Privacy policy

1. Scope of this policy

This policy explains how Writibot, Inc. handles personal information when you visit our website, create an account, and use the Writibot AI writing workspace. It covers the app, our marketing pages and the emails we send you, and it applies wherever you are. Writibot, Inc. is the controller of the information described here.

If you use Writibot through an organisation, such as your employer or your school, that organisation decides what goes into the workspace and how long it is kept; we process that content on their instructions, and a signed agreement with them takes precedence over this policy. Third-party tools you connect or paste output into have policies of their own.

2. Information we collect

We try to collect the minimum that makes the product work. In practice it falls into five groups:

• Account details. Your name, email address, password stored as a salted hash, workspace name, interface preferences, and the addresses of colleagues you invite.
• Billing details. Your plan, billing country, invoice history and any tax identifiers you give us. Card numbers are entered into and held by our payment processor; we never see or store full card details.
• The content you write and generate. Prompts, briefs, uploads, drafts, rewrites, templates, tone and style presets, and the results of the built-in checks you run on a draft.
• Usage and device data. Which features you use and when, approximate location derived from your IP address, browser and operating system, and diagnostic logs and error reports.
• Support messages. What you write to us by email or in the app, plus the account context we need to answer you properly.

We never ask for special-category information such as health details or political views. If it ends up in a draft anyway, it gets the same protections as everything else you write.

3. How we use information

Every use below maps to something you would expect from a writing tool you pay for:

• Running the service. Creating your account, generating and saving drafts, syncing presets, running the built-in checks and delivering your exports.
• Billing. Taking payment, issuing invoices, applying the right tax, handling failed payments and preventing payment fraud.
• Support. Answering your questions, reproducing problems you report, and following up once we have fixed them.
• Security and abuse prevention. Detecting suspicious logins, rate-limiting, investigating misuse and keeping audit logs of administrative access.
• Product improvement. Understanding in aggregate which features are used and where people get stuck, so the next version is better than this one.
• Communication. Service notices, billing alerts and security warnings, plus product news if you opted in, which you can leave at any time.

Improving the product means studying aggregated, de-identified usage patterns and the problems you report. It does not mean browsing your drafts or training models on them.

4. Model training

We do not use your content to train AI models. Your prompts, uploads, drafts and generated text are not added to any training set of ours, and our contracts require the model providers we work with not to use content sent through Writibot to train or fine-tune their models either. This is the default on every plan, free and paid, and you do not have to switch anything on to get it.

If we ever want to offer training on customer content, for instance to build a model that learns your house style, it will be strictly opt-in: off unless you deliberately turn it on, explained clearly before you decide, limited to the workspace that enabled it, and reversible afterwards. We will not enable it quietly, and we will never treat continued use of the service as consent for it.

A small number of our staff can reach customer content when you ask for help with a specific document, or when we are investigating a security incident or a report of abuse. That access is logged and used only for the purpose that triggered it.

5. Legal bases

If you are in the United Kingdom, the European Economic Area or another region with similar law, we rely on the following legal bases:

• Performance of a contract. Providing the workspace, saving your work, taking payment for the plan you chose and supporting you when something goes wrong.
• Legitimate interests. Keeping the service secure, preventing fraud and abuse, understanding aggregate usage to improve the product, and sending service-related messages. We weigh these against your rights and pick the least intrusive option that works.
• Consent. Optional analytics cookies where consent is required, marketing emails, and any future opt-in feature such as training on your content. You can withdraw consent at any time without affecting what came before.
• Legal obligation. Keeping tax and accounting records, and responding to valid legal requests we are required to answer.

6. Sharing and sub-processors

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do rely on service providers to run Writibot, each bound by a contract that limits them to our instructions and requires appropriate security. By category, they are:

• cloud hosting and storage, where the application and your content live
• AI model providers, which process the text needed to generate a response, without using it for training
• payment processing, which handles card details, subscriptions and invoices
• product analytics and error monitoring, which tell us how features perform and when something breaks
• email delivery, for service notices, receipts and any newsletter you opted into

We may also disclose information where the law requires it, to protect our rights or the safety of a person, or in connection with a merger or acquisition, in which case we would tell you before your information became subject to a different policy. We keep a current list of the specific sub-processors we use and will send it on request to privacy@writibot.com.

7. International transfers

Writibot is a remote-first company and our providers operate in more than one country, so personal information may be processed outside the country where you live, including in the United States.

When information leaves the United Kingdom or the European Economic Area, we use a lawful transfer mechanism, normally the standard contractual clauses adopted by the European Commission together with the UK addendum, backed by encryption in transit and at rest and strict access controls. We assess a provider and the legal environment it operates in before we send anything there, and we will tell you which mechanism applies if you ask.

8. How long we keep information

We keep information for as long as it serves the purpose we collected it for, and then we delete it:

• Your content. Drafts, prompts and presets stay in your workspace until you delete them or close your account. There is no automatic expiry, because half-finished writing has a habit of becoming useful again.
• Deleted items. When you delete something it leaves your workspace immediately and is removed from our active systems. Backups rotate on a rolling schedule, so deleted content is fully purged from backups within 30 days.
• Account data. After you close your account we delete or irreversibly anonymise the remaining account records within 90 days.
• Billing records. Invoices and payment records are kept for up to seven years, because tax and accounting law requires it.
• Logs. Security and diagnostic logs are kept for up to twelve months and then deleted on a rolling basis.

If a legal claim or an active investigation requires us to hold something longer, we keep only what is necessary for that purpose and delete it once the matter closes.

9. Security

Protecting your writing matters to us, so here is what we actually do rather than a badge to look at:

• traffic between you and Writibot is encrypted in transit with TLS, and content is encrypted at rest on our storage
• access to production systems is limited to the people who need it, granted on a least-privilege basis, protected by multi-factor authentication and reviewed regularly
• administrative access to customer content is logged, and used only for support you have asked for or for investigating security and abuse
• passwords are stored as salted hashes, so we never hold them in a form anyone here could read
• development and production environments are kept separate, dependencies are patched, and changes are reviewed before they ship

No system is perfectly secure and we will not pretend otherwise. If a breach affects your personal information, we will notify you and any relevant regulator without undue delay and explain what we are doing about it. There is more detail on our security page.

10. Your rights and controls

Depending on where you live, you have some or all of the following rights over your personal information:

• Access. Ask what personal information we hold about you and receive a copy of it.
• Correction. Fix anything inaccurate or incomplete, most of which you can edit yourself in settings.
• Deletion. Ask us to delete your account and its content. Individual drafts you can delete yourself at any time.
• Export. Download your drafts and account data in a portable format you can take elsewhere.
• Objection and restriction. Object to processing based on legitimate interests, or ask us to pause it while a question is resolved.
• Withdraw consent. Turn off optional analytics or unsubscribe from marketing, without affecting anything you agreed to before.

Several of these are a click away in your account settings. For anything else, write to privacy@writibot.com from the address on your account and we will respond within 30 days. We will never charge you or treat you differently for exercising a right. If our answer disappoints you, you can complain to your local data protection authority, though we would appreciate the chance to put it right first.

11. Cookies and analytics

We use a small number of cookies and similar technologies. Strictly necessary cookies keep you signed in, remember which workspace you are in and protect against cross-site request forgery; the product does not function without them. Preference cookies remember choices like your language and interface settings.

We also use privacy-conscious product analytics to see which features are used and where people run into trouble. Where consent is required we ask before setting analytics cookies, and you can change your answer whenever you like. We do not run advertising trackers and we do not build advertising profiles about you. You can clear or block cookies in your browser settings, though blocking strictly necessary ones will stop you signing in.

12. Children's privacy

Writibot is not designed for children. You must be at least 16 years old to create an account, as set out in our terms of service, and we do not knowingly collect personal information from anyone younger.

If you believe a child has given us personal information, write to privacy@writibot.com and we will delete the account and its content promptly. Where a school or an educator uses Writibot with older students, the school is responsible for obtaining any consent its jurisdiction requires.

13. Changes to this policy

We will update this policy when our practices, our providers or the law change. The date at the top of this page shows when the current version took effect, and any notice we send includes a plain-language summary of what changed.

If a change is material, for example a new purpose for using your content or a new category of sharing, we will tell you by email or in the product at least 30 days before it takes effect, so you have time to read it, ask us about it, or close your account. We will not make a material change quietly.

14. Contact

If you have a question about your privacy, want to exercise one of the rights above, or think we have got something wrong, write to our privacy team at privacy@writibot.com. A person reads that inbox, and we aim to reply within a few working days and always within 30 days. Your message reaches Writibot, Inc., the company behind Writibot.

You may also want to read our terms of service for the rules that govern the product, or our security page for more on how we protect what you write.