Privacy policy

We process personal information to operate, secure, improve, and bill for the Services; to communicate with you; and to comply with law. We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where changes are material, provide additional notice as described in the “Changes” section.

This Privacy Policy applies to personal information we process in connection with the Services. It does not apply to information processed solely by third parties under their own policies (for example, a payment processor’s privacy notice for card transactions, or a social network you use to authenticate), except where we jointly determine processing with a partner and law requires otherwise.

If you access the Services on behalf of an organization, that organization is typically the controller of personal information submitted through its workspace, and we act as a processor or service provider to the organization as described in your agreement with us. Where you use the Services only for yourself, we typically act as a controller of account and usage data as described in this policy.

• Personal information means information that identifies or relates to an identified or identifiable individual, or that is otherwise treated as personal data or personal information under applicable law.
• Usage information means technical and engagement data generated by your device or your use of the Services (for example, log data, approximate location derived from IP address, and feature usage).
• Content means text, files, prompts, settings, or other materials you submit to the Services, including AI inputs and outputs associated with your account.

We collect information:

• Directly from you when you create an account, use features, upload Content, or contact us.
• Automatically through cookies, SDKs, server logs, and similar technologies.
• From third parties as described above, where permitted by law and contract.

Depending on the context, we use personal information to:

• Provide, operate, maintain, personalize, and improve the Services.
• Create and administer accounts, authenticate users, and process transactions.
• Provide customer support, respond to inquiries, and send service-related notices.
• Monitor usage, troubleshoot errors, detect and prevent fraud, abuse, and security incidents.
• Develop new features, conduct analytics, and measure the effectiveness of the Services.
• Send marketing communications where permitted, including information about features, offers, and events, subject to your choices.
• Comply with legal obligations, enforce our terms, and protect rights, safety, and property.
• Aggregate or de-identify information where permitted, so it no longer reasonably identifies you, and use it for research, benchmarking, and product improvement.

Where we rely on consent (for example, certain cookies or marketing in some regions), you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on one or more of the following legal bases, as applicable:

• Contract: processing necessary to perform our agreement with you (for example, providing the Services you requested).
• Legitimate interests: processing necessary for our legitimate interests that are not overridden by your interests or fundamental rights (for example, securing the Services, improving reliability, fraud prevention, and internal analytics), where permitted by law.
• Legal obligation: processing necessary to comply with applicable law.
• Consent: where we ask for your consent for a specific activity.

You may have the right to object to certain processing based on legitimate interests, and to lodge a complaint with a supervisory authority. See “Your privacy rights and choices.”

The Services use artificial intelligence systems, which may be hosted or operated by third-party providers. When you submit prompts or Content, that information may be transmitted to those providers to generate outputs. Providers may impose their own technical, safety, and logging requirements.

Depending on your plan, product settings, and applicable law, we may use prompts, outputs, and related metadata in de-identified or aggregated form, or under contractual safeguards, to improve model quality, detect misuse, and evaluate product performance. We do not use your Content to train third-party foundation models except where permitted by your settings, our agreements with you, and applicable law. If we offer plan-specific controls (for example, opting out of certain training or logging uses), those controls will be described in-product or in Supplemental Terms.

You should avoid submitting sensitive categories of personal information in prompts unless you have a lawful basis and any required agreements with us. Outputs may contain errors; do not rely on outputs as factual or complete without verification.

We use cookies and similar technologies for essential operations (for example, session authentication and security), to remember preferences, to understand how the Services are used, and for marketing where permitted. We may use first-party and third-party cookies.

You can control cookies through your browser settings. Blocking certain cookies may limit functionality (for example, staying signed in). Third-party sites linked from the Services may set their own cookies; this policy does not govern those technologies.

Where required, we will obtain consent before using non-essential cookies and provide a cookie banner or preference center consistent with local law.

We may share personal information in the following circumstances:

• Service providers and subprocessors who assist us with hosting, infrastructure, analytics, customer support, email delivery, security monitoring, fraud prevention, and payment processing, subject to contractual obligations.
• AI and data providers that power features you use, to the extent necessary to provide those features.
• Your organization if you use a team or enterprise workspace, your administrator may access usage and billing information consistent with the product design.
• Professional advisors such as lawyers and accountants under confidentiality obligations.
• Business transfers as described below.
• Legal and safety when we believe disclosure is necessary to comply with law, regulation, legal process, or governmental requests; to enforce our terms; to protect the rights, property, or safety of Writingful, our users, or the public; or to detect, prevent, or address fraud, security, or technical issues.
• With your direction or consent, such as when you enable an integration or publish content publicly.

We do not sell your personal information for money. We do not rent your contact lists to data brokers for their independent marketing. Where privacy laws define “sale” or “sharing” broadly (for example, certain digital advertising activities), we disclose those activities and your choices in the United States state section where applicable.

We may process and store information in the United States and other countries where we or our service providers operate. Those countries may have data protection laws that differ from the laws of your country.

When we transfer personal information from the EEA, UK, or Switzerland to countries not deemed to provide an adequate level of protection, we use appropriate safeguards such as standard contractual clauses approved by relevant authorities (and supplementary measures where required), or other lawful transfer mechanisms.

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Criteria used to determine retention include whether you have an active account, whether we have an ongoing relationship with you, whether retention is needed for legal claims or compliance, and whether information can be aggregated or de-identified.

Free plan content. Articles and other content you create while on the free plan are automatically and permanently deleted three (3) months after they were created, including if you later upgrade. Content created on a paid plan is retained until you delete it or close your account. You can export a copy of your content from the editor at any time before it is deleted.

When you delete your account or Content where the product supports deletion, we will delete or de-identify information within a reasonable period, subject to backup retention and legal holds. Some residual copies may persist for a limited time in backups before automatic rotation.

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. These measures may include encryption in transit, access controls, logging, vulnerability management, and employee training.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your credentials and for notifying us of suspected unauthorized access.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information; to restrict or object to certain processing; to withdraw consent where processing is based on consent; and to lodge a complaint with a supervisory authority. You may also have rights related to automated decision-making where applicable law provides them.

To exercise rights, contact us using the methods in “Contact us.” We may need to verify your identity before fulfilling requests. If you are an end user of an organization’s workspace, we may refer your request to that organization where appropriate.

If you are in the EEA, UK, or Switzerland and we act as a processor on behalf of your organization, your organization may be responsible for receiving and honoring certain requests; we will assist as required by contract and law.

Several U.S. states provide residents with additional privacy rights. Depending on your state of residence and whether we meet applicable thresholds, you may have rights to access, delete, correct, obtain a copy of, or opt out of certain processing of personal information, including targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects (where those terms are defined by local law).

We describe our practices in this policy and provide contact methods for requests. We will not discriminate against you for exercising rights granted by law, except where permitted (for example, if a different price is reasonably related to the value of your data and disclosed in advance).

If your state provides an appeal process for denied requests, we will provide appeal instructions in our response where required.

We may send transactional messages (security alerts, receipts, product updates that affect your use, and legal notices). We may also send marketing emails or in-product messages where permitted.

You can opt out of marketing communications by using the unsubscribe link in emails or adjusting notification settings in your account, where available. You cannot opt out of certain essential service notices while maintaining an active account.

The Services are not directed to children under 13 (or the age required by local law), and we do not knowingly collect personal information from children for those Services. If you believe we have collected information from a child without appropriate authorization, contact us and we will take appropriate steps to investigate and delete such information where required by law.

The Services may contain links to third-party websites or allow you to connect integrations (for example, publishing or storage tools). Those third parties have their own privacy practices. We encourage you to read their policies before providing information or enabling access.

If you enable an integration, we may exchange information with that provider as directed by your settings. The integration’s privacy notice governs its independent processing where it acts as a separate controller.

If you choose to post reviews, comments, forum messages, portfolio items, or other content visible to other users, that information may be public and may be read, collected, or used by others outside our control. Usernames, display names, and profile fields you make public may be shown alongside your activity.

If you provide a testimonial or case study, we may display it on our websites or marketing materials with your consent (or, for organizational customers, as permitted by your agreement with us). You may ask us to remove published testimonials where we are able to do so.

We may invite you to participate in surveys, beta programs, or user research. Participation is voluntary. Information you provide may be used to improve the Services and may be aggregated with other responses. If research involves recording sessions or collecting special categories of data, we will provide additional disclosures and obtain consent where required.

We use automated systems to provide AI features, detect abuse, route support requests, and personalize parts of the Services. We do not use solely automated decision-making that produces legal or similarly significant effects about you without human oversight, rights, or disclosures where such practices are required by applicable law.

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will take steps to require the successor to honor this Privacy Policy or notify you of changes as required by law.

We do not sell personal information for monetary consideration. Certain laws treat some disclosures of personal information to advertising partners as a “sale” or “sharing” for cross-context behavioral advertising. Where we engage in activities that could be characterized that way under local law, we will provide the legally required controls and disclosures.

We use analytics tools to understand how visitors and customers use our websites and applications (for example, page views, funnels, feature adoption, and crash rates). These tools may set cookies or read device identifiers and may receive IP addresses and usage events.

Where we run advertising campaigns, we may use ad platforms that collect or receive identifiers and conversion events to measure performance and, where permitted, to deliver or personalize ads. You may control certain ad tracking through device and browser settings and industry opt-out tools where available in your region.

Some privacy laws define special categories of sensitive personal information (for example, government identifiers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic data, biometric data used for identification, health information, and sexual orientation or sex life data). We do not ask you to provide sensitive information to use the Services, and you should not include it in prompts or uploads unless you have a lawful basis and any required agreements with us.

If you are a California resident and we collect sensitive personal information as defined under applicable law, we will use it only for permitted purposes and provide any required notices and limit-use obligations.

If you use the Services under a team, company, or other organization, your administrator may be able to access, export, restrict, or delete information associated with your use of the workspace, subject to product functionality and the organization’s policies. The organization is typically responsible for end-user notices and for honoring privacy rights requests that relate to workspace data.

If your account was created or is managed by an administrator (for example, single sign-on), certain profile fields and access controls may be governed by that organization’s settings.

We may disclose personal information when we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or governmental requests, including to meet national security or law enforcement requirements. We may also disclose information where necessary to enforce our agreements, to investigate potential violations, or to protect the rights, property, or safety of Writingful, our users, or the public.

Where permitted by law, we may seek to notify users about governmental requests for their information unless prohibited by law or court order, or unless notice would be futile or would create a risk of harm.

We may update this Privacy Policy to reflect changes to our practices, technologies, legal requirements, or other factors. We will post the updated policy on this page and update the “Last updated” date. If changes are material, we will provide additional notice (for example, by email or in-product message) where required by law.

If you have questions about this Privacy Policy or want to exercise privacy rights, contact us through the support or contact options on writingful.com.