Privacy policy

This policy explains how Company legal name (“Winston AI”, “we”, “us”) handles personal data when you use our website, apps, browser extension and API (together, the “service”).

For account, billing and website data, we are the controller. When a school, university or company sets up Winston AI for its people, that organization decides how the service is used, and we process the documents its members scan on its behalf under a data processing agreement. In that case the organization's own privacy notice applies too.

Our registered address is registered address. You can reach our privacy team at privacy@winstonai.ai.

Information you give us

• Account details: your name, email address, password (stored only as a salted hash), role and, for teams, your organization's name.
• Documents and scan content: text you paste and files you upload for a scan. Section 3 explains how we treat it.
• Billing details: your billing name, address, tax ID and plan. Card numbers go straight to our payment processor; we only see the card type, last four digits and expiry date.
• Messages: what you send us through the contact form or by email.

Information collected automatically

• Usage data: pages you visit, features you use, scan metadata such as word count, language and credits used, and timestamps.
• Device and log data: IP address, browser type, operating system and error reports, used to keep the service secure and working.
• Cookies: small files that keep you signed in and remember your preferences. See section 9.

Information from others

If you sign in with Google or Microsoft, we receive your name, email address and profile picture from that provider. If your organization invites you, we receive your name and email address from the admin who sent the invite.

The writing you scan can be personal, unpublished or confidential, so we treat it more strictly than any other data we hold.

• Used only to run your scans. We process scan content to produce your results, keep it in your scan history and generate the reports you choose to share.
• Never used to train models. We don't use your documents to train or improve any AI model, and our AI detection provider is contractually prohibited from doing so.
• Not added to any shared database. Your text isn't added to a public index or to the sources our plagiarism check compares against. On Team plans, an admin can choose to compare new scans with the workspace's own past submissions; those stay inside the workspace.
• Limited staff access. Our staff don't read your documents unless you ask us to as part of a support request, or the law requires it. Every such access is logged.

Text checked with the free scan box on our website, without an account, is processed to return a result and isn't saved to a scan history. We keep a hashed record of the IP address for up to 24 hours to enforce the daily limit.

• To provide the service: run scans, keep your history, generate reports and support team workspaces.
• To handle billing: take payments, issue invoices and prevent fraud.
• To keep the service secure: detect abuse, enforce rate limits and investigate incidents.
• To support you: answer questions and fix problems you report.
• To improve the product: we study aggregated usage, such as which features are used and where scans fail. This never involves reading your documents.
• To communicate: send service emails such as receipts and security notices and, if you opt in, product news. You can unsubscribe from marketing at any time.

If you're in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to provide the service you signed up for, including scans and billing.
• Legitimate interests: to secure the service, prevent fraud and understand how it's used in aggregate. We weigh these interests against your rights.
• Consent: for optional cookies and marketing emails. You can withdraw consent at any time.
• Legal obligation: to keep tax records and respond to lawful requests.

We don't sell personal data, and we don't share it for advertising. We use a small number of service providers to run Winston AI. Each one processes data only on our instructions, under a data processing agreement.

We update this list before we add or replace a subprocessor. Organizations with a data processing agreement can ask to be told in advance by writing to privacy@winstonai.ai.

Other sharing

• With people you choose: when you share a report link or work in a team workspace.
• For legal reasons: when the law requires it, or to protect the rights and safety of our users or the public. Where we're allowed to, we'll tell you first.
• In a business transfer: if Winston AI is part of a merger or acquisition, your data stays protected by this policy, and we'll tell you before it becomes subject to a different one.

Our providers may process data outside your country. When personal data leaves the EEA, the UK or Switzerland, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses, with additional safeguards where needed.

We keep personal data only for as long as we need it. These are our standard periods:

You can delete individual scans from your history, or everything at once from Settings. Delete scans or your account walks through the steps.

We use a small number of cookies. Strictly necessary cookies are always on. Analytics cookies are set only if you allow them, and we don't use advertising cookies at all.

Change your choices at any time with the Cookie settings link in the footer, or block cookies in your browser. Blocking strictly necessary cookies stops sign-in from working.

We encrypt data in transit with TLS and at rest with AES-256. Access to production systems is limited to a small number of staff, protected by multi-factor authentication and logged. We test our defenses regularly and fix reported issues quickly.

No system is perfectly secure. If a breach affects your personal data, we'll notify you and the relevant authorities without undue delay, as the law requires. To report a vulnerability, write to security contact.

Depending on where you live, you have the right to:

• Access the personal data we hold about you and get a copy.
• Correct data that's inaccurate or incomplete.
• Delete your data, also called the right to be forgotten.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Port your data: receive it in a machine-readable format, or have it sent to another provider.
• Withdraw consent at any time, without affecting processing that happened before.
• Complain to your local data protection authority. We'd appreciate the chance to help first.

You can do much of this yourself in Settings. For anything else, email privacy@winstonai.ai. We'll verify your identity and reply within 30 days. If a school or company manages your account, we may pass your request to them.

California and other US states

We don't sell personal information or share it for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you. You have the right to know, delete and correct your information, and we won't treat you differently for using those rights.

Winston AI isn't directed at children under 13, and we don't knowingly collect their data without authorization from a school or a parent. Where a school provides Winston AI to students, the school is responsible for any consent required, and we process student data only on the school's instructions.

If you believe a child has given us personal data without permission, contact privacy@winstonai.ai and we'll delete it.

If we make material changes, we'll email account owners and show a notice in the app at least 30 days before they take effect. The date at the top of this page shows when the policy last changed.

• Privacy questions and requests: privacy@winstonai.ai
• Postal address: Company legal name, registered address
• EU representative: name and address
• Data protection officer: name and contact details