1. Data controller and contact
This Privacy Policy explains how SecretWrite ("we", "us") collects and uses personal data when you use the Service. We are the data controller for that processing.
For any privacy question or to exercise your rights, contact us at support@secretwrite.com.
2. Data we collect
We collect only what we need to run the Service:
- Account data: your email address and language preference, managed through our authentication provider.
- Usage metadata: counts of words processed, the type of action (humanize, detect, generate), model identifiers, and timestamps. We do not store the text you submit (see "Your submitted text").
- Billing data: your subscription and payment status. Card and payment details are handled by Stripe as Merchant of Record; we do not receive or store your full card details.
- Technical and security data: IP address, request metadata, rate-limiting signals, and CAPTCHA results, used to keep the Service secure and prevent abuse.
- Product analytics: four first-party events that measure how new visitors become customers: your first visit (including how you reached us, such as the campaign link or referring website), your first view of the sign-in page, the creation of your account, and your first subscription. We do not record the pages you browse or what you do in the tools. Before you sign in this is not linked to your identity; once you sign in it is associated with your account (see "Cookies and analytics").
3. Your submitted text
When you use the Humanizer, Detector, or Generator, your text is processed in real time by a third-party artificial-intelligence processing provider in order to produce your result.
We do not store the text you submit or the Output after your request is served; we keep only the usage metadata described above. Your text is not used to train artificial-intelligence models, and it is processed subject to the provider's confidentiality terms.
4. Service providers
We use a small number of trusted service providers that process data on our behalf, under contracts that require appropriate safeguards:
- Supabase: database and authentication.
- Stripe: payments and Merchant-of-Record services.
- Resend: transactional email.
- Cloudflare: content delivery, security, and CAPTCHA.
- Sentry: error monitoring.
- PostHog: first-party product analytics.
- A third-party AI processing provider: generates your Output. For competitive reasons we identify this provider by category rather than by name.
5. Legal bases for processing
We process your personal data on the following legal bases:
- Performance of our contract with you: to create your account, provide the Service, and send transactional emails.
- Our legitimate interests: to keep the Service secure, prevent abuse, and measure and improve how the Service is used, including understanding which channels and steps lead visitors to subscribe.
- Compliance with a legal obligation: to keep accounting and tax records.
6. International transfers
Some of our providers process data outside the European Economic Area. Where they do, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.
7. How long we keep data
We keep your account data for as long as your account is active, and delete it on account closure or on your request, subject to the exceptions below.
- Invoices and accounting records are kept for the period required by Spanish tax and commercial law (generally between four and six years).
- Security and error logs are kept for a short period (around 90 days).
- The text you submit is not retained.
8. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any of these rights, contact us at support@secretwrite.com.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or with your local supervisory authority.
9. Communications
We currently send only transactional emails (such as sign-in links, receipts, and account or service notices), which are necessary to provide the Service. We do not send marketing emails. If we introduce marketing communications in the future, we will ask for your consent first, and you will be able to opt out at any time.
11. Children
The Service is intended for users aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a new "last updated" date and, where appropriate, notify you of material changes.