months and used only to credit the right acquisition channel for your subscription.
  • An affiliate referral cookie: set only if you arrive through an affiliate's referral link, kept for up to 60 days, and used solely to attribute your subscription to that affiliate. It does not track you across other websites.

Our analytics are first-party and are used to understand and improve the Service, including how visitors move from their first visit to a subscription. Before you sign in, this measurement is not linked to your identity; after you sign in, it is associated with your account. We do not use these analytics for advertising, and we do not track you across other websites. If we introduce advertising or cross-site tracking in the future, we will ask for your consent through a banner before doing so.

11. Children

The Service is intended for users aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "last updated" date and, where appropriate, notify you of material changes.