This policy explains what personal data encryptmyai collects, what we don’t, who we share it with, and the rights you have under UK GDPR and EU GDPR. The data controller is WeLinkAnything Ltd, registered in the United Kingdom.
What we collect
- Your email address — for sign-in and service notifications
- Usage metadata — when you sign in, how many drafts you’ve generated, approximate byte count of your knowledge base, which drafter you used
- Payment data — handled by Stripe. We see your Stripe customer ID, plan status, and billing email. We never see your card number.
What we don’t collect
Your encryption passphrase. Never sent to us, never stored. Derived into a key inside your browser.
The plaintext of your knowledge base files. Files are encrypted in your browser before upload; we store only encrypted bytes.
The filenames of your knowledge base files. Encrypted alongside file contents; we see only opaque identifiers.
The content of your drafts. We don’t store the text of the drafts we generate — only metadata (length, timestamp).
Third parties we rely on
- Supabase (EU-hosted) — authentication, encrypted file storage, database. supabase.com/privacy
- Anthropic (US-based) — AI drafting via the Claude API. Draft content transits through Anthropic for the seconds it takes to generate output. Anthropic does not train on API data and deletes it after a 30-day trust-and-safety window. anthropic.com/privacy
- Stripe (US/UK) — payment processing. stripe.com/privacy
- Netlify (US-based) — website hosting. netlify.com/privacy
Cookies
We use a small number of first-party cookies for authentication (Supabase session). We don’t use advertising cookies or third-party trackers.
Your rights
Under UK GDPR and EU GDPR you have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your account and all associated data
- Export your data
- Withdraw consent for processing
Request any of these via the contact form.
Data retention
- Account email: kept until you delete your account
- Encrypted files: kept until you delete them or your account
- Usage metadata: kept for 24 months, then aggregated anonymously
- Stripe payment data: kept per Stripe’s retention policy
- Anthropic API transit: 30 days per Anthropic’s policy
Children
encryptmyai is intended for adult professional use. We don’t knowingly collect data from anyone under 18.
Changes to this policy
Material changes will be announced via email to your sign-in address. The “last updated” date at the top reflects when this policy was most recently revised.
Contact
Privacy questions, data requests, or complaints: use the contact form. You can also contact the UK Information Commissioner’s Office if you believe we’ve mishandled your data: ico.org.uk.