Privacy Policy

Last updated: October 2026  ·  AI Rewriter  ·  ai-rewriter.cc

This Privacy Policy explains how AI Rewriter (“we”, “us”, or “our”) collects, uses, and protects your personal data when you visit ai-rewriter.cc and use our text-rewriting service. We are committed to handling your data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

AI Rewriter
Website: https://ai-rewriter.cc
Contact: available through the in-app support channels or via the contact links in the navigation.

2. What Data We Collect

We collect only the data necessary to provide and improve our service:

• Account data: your email address, provided when you create an account via our authentication provider (Clerk). We may also store a display name or profile image if supplied.
• Payment data: transaction references and plan details to confirm your subscription. Payment card details are handled exclusively by Paystack and are never stored on our servers.
• Usage analytics: anonymised metrics such as rewrite counts, selected models, and session duration. These contain no raw text and cannot be linked back to you individually.
• Rewrite text, only if you opt in: if, and only if, you switch on Help improve the models in Privacy choices (the privacy banner, or the link in the site footer), the text you paste and the rewritten versions we return are saved so they can be used to improve our rewriting models. This is off by default. See section 2A.
• Technical data: IP address, browser type, device type, and session identifiers collected automatically when you access the service. We use this data for security, fraud prevention, and analytics.
• A device signature, to stop trial abuse: when you sign in, sign up, or use the rewriter, we compute a signature from your browser and device settings and store it in a cookie (_tmk_vid). It lets us tell when one device opens many free trials under different email addresses, which is the main way the free tier gets abused. We do not use it for advertising, we do not share it, and it is not computed while you are simply reading the site.
• Session recordings and heatmaps: on most pages we record how the page is used — mouse movement, clicks, scrolling, taps, and the changing appearance of the page — using Microsoft Clarity. This is described in full in Section 9A, including the text we exclude from these recordings.
• Cookies & local storage: session cookies necessary to keep you logged in, and analytics cookies used to measure traffic and to link page views into a single recorded session. Our session-recording provider (Microsoft) also sets its own third-party cookies, some of which Microsoft uses for advertising and site analytics across its services. We do not run advertising on this site and we do not sell your data.
• Device characteristics: when you sign in, we compute a device identifier from technical characteristics of your browser and device (such as screen, fonts, and hardware capabilities) using the ThumbmarkJS library. We store this identifier, a broad device classification, and a uniqueness estimate. We do not collect your precise location, contacts, or files.
• Sign-in and device history: for each account we keep a short history of the devices that accessed it and when they were last seen.
• IP address and usage counters: for visitors who use our free tools without an account, we record the IP address and a daily usage count. IP addresses connected with abuse (for example automated scraping) may be recorded in a block list.
• Page view records: for each page opened on this site we record the address of the page, the country the request came from, the page that referred you, your browser’s user-agent string, and the time. This happens on our own servers, so it does not use cookies and does not depend on your cookie choice. If you do not have an account, we do not record your IP address, city, network provider or device signature against these page views. We use them to see which pages are read, where readers arrive from, and to tell readers apart from automated crawlers, which are a large share of the traffic any small site receives. They are deleted automatically after 30 days.

Text you submit for rewriting is not stored, unless you opt in. By default your input passes through our rewriting model and is returned directly to you, and no copy is retained on our servers after the request completes. The single exception is the optional Help improve the models setting described in section 2A, which is off unless you switch it on. Rewriting itself runs on language models hosted on our own infrastructure — your text is not sent to any external AI provider to be rewritten.

AI detection is the one exception, and it is worth reading. When you use our AI detector, and when we score a rewritten version for you, the text being checked is transmitted to our outside detection services, ZeroGPT and Originality.ai, because scoring it is the whole purpose of the request. We send it from our servers rather than from your browser, so your IP address and account are not disclosed to them, and we keep only a cryptographic hash of the text (used to avoid re-checking identical text) — never the text itself. Once transmitted, the text is handled under each service’s own terms, which may let it keep the text or use it to improve its models (Originality.ai’s terms say so); we do not control that. If a passage is confidential, do not run it through the detector. See Section 5.

2A. Using Your Text to Improve Our Models

We build and fine-tune our own rewriting models. Real examples of AI-written text and its rewritten versions are what make those models better. We ask rather than assume.

This is off by default. Unless you switch on Help improve the models in Privacy choices (the privacy banner, or the link in the site footer), nothing you paste and nothing we return is saved.

If you do switch it on, then for each rewrite we store:

• the text you pasted in, and the rewritten versions we returned;
• which model and which rewrite mode produced them, and any AI-detection scores;
• an account identifier, so that we can find and delete your contributions if you ask.

These records are held on our own servers, are deleted automatically after 7 days, and are used for one purpose only, which is improving the rewriting models. They are never sold, never shared with advertisers, and never published. They are not linked to your Google account.

You can turn the setting off at any time from Privacy choices in the site footer. Doing so stops all future collection immediately. To have contributions already collected removed before the 7-day window expires, contact us and we will delete them.

A note if you write for assessment. If you are rewriting unpublished academic work, coursework, or anything covered by a confidentiality obligation, we would suggest leaving this setting off.

2B. Documents Sent to the Editing Service

If you ask for a quote from our Human Editing & Proofreading service, we receive the document you send, your name, email address, an optional phone or WhatsApp number, the services and options you choose, any notes, your declaration, and a one-way hash of your IP address (used to limit abuse).

We use these only to quote for, carry out and deliver the work you asked for and to answer your questions. Only the editor working on your order sees the document. It is never published, sold, shared with advertisers, or used to train our models, whatever your Help improve the models setting.

The document and the order details are stored on our own server, which is not included in our backups, and are forwarded to our editor by email through our email providers (Resend, with Gmail as a fallback). Everything is deleted from our systems within 30 days of you sending it, including the edited files and our email copies. To have it deleted sooner, contact us.

3. How We Use Your Data

We process your personal data for the following purposes:

• Service delivery: to authenticate you, manage your subscription, and provide the rewriting tool.
• Payment processing: to verify and record your subscription payments.
• Communication: to send important account or service updates (e.g. subscription expiry notices). We do not send marketing emails unless you have explicitly opted in.
• Security and fraud prevention: to detect and prevent abuse, ban evasion, and unauthorised access.
• Preventing free-trial abuse: device identifiers let us recognise a device that has already used a free trial, so trials cannot be repeated endlessly by creating new accounts.
• Preventing account sharing: if one account is used from several devices in a short period, our system may flag it for review and notify our administrator. We may also limit an account to one active session at a time: signing in on a new device can be blocked while another session is active.
• Protecting the service: per-IP daily limits and automatic blocking protect the free tools from abuse that would degrade the service for everyone.
• Service improvement: to analyse anonymised usage patterns and improve the rewriting models and user experience.
• Finding usability problems: to review session recordings and heatmaps in aggregate so we can see where pages confuse people, where layouts break on a given device, and where users abandon a task.
• Legal compliance: to fulfil our obligations under applicable law.

4. Legal Basis for Processing

Under the GDPR, we rely on the following legal bases:

• Performance of a contract (Article 6(1)(b)): processing your account and payment data is necessary to provide the service you have subscribed to.
• Legitimate interests (Article 6(1)(f)): processing technical data for security, fraud prevention, anonymised analytics, and session recording and heatmaps to diagnose usability problems, where these interests are not overridden by your rights.
• Server-side page view records (page, country, referrer, user agent): legitimate interest — knowing which pages are read and separating readers from crawlers is basic to running the site at all, and we cannot rely on cookie-based analytics for it because most visitors decline them. The records carry no IP address for visitors without an account, are never used for advertising, are not shared, and are deleted after 30 days.
• Fraud and abuse prevention (device fingerprinting, device history, IP limits and blocking): legitimate interest — protecting a small service from trial abuse, account sharing, and automated misuse. We considered the impact on users and limit the data to what these protections need.
• Legal obligation (Article 6(1)(c)): retaining certain transaction records as required by law.
• Consent (Article 6(1)(a)): where we ask for your consent (e.g. optional communications), you may withdraw it at any time without affecting prior processing.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share data only with:

• Clerk — our authentication provider. Clerk processes your email address and account credentials. See Clerk’s Privacy Policy.
• Paystack — our payment processor. Paystack handles all card and M-Pesa transactions. We only receive a transaction reference and status. See Paystack’s Privacy Policy.
• Originality.ai — our AI-detection provider. It receives the text you submit to the detector and the rewritten versions we score for you, and returns a score; AI detection is the only case in which text you give us leaves our infrastructure. It does not receive your IP address, email address, or account identifier, because the request is made server-to-server. Its handling of the text is governed by Originality.ai’s Privacy Policy, which permits it to use scan submissions to improve its own models.
• ZeroGPT — an AI-detection service. It receives the same text as Originality.ai, for the same purpose, and in the same server-to-server way, so it does not receive your IP address, email address, or account identifier. Its handling of the text is governed by ZeroGPT’s Privacy Policy.
• Google (Google Analytics) — our traffic-measurement provider. Google Analytics receives page views and a small number of named interaction events (for example that a rewrite was started, or that a plan was selected), together with the technical data listed in Section 2 such as browser, device type and an approximate location derived from your IP address. It never receives the text you submit or the text we return. See Google’s Privacy Policy.
• Microsoft (Clarity) — our session-recording and heatmap provider. Microsoft receives the interaction data described in Section 9A and acts as a processor for it. Microsoft may combine that data with signals it already holds about your browser for its own site-analytics and advertising purposes, as described in its privacy statement. See Microsoft’s Privacy Statement.
• Hosting provider — our infrastructure provider (Linode / Akamai) hosts the application and data in accordance with applicable data protection standards.
• Legal authorities: we may disclose data if required to do so by law or in response to a valid legal process.

Clerk, Paystack and our hosting provider process your data under their terms with us. The AI-detection services are public tools that we do not have a contract with; they handle the text they receive under their own published terms, linked above.

6. International Transfers

Your data may be processed in countries outside the European Economic Area (EEA), including the United States, where our infrastructure and some service providers are located. When we transfer data outside the EEA we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

7. Data Retention

We retain your data only for as long as necessary:

• Account data: retained for the duration of your account, and deleted within 30 days of account deletion upon request.
• Payment records: retained for up to 7 years to comply with financial and tax regulations.
• Usage analytics: anonymised data may be retained indefinitely as it cannot identify you.
• Security logs (IP, session): retained for up to 6 months for fraud prevention purposes, then deleted automatically.
• Page view records: deleted automatically 30 days after the visit. For visitors without an account these records contain no IP address, so what remains after that window is only a count of pages read.
• Device identifiers and device history: kept while your account is active; device history older than 6 months is deleted automatically, and all of it is deleted with the account.
• Anonymous per-IP usage counters: kept for up to 6 months, then deleted automatically.
• Abuse block-list entries: kept while the block is needed; reviewed periodically.
• Sharing-alert records: kept for up to 6 months for audit purposes, then deleted automatically.
• AI-detection records: the score, the time of the check and a hash of the text — never the text itself — are deleted automatically 30 days after the check. Retention of the text by the detection services is governed by their policies, not ours.
• Session recordings (Microsoft Clarity): retained by Microsoft for 30 days from the time of recording. A small randomly selected sample, and any recording we mark as a favourite while investigating a problem, may be kept for up to 9 months. Aggregated heatmaps and behavioural metrics contain no individual recording and may be kept for longer.

8. Your Rights Under the GDPR

If you are located in the EEA or UK, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us through the support channels available in the application. We will respond within 30 days.

8A. Your Rights Under the Kenya Data Protection Act, 2019

If you are in Kenya, the Data Protection Act, 2019 gives you rights that closely mirror the GDPR rights above, including the right to:

• be informed about how we use your personal data (this policy);
• access the personal data we hold about you;
• have inaccurate data corrected and, in appropriate cases, deleted;
• object to or restrict processing of your data;
• data portability, where technically feasible.

To exercise any of these rights, contact us using the details in the “Contact Us” section. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) — odpc.go.ke.

We function as the data controller for the personal data described in this policy within the meaning of the Act.

9. Cookies

Analytics and session-recording cookies are only set if you agree. The first time you visit we ask, and nothing below in the “analytics” or “session-recording” categories is set unless you choose Accept analytics. If you choose Essential only, Google Analytics runs without storing anything on your device and Microsoft Clarity is not loaded at all. You can change your mind at any time using the Cookie settings link in the footer of any page.

We use the following types of cookies:

• Strictly necessary cookies: session and authentication cookies required for the service to function. These cannot be disabled without breaking your login session.
• Analytics cookies: first-party cookies that help us understand how the service is used (page views, session counts). Google Analytics sets _ga, which holds a pseudonymous identifier for your browser, and _ga_<measurement id>, which maintains your analytics session state. Both expire two years after your last visit unless you delete them sooner.
• Session-recording cookies: Microsoft Clarity sets two first-party cookies — _clck, which holds a pseudonymous Clarity user ID for this site, and _clsk, which joins several page views into a single recorded session. Clarity also sets third-party cookies on Microsoft domains (including MUID, CLID, SM, MR and ANONCHK) which identify a browser across sites that use Microsoft services; Microsoft uses some of these for its own advertising and site analytics. We do not display advertising on this site and we do not use these cookies to target you.

You can control or delete cookies through your browser settings. Blocking third-party cookies stops the Microsoft cookies above; deleting _clck and _clsk stops Clarity linking your future visits to past ones. Disabling strictly necessary cookies will prevent you from logging in.

9A. Session Recordings and Heatmaps (Microsoft Clarity)

Since 12 September 2026 we use Microsoft Clarity, a behavioural analytics tool, to understand how people actually use the site. Clarity is provided by Microsoft, which processes this data on our behalf.

What Clarity records:

• Session recordings: a reconstruction of your visit built from the structure and appearance of the pages you viewed, together with your mouse movements, clicks, taps, scrolling, and the pages you moved between. It is not a video or a camera recording — it is a replay of the page, rebuilt from what your browser displayed.
• Heatmaps: aggregated maps showing where visitors click and how far down a page they scroll.
• Behavioural metrics: derived measures such as rage clicks, dead clicks, excessive scrolling, and time spent on a page, plus the technical data listed in Section 2 (browser, device type, approximate location from your IP address, and referring page).

What Clarity does not record: we have deliberately excluded your content from these recordings.

• The text you paste in is typed into a text box, and Clarity masks the contents of text boxes and input fields in every mode it offers. This cannot be switched off by us.
• The rewritten text we return to you is explicitly marked as masked in our page code, so it is replaced with placeholder characters before anything leaves your browser.
• The same applies to the text you submit to, and the results shown by, our AI detection tool.

In short, Clarity can show us that you rewrote a paragraph and how you moved around the page while doing it — never what the paragraph said. This is consistent with our commitment elsewhere in this policy that your text is never stored or read by a person.

Where it runs: on our public and product pages — the home page, pricing, the blog, our topic and comparison landing pages, sign-in and sign-up, the rewriter, the AI detector, and the billing and checkout pages. It is deliberately not loaded on the payment confirmation page, and not on this policy page.

Microsoft’s own use: Clarity identifies your browser using the cookies described in Section 9, and Microsoft may combine that data with signals it already holds about your browser from other Microsoft services, including advertising signals. We do not run advertising on this site, and we do not receive any advertising audience or profile from Microsoft. Microsoft’s handling of this data is governed by the Microsoft Privacy Statement.

Retention: see Section 7. Opting out: you can block or delete the cookies listed in Section 9 through your browser settings, or use a browser extension or setting that blocks analytics scripts; the rest of the service works normally without them.

10. Children’s Privacy

Our service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has provided us with personal data, we will delete it promptly.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encrypted connections (HTTPS), hashed credentials, and access controls limiting who can view personal data within our systems. Administrative access to user data additionally requires two-factor authentication and a time-limited elevated session.

12. Google API Services User Data Policy

AI Rewriter uses Google Sign-In (OAuth 2.0) to allow you to authenticate using your Google account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we commit to the following:

• Limited use: We only use the Google user data we receive (your email address and basic profile information) to provide and improve the AI Rewriter service. We do not use this data for any other purpose.
• No data transfer: We do not transfer Google user data to third parties except as necessary to provide the service (e.g. our hosting provider), or as required by law.
• No advertising: We do not use Google user data for serving advertisements, and we do not allow advertising networks to access it.
• No unauthorised human access: We do not allow humans to read Google user data unless you have given explicit consent, it is required for security purposes, or we are legally obligated to do so.
• Rewrite text is kept separate from your Google account: the text you submit for rewriting is never associated with your Google account, never shared with Google, and never used for advertising. By default it is processed in memory and returned to you without being written to disk. If you switch on the optional Help improve the models setting (section 2A), that text is stored for model training, still without any link to your Google account.

This disclosure satisfies the Google API Services User Data Policy Limited Use requirements for apps that access Google OAuth scopes.

13. Account Deletion

You may request the permanent deletion of your account and all associated personal data at any time. To do so:

• Contact us through the in-app support channel or via the contact form at ai-rewriter.cc.
• Include “Account Deletion Request” in your message and the email address associated with your account.

We will process your request and confirm deletion within 30 days. Note that we may retain certain transaction records for up to 7 years as required by financial regulations (see Section 7), but these will be de-linked from your personal profile.

You may also disconnect Google Sign-In from your account at any time by visiting your Google account permissions page and revoking access for AI Rewriter.

14. Do Not Track

Some browsers send a “Do Not Track” (DNT) signal. We currently do not alter our data collection practices in response to DNT signals, as there is no industry-wide standard for honouring them. We encourage you to use our cookie controls (described in Section 9) to manage your preferences directly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or via an in-app notice. The “Last updated” date at the top of this page always reflects the most recent revision. Continued use of the service after changes are published constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern, please contact us through the support channels available within the application or by visiting ai-rewriter.cc.

You also have the right to lodge a complaint with a supervisory authority. In the EU, you may contact your national data protection authority. In the UK, you may contact the Information Commissioner’s Office (ICO).

---

Also see our Terms & Conditions.