Handwrite
Get started

Privacy Policy

What we collect, why we collect it, and the rights you have over it, written to be read rather than skimmed past.

Last updated: July 21, 2026

1. Why read this

This policy explains how Handwrite handles personal data across our public website, the free guest tools, and the paid member area that runs under the same brand. It covers what we collect, what we do with it, how long we keep it, who we share it with, and how you can exercise your rights.

We have tried to keep the language plain. If anything here is unclear, or you think our practice does not match what we describe, write to support@handwrite.ai and we will sort it out.

2. Who we are

Handwrite provides an AI detector, which estimates how a piece of text reads, and an AI humanizer, which helps AI drafts sound natural. The service is web only: there is no mobile app. We are the data controller for the processing described in this policy.

For any privacy question or request, contact us at support@handwrite.ai.

3. What we collect and why

We collect only what each purpose actually needs. Each block below describes one purpose: the data involved, why we process it, the legal basis under Article 6 GDPR, and how long we keep it.

Account and login data

What
Your name, email address, and password details when you create an account in the member area.
Why
To create your account, sign you in securely, and provide the features you subscribed to.
Legal basis
Contract (Art. 6(1)(b) GDPR): we cannot run your account without it.
Retention
While your account is active, and up to 5 years after your last login. After that we delete or anonymize it.

Order and billing data

What
Your plan, order history, and invoicing details. Card payments run through our payment providers; we never see or store full card numbers ourselves.
Why
To take payment for subscriptions, issue invoices, and meet bookkeeping and tax obligations.
Legal basis
Contract and legal obligation (Art. 6(1)(b) and (c) GDPR).
Retention
As long as tax and accounting law requires us to keep records, up to 10 years.

Trial fair-use signals

What
When you start a trial: your email address in normalized form, the network (IP) address the purchase was made from, and a payment-method identifier. For cards that is a reference our payment processor derives from the card (never the card number itself, which we cannot see); for Cash App or Link it is the handle or email tied to that payment method.
Why
To enforce our one-trial-per-person-and-household policy and prevent repeated trials on the same payment method, inbox, or connection. If the signals match an earlier trial, the new trial's free daily allowances are paused; nothing is charged and support can review any mistake.
Legal basis
Legitimate interest (Art. 6(1)(f) GDPR): preventing abuse of a promotional offer.
Retention
Network addresses are only compared against trials from the last 30 days. The signals themselves are retained for as long as we operate the trial program, including after an account is deleted: keeping them is what prevents a deleted account from immediately claiming a second trial. They are used for no other purpose.

The text you submit to the tools

What
The writing you paste into the detector or humanizer, and the result we produce from it.
Why
Only to produce the analysis or rewrite you asked for. Your text is shared with AI model providers acting as our processors under contract. It is never used to train models and never sold. The content stays yours.
Legal basis
Contract (Art. 6(1)(b) GDPR): processing the text is the service.
Retention
Only as long as needed to deliver your result, unless you choose to save it in your account, in which case it stays until you delete it or close the account.

Support inquiries

What
Your message, your email address, and any account details needed to help you.
Why
To answer your question, fix problems, and keep a record of what we agreed.
Legal basis
Consent and legitimate interest (Art. 6(1)(a) and (f) GDPR).
Retention
Up to 3 years after the conversation is closed.

Usage and device data

What
IP address, browser type, device information, pages visited, and rough timing of requests.
Why
To keep the service secure, prevent abuse of the free quota, debug problems, and understand which parts of the product need improving.
Legal basis
Legitimate interest (Art. 6(1)(f) GDPR); consent where local law requires it.
Retention
Raw logs for up to 12 months. Anything kept longer exists only in aggregated form that no longer identifies you.

Marketing emails

What
Your email address and which of our messages you open.
Why
To send product news and offers, only if you asked for them. Every email includes a working unsubscribe link.
Legal basis
Consent (Art. 6(1)(a) GDPR). Marketing is never a condition of using the service.
Retention
Until you unsubscribe or withdraw consent.

4. Who we share data with

We do not sell personal data. We share it only with service providers who help us run the product, and only as much as each one needs. The categories are:

  • Payment processors, who handle subscription payments for the member area. Card details go to them directly; we never store full card numbers.
  • Cloud hosting and infrastructure providers that run our servers and store our data.
  • Email providers that deliver account, receipt, and (with your consent) marketing messages.
  • AI model providers, who process the text you submit as our processors under contract, solely to produce your analysis or rewrite.
  • Accountants, lawyers, and auditors, where professional or legal duties require it.
  • A buyer or successor if the business is sold or merged, in which case this policy continues to apply to your data.

Some of these providers operate outside the European Economic Area. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or another safeguard recognized under GDPR Chapter V.

5. Your rights

Under the GDPR you can, at any time and free of charge:

  • Access. Ask for a copy of the personal data we hold about you.
  • Rectification. Have inaccurate or incomplete data corrected.
  • Erasure. Ask us to delete your data when we no longer have a valid reason to keep it.
  • Restriction. Ask us to pause processing while a dispute about your data is resolved.
  • Portability. Receive the data you gave us in a common machine-readable format, or have it sent to another provider where technically feasible.
  • Objection. Object to processing based on our legitimate interests, including any direct marketing.
  • Withdraw consent. Where processing relies on your consent, withdraw it at any time. This does not affect processing that already happened.
  • No purely automated decisions. Not be subject to a decision with legal or similarly significant effects that was made solely by automated means.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one in the country where you live or work. We would appreciate the chance to resolve the issue first, but you do not have to give us one.

6. Cookies and local storage

Cookies are small files a website stores in your browser so it can recognize you between page loads. Browsers also offer local storage, a similar mechanism for saving small pieces of data on your device.

Our use is deliberately minimal. Session and security cookies are used in the member area, to keep you signed in safely. This public site sets no cookies at all today: it uses only browser local storage for preferences, such as your theme choice and how many free guest uses of the tools remain on your device. These strictly necessary items are required for the service to function and do not need consent.

We do not currently run analytics, advertising, or other tracking cookies on this site. If we ever introduce them, we will ask for your consent first and list each one here with its purpose and lifetime.

You can inspect, block, or delete cookies in your browser settings. The official guides:

Blocking strictly necessary items may stop parts of the site from working, such as staying signed in to the member area.

7. How to make a request

Email support@handwrite.ai and tell us which right you want to exercise. To protect your data we first verify that the request really comes from you, usually by confirming control of the email address on the account. We respond within one month; if a request is unusually complex we may extend that by up to two further months, and we will tell you if so.

You can also act through an authorized agent. The agent must provide your written permission, and we may still confirm the request with you directly. Parents and legal guardians may submit requests on behalf of their minor children.

8. Automated decision-making

We do not make decisions that produce legal effects, or similarly significant effects, about you based solely on automated processing. The detector's score is an estimate we display to you; it is not a judgment we act on, and nothing about your account is decided by it.

One automated check we do run: when a trial starts, the fair-use signals described in section 3 are compared against earlier trials. A match pauses the new trial's free daily allowances. This never charges you, never removes your account or content, and is not a solely automated decision with significant effects: paid access is unaffected, and you can always ask a human to review the outcome via support.

9. California residents

If you live in California, the CCPA gives you additional rights over your personal information:

  • Know and access the categories and specific pieces of personal information we have collected about you.
  • Correct inaccurate personal information we hold about you.
  • Request deletion of your personal information.
  • Receive your data in a portable format where technically feasible.
  • Opt out of the sale or sharing of personal information. To be plain: we do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
  • Not be discriminated against for exercising any of these rights. Your service stays the same either way.

Submit a verifiable request to support@handwrite.ai. The identity verification and agent rules in section 7 apply to CCPA requests too.

10. Changes to this policy

When our practices change, we update this page and revise the date at the top. For material changes that affect account holders, we will also give notice on the site or by email before the change takes effect. Questions are always welcome at support@handwrite.ai.