Privacy Policy

Last updated: 14 October 2026

1. Who We Are

ScriptGrain is operated by Adapt Progress Evolve Limited, registered in England and Wales (company number 10047328, registered office 5 Brayford Square, London E1 0SG, VAT GB362654684). For any privacy-related enquiries, contact us at support@scriptgrain.com.

2. What We Collect

We collect the following data:

• Account information: email address, hashed password, and how you arrived when you created the account: the page you landed on, the site that referred you, any campaign tags in the link, and which button you used. We keep this so we know which channels bring writers to ScriptGrain; opting out of statistics (section 8) also stops it being recorded.
• Writing samples: text you upload for voice analysis
• Voice profiles: the stylometric analysis generated from your samples
• Generated content: text produced using your voice profile
• Payment information: processed securely by Stripe, we do not store card details
• Usage data: pages visited, features used, timestamps. On our public marketing and blog pages we collect anonymous, first-party statistics about how the site is used: the page, the referring site, device type (phone, tablet or desktop), country, which buttons were clicked, and the size band of a sample pasted into the homepage preview. There are no cookies, no IP addresses, no personal identifiers, and nothing is stored on your device: a random number kept in the page's memory groups one visit's page views and is forgotten when you leave. We never collect the writing itself. These statistics are used only to improve the site, under the statistical-purposes exception in UK privacy law (PECR as amended by the Data (Use and Access) Act 2025), and you can opt out in section 8.
• Product analytics (consent-based): if you accept analytics in the cookie banner, we use PostHog (hosted in the EU) to understand how the product is used: feature usage events, page interactions, and error reports. Events are linked to a pseudonymous account identifier, not your email or name. If you decline, PostHog sets no cookies and sends nothing.
• Device check on the free plan only: when you use a free voice analysis or the free draft, your browser computes a device identifier which we immediately convert into a salted, irreversible hash. We store only that hash, alongside a salted hash of your IP address, to stop one person claiming the free plan repeatedly under new accounts. We cannot turn either hash back into your device or your location, they are never shared with anyone, and no device check runs on a paid plan.

3. How We Use Your Data

• To provide the ScriptGrain service, analysing your writing and generating content in your voice
• To process payments and manage your subscription
• To send transactional emails (account confirmations, payment receipts, profile notifications)
• To improve the Service based on aggregated, anonymised usage patterns
• To prevent abuse of our free plan, which costs us real money to run, using the salted device and IP hashes described above (our legitimate interest in keeping a free tier available at all)

4. AI Processing

Your writing samples are processed by third-party AI providers, always server-side: Anthropic (the Claude API) performs the stylometric analysis and content generation, and Voyage AI computes text embeddings (numerical similarity fingerprints) used to match generated drafts to your voice. We never use your data to train AI models, and the commercial terms we contract under forbid these providers from training on it. Their own retention is governed by their terms with us, which we hold them to but cannot audit.

5. Data Sharing

We do not sell your data. We share data only with:

• Supabase: our database, authentication, and storage provider; your account data and content are stored in Supabase's cloud, hosted in the EU (Ireland)
• Anthropic (Claude API): for AI-powered analysis and generation
• Voyage AI: for text embeddings used to match generated drafts to your voice
• Stripe: for payment processing
• Firecrawl: for URL content import (Writer plan and above)
• Resend: for delivery of account, billing, and notification emails
• PostHog (EU): for consent-based product analytics and error tracking
• Cloudflare: hosts our website; as our hosting provider it processes visitor IP addresses to serve pages and protect against abuse

Our typefaces are served from our own domain, so loading a page does not send your IP address to Google or any other font host.

AI assistants and connectors you authorise. ScriptGrain has a public API and an MCP server, so you can connect your account to a third-party AI assistant (for example Claude or Meta Muse). When you approve such a connection, either by signing in on our consent page or by pasting an API key, that assistant can read your voice profiles and generated drafts and can create profiles and drafts on your behalf, within your plan's credits. Anything the assistant retrieves is then held and processed by its provider under that provider's own terms and privacy policy, which we do not control and cannot audit. We record which connections you have approved and when each key was last used. You can revoke a connection at any time in Settings under API, which ends its access immediately. We do not share your data with an assistant you have not connected.

6. Data Retention

Your data is retained for as long as your account is active. If you delete your account, your writing samples, voice profiles, generated content, subscription, and usage records are erased immediately as part of the deletion, and the product analytics records PostHog holds about you (your person record and its events) are erased with them. Anonymised usage statistics, which contain no personal identifiers, may be retained for analytics purposes.

Guest sessions started by an AI assistant: an AI assistant can measure someone's writing voice before they have an account by starting a guest session through our API or MCP server. The writing the assistant sends and the voice profile built from it are held in a guest workspace with no name or email address, and we keep a salted hash of the network address that started the session for up to two days, only to enforce limits. The assistant is given a claim link for the person, where they can keep the profile in a free account or delete the session. A session that is not claimed within 7 days is archived: the assistant's access ends, and the writing and profile are kept with no time limit so the person can still claim them later. Archived sessions are never deleted automatically. They are deleted, completely and immediately, only when the person chooses Delete this instead on the claim link.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability, receive your data in a structured format

You can delete your account and all associated data yourself at any time from your account settings (Danger Zone, then Delete Account). This erases your profiles, samples, generated content, subscription, and usage records immediately, and cancels any active subscription. You can also download a structured copy of your data from the same page before deleting.

To exercise any of these rights, or for help with deletion, you can also email support@scriptgrain.com.

8. Cookies

ScriptGrain uses essential cookies for authentication and session management. We do not use advertising cookies. Our first-party visitor statistics (section 2) are anonymous, cookie-free and store nothing on your device, so they run whether or not you accept the banner; you can switch them off for this browser with the opt-out control in this section of the privacy page, which stores a single opt-out flag, the only thing we then keep on your device for statistics. If you accept analytics in the cookie banner, PostHog stores an analytics cookie to recognise return visits; declining (or never accepting) means no analytics cookie is ever set, and you can change your mind by clearing site data for scriptgrain.com. Change on 2 September 2026: before this date the anonymous statistics used a per-tab value in your browser's session storage and were switched off by Decline; they now store nothing and are controlled by the opt-out above.

9. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS), encrypted storage, and row-level security on all database tables. Despite our best efforts, no system is 100% secure.

10. International Transfers

We are based in the United Kingdom and your account data is stored in the EU (Ireland). Some of the providers listed in section 5 process data outside the UK, chiefly in the United States: Anthropic and Voyage AI (analysis, generation and embeddings), Stripe (payments), Firecrawl (website import), Resend (email), and Google (sign-in, only if you choose to sign in with Google). Cloudflare serves the site from its global network. Where personal data leaves the UK we rely on the safeguards UK law provides: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses with each provider, or an adequacy decision where one applies (as it does for the EU). Your rights under UK GDPR (section 7) apply wherever the data is processed.

11. For Residents of California and Other US States

If you live in California or another US state with a consumer privacy law, this section applies to you in addition to the rest of this policy.

What we collect and why. Identifiers (your email address and a pseudonymous account identifier); commercial information (your plan and payment history, held by Stripe); the writing you upload and the content we generate for you; internet activity (the anonymous site statistics and, only if you accept the banner, product analytics); and inferences about your writing style (your voice profile). We collect it for the purposes in section 3: to provide the service, to bill you, to send account email, to improve the service, and to prevent abuse of the free tier.

No sale, no sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We never have, and we will not. We do not knowingly collect personal information from anyone under 18.

Your rights. You have the right to know what personal information we hold about you and to receive a copy, to correct it, to delete it, to opt out of any sale or sharing (there is none), and not to be discriminated against for exercising these rights. You can delete your account and download your data from your account settings at any time, or email support@scriptgrain.com. We verify requests by confirming control of the account email address and answer within 45 days. You may use an authorised agent to make a request on your behalf if the agent provides your written permission.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email. Continued use of the Service after changes constitutes acceptance.

13. Contact

Data controller: Adapt Progress Evolve Limited, company number 10047328, registered office 5 Brayford Square, London E1 0SG, VAT GB362654684. Contact: support@scriptgrain.com.

See also: Terms of Service · Trust · Support