Trust and Security
Last reviewed: 10 November 2026
We never use your writing to train AI models. It is read to measure your voice and to draft in it, and for nothing else. The providers that run the analysis receive it under commercial terms that forbid them from training on it. We hold them to those terms, and we tell you who they are below, but we cannot audit their systems.
Where your data lives
Your account, samples, voice profiles and drafts are stored in Supabase's cloud in Ireland. The providers below process parts of that data to run the service. Each one is named in our Privacy Policy, and we do not share your data with anyone else.
| Provider | Where | What it does for you |
|---|---|---|
| Supabase | EU (Ireland) | Database, sign-in, file storage and the server functions that run the product |
| Anthropic | United States | The Claude models that measure a voice and draft in it |
| Voyage AI | United States | Text embeddings used to score how closely a draft matches a voice |
| Stripe | United States and EU | Payments and invoices; card details never reach our servers |
| Firecrawl | United States | Reading a web page you ask us to import, on paid plans |
| Resend | United States | Account, billing and notification email |
| PostHog | EU | Product analytics and error reports, only if you accept the cookie banner |
| Cloudflare | Global edge network | Serving the website and protecting it from abuse |
| United States | Sign-in with Google, only if you choose it | |
| Notion | United States | Creating pages from your drafts in your own Notion workspace, only if you connect it |
Where data leaves the UK, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses with each provider, or an adequacy decision where one applies.
What we never do
- We never train AI models on your writing, and the commercial terms we hold the AI providers to forbid them from training on it.
- We never sell personal information, and we never share it for advertising.
- We never store your card details; Stripe holds them.
- The marketing site loads no third-party fonts, and the only third-party analytics is the consent-gated PostHog you can decline.
Keeping and deleting your data
Your data is kept for as long as your account is open. You can download a structured copy of everything we hold at any time from your account settings. Deleting your account from the same page removes, immediately and permanently: your writing samples, voice profiles and their history, generated drafts and edits, team memberships and any team you own, your subscription (cancelled at Stripe as part of the deletion), your usage records, and the product analytics records PostHog holds about you. Only anonymous statistics that contain no personal identifiers are kept.
How it is protected
- Everything travels over TLS, and the site tells browsers to use HTTPS only (HSTS).
- The site cannot be framed by other sites, which blocks clickjacking.
- Every database table is protected by row-level security, so your account can only ever read its own rows, and the keys that can bypass it exist only on the server.
- API keys are shown to you once and stored only as a SHA-256 hash; we cannot read them back, and neither could anyone who obtained our database.
- Support access to an account is read-only by default, time-limited, requires a stated reason and is recorded in an audit log; any change-making access is separately escalated and you are emailed when it is used.
- Free-tier abuse checks store only salted, irreversible hashes, never your device identifier or IP address.
Government and third-party requests
We disclose customer data only when a request is legally valid and binding under the law of England and Wales (the jurisdiction of Adapt Progress Evolve Limited, which operates ScriptGrain). We check every request for legal validity and scope, challenge any that are overbroad or invalid, and disclose only the minimum data required. Unless the law forbids it, we notify the affected user before disclosing so they can seek a remedy. We do not give any government or third party bulk access, backdoors or encryption keys. Requests for data held by our subprocessors are handled under their own published policies.
Questions
Security or privacy questions, subprocessor lists for a vendor review, or a data request: email support@scriptgrain.com. We aim to reply within one business day, and answer verified data requests within 45 days at the latest. If you believe you have found a security issue, please tell us there first so we can fix it before it is public.
See also: Privacy Policy · Terms of Service · Support