Privacy Notice

This notice covers the Pontbot website and the tools available after signing in, in every language version. It applies whether you are just browsing or you have an account and use the tools.

What it does not cover: the data practices of external sites and services you click through to or sign in with, and the systems of your school, university or employer. Those are governed by the provider’s own notice.

We have tried to write this in plain language, marking legal references for precision. If anything is unclear, ask us at the contact address below — and if this format is an obstacle for you, we will send the notice in another readable format on request.

Processing is subject to the EU General Data Protection Regulation (GDPR) and, as a company incorporated in the United Kingdom, to the UK GDPR. We are not required to appoint a Data Protection Officer; privacy requests are handled through the contact address below.

Pontbot tools (AI detector, plagiarism check, paraphraser, humanizer, consultant, thesis editor) require a signed-in account, so processing is always tied to an identified user. Data reaches us in three ways:

• You give it to us: email address, password, the text you submit and files you upload, documents you write in the editor, billing details, and anything you send to support.
• It is generated automatically: technical logs (IP address, browser, request time, errors), character and credit usage, and — with your consent — analytics data.
• We receive it from a third party: if you sign in with Google, Google passes us the sign-in identifier, your email address and your name. We never see your Google password.

We do not ask for or seek special category data (Art. 9): we collect nothing about health, ethnicity, religion, politics or sexual orientation, and we never ask for identity documents. If such data happens to appear in text you submit, we process it solely to carry out the operation you requested, under the same retention rules. Please do not include personal data in your paper that the work does not require.

Analysis is performed with our own AI model. We use your submitted text to carry out the operation you requested and store the run in your account history so you can open it again later.

• We do not train our AI model on the text you submit.
• We do not sell your text, and we do not make it available to other users, schools, universities or advertisers.
• Your paper is not added to any public or shared plagiarism database.
• Apart from you, your runs and documents are accessible only to the operational staff who need access for troubleshooting or to meet a legal obligation, and such access is logged.

A detector score is a statistical estimate, not evidence. We do not use it to make any decision about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22), and we do not hand scores to institutions for disciplinary purposes.

We do not sell or rent personal data. To run the service we use specialist providers for the functions below. Each is bound by a data processing agreement, may only process the data for the stated purpose, and may not use it for its own purposes. We do not publish the current list of named providers for operational security reasons, but you can request it at any time at the contact address below.

We also disclose data where required by law or by a binding decision of a court or authority, or where necessary to establish, exercise or defend legal claims. If the service or part of it transfers to another company (reorganisation, sale of business), data passes on only under these same terms, with prior notice.

Some of the providers above process data outside the European Economic Area, typically in the United States. Such transfers rely on Chapter V of the GDPR: the European Commission’s Standard Contractual Clauses and, where applicable, certification under the EU–US Data Privacy Framework, together with supplementary technical and organisational safeguards (encryption in transit, access restriction). You can request a copy of the relevant safeguards at the contact address below.

Strictly necessary cookies (sign-in session, security and load-management cookies) are used to provide the service — your account would not work without them, so they cannot be switched off. Every other cookie and measurement script loads only after your consent, by category.

You decide on the banner shown on your first visit: rejecting takes exactly as many clicks as accepting, and until you decide, no measurement or advertising script loads at all. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer — cookies belonging to a withdrawn category are then deleted. Consent expires after one year, when we ask again.

Most things you can do yourself, immediately, without sending us a request:

Account deletion is immediate and irreversible: your runs, documents and every row belonging to you are deleted, and we cancel any active subscription so you are not charged again. Remaining credits are lost with no refund. Accounting records for your purchases are kept by the payment provider for the period required by law — deletion does not affect those, and we cannot delete them either.

We send no newsletter and no promotional email. What we do send belongs to the service (password reset, purchase confirmation, finished analysis, subscription changes), so it cannot be switched off while your account exists — it is not marketing, it is part of performing the contract.

• All traffic runs over encrypted (HTTPS/TLS) connections and data is stored on encrypted storage.
• Passwords are never stored in a recoverable form, only as hashes.
• Access control is enforced inside the database itself, not only in application code: a query can only ever return your own data.
• Operational access is limited to what is necessary and is logged.
• Firewall and request rate limiting protect the service against automated abuse and overload.

How you can help: use a strong password you do not reuse elsewhere, never share your sign-in details, and sign out when you finish on a shared or public computer.

No method of transmitting or storing data over the internet is entirely risk-free, so nobody can promise 100% security — and we will not claim it either. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay and notify the competent authority within the statutory deadline.

You have the following rights in relation to your data. You can exercise any of them free of charge at the contact address below.

• Access (Art. 15): obtain a copy of your data and information about how it is processed.
• Rectification (Art. 16): have inaccurate data corrected or incomplete data completed.
• Erasure (Art. 17): have your data deleted where there is no (longer a) legal basis for processing. You can delete your account and individual runs yourself in the app. Accounting records we are required by law to keep cannot be deleted before their retention period ends.
• Restriction (Art. 18): ask us to store but not otherwise use your data — for example while we examine an accuracy objection.
• Objection (Art. 21): object to processing based on legitimate interests.
• Portability (Art. 20): receive the data you provided under the contract in a machine-readable format, or have it transmitted to another controller.
• Withdrawal of consent (Art. 7): stop consent-based processing (analytics and advertising cookies) at any time. Withdrawal does not affect the lawfulness of earlier processing.

We respond within one month. For complex or numerous requests this may be extended by two further months, and we will tell you the reason. To prevent misuse, please send your request from the email address on the account, or we may ask you to verify your identity.

If you believe our processing is unlawful, please tell us first — that is usually the fastest route to a fix. Regardless, you may lodge a complaint with a supervisory authority or bring court proceedings.

You may also contact the data protection authority of the EEA member state where you habitually reside or work, or bring proceedings before the court with jurisdiction over your place of residence.

The service is not available to anyone under 16, and we do not knowingly process the data of anyone under 16. If we learn that an account was created by someone under 16, we delete the account and its data. A parent or guardian can report this at the contact address below.

If the service or our processing changes, we update this notice and show the new effective date at the top of the page. For material changes that affect you adversely — such as a new processing purpose — we also notify you by email or in the app before they take effect.