# Privacy Policy · ScriptGrain > How ScriptGrain handles your data. A UK GDPR-aware privacy policy. Canonical: https://scriptgrain.com/privacy # Privacy Policy Last updated: 12 September 2026 ## 1. Who We Are ScriptGrain is operated by Adapt Progress Evolve Limited, registered in England and Wales. For any privacy-related enquiries, contact us at support@scriptgrain.com. ## 2. What We Collect We collect the following data: - Account information: email address, hashed password, and how you arrived when you created the account: the page you landed on, the site that referred you, any campaign tags in the link, and which button you used. We keep this so we know which channels bring writers to ScriptGrain; opting out of statistics (section 8) also stops it being recorded. - Writing samples: text you upload for voice analysis - Voice profiles: the stylometric analysis generated from your samples - Generated content: text produced using your voice profile - Payment information: processed securely by Stripe, we do not store card details - Usage data: pages visited, features used, timestamps. On our public marketing and blog pages we collect anonymous, first-party statistics about how the site is used: the page, the referring site, device type (phone, tablet or desktop), country, which buttons were clicked, and the size band of a sample pasted into the homepage preview. There are no cookies, no IP addresses, no personal identifiers, and nothing is stored on your device: a random number kept in the page's memory groups one visit's page views and is forgotten when you leave. We never collect the writing itself. These statistics are used only to improve the site, under the statistical-purposes exception in UK privacy law (PECR as amended by the Data (Use and Access) Act 2025), and you can opt out in section 8. - Product analytics (consent-based): if you accept analytics in the cookie banner, we use PostHog (hosted in the EU) to understand how the product is used: feature usage events, page interactions, and error reports. Events are linked to a pseudonymous account identifier, not your email or name. If you decline, PostHog sets no cookies and sends nothing. - Device check on free trials only: when you use a free voice analysis or the free draft, your browser computes a device identifier which we immediately convert into a salted, irreversible hash. We store only that hash, alongside a salted hash of your IP address, to stop one person claiming the free trial repeatedly under new accounts. We cannot turn either hash back into your device or your location, they are never shared with anyone, and no device check runs on a paid plan. ## 3. How We Use Your Data - To provide the ScriptGrain service, analysing your writing and generating content in your voice - To process payments and manage your subscription - To send transactional emails (account confirmations, payment receipts, profile notifications) - To improve the Service based on aggregated, anonymised usage patterns - To prevent abuse of our free trials, which cost us real money to run, using the salted device and IP hashes described above (our legitimate interest in keeping a free tier available at all) ## 4. AI Processing Your writing samples are processed by third-party AI providers, always server-side: Anthropic (the Claude API) performs the stylometric analysis and content generation, and Voyage AI computes text embeddings (numerical similarity fingerprints) used to match generated drafts to your voice. Your data is never used to train AI models. These providers may retain request data for a short period for abuse monitoring, after which it is deleted. ## 5. Data Sharing We do not sell your data. We share data only with: - Supabase: our database, authentication, and storage provider; your account data and content are stored in Supabase's cloud, hosted in the EU (Ireland) - Anthropic (Claude API): for AI-powered analysis and generation - Voyage AI: for text embeddings used to match generated drafts to your voice - Stripe: for payment processing - Firecrawl: for URL content import (Writer plan and above) - Resend: for delivery of account, billing, and notification emails - PostHog (EU): for consent-based product analytics and error tracking - Cloudflare: hosts our website; as our hosting provider it processes visitor IP addresses to serve pages and protect against abuse Our typefaces are served from our own domain, so loading a page does not send your IP address to Google or any other font host. ## 6. Data Retention Your data is retained for as long as your account is active. If you delete your account, your writing samples, voice profiles, generated content, subscription, and usage records are erased immediately as part of the deletion, and the product analytics records PostHog holds about you (your person record and its events) are erased with them. Anonymised usage statistics, which contain no personal identifiers, may be retained for analytics purposes. ## 7. Your Rights Under UK GDPR, you have the right to: - Access the personal data we hold about you - Request correction of inaccurate data - Request deletion of your data - Object to or restrict processing of your data - Data portability, receive your data in a structured format You can delete your account and all associated data yourself at any time from your account settings (Danger Zone, then Delete Account). This erases your profiles, samples, generated content, subscription, and usage records immediately, and cancels any active subscription. You can also download a structured copy of your data from the same page before deleting. To exercise any of these rights, or for help with deletion, you can also email support@scriptgrain.com. ## 8. Cookies ScriptGrain uses essential cookies for authentication and session management. We do not use advertising cookies. Our first-party visitor statistics (section 2) are anonymous, cookie-free and store nothing on your device, so they run whether or not you accept the banner; you can switch them off for this browser with the opt-out control in this section of the privacy page, which stores a single opt-out flag, the only thing we then keep on your device for statistics. If you accept analytics in the cookie banner, PostHog stores an analytics cookie to recognise return visits; declining (or never accepting) means no analytics cookie is ever set, and you can change your mind by clearing site data for scriptgrain.com. Change on 2 September 2026: before this date the anonymous statistics used a per-tab value in your browser's session storage and were switched off by Decline; they now store nothing and are controlled by the opt-out above. ## 9. Security We use industry-standard measures to protect your data, including encryption in transit (TLS), encrypted storage, and row-level security on all database tables. Despite our best efforts, no system is 100% secure. ## 10. Changes to This Policy We may update this policy from time to time. We will notify you of significant changes via email. Continued use of the Service after changes constitutes acceptance. ## 11. Contact Data controller: Adapt Progress Evolve Limited. Contact: support@scriptgrain.com. See also: [Terms of Service](https://scriptgrain.com/terms) · [Support](https://scriptgrain.com/support)