RewritePal Privacy Policy

1. Scope and who is responsible

This Privacy Policy explains how RewritePal collects, uses, shares, and retains personal information when you use the RewritePal website, web application, Chrome extension, accounts, paid features, support, and related services (collectively, the "Service").

RewritePal is operated from Brazil. In this Policy, "RewritePal," "we," "us," and "our" refer to the operator of the Service and the controller of personal information handled for its own purposes. Contact information appears in Section 14.

This Policy is a notice about data processing. It is not a contract requiring you to surrender privacy rights that cannot be waived under applicable law.

2. Information we handle

• Submitted writing and generated output. We temporarily process the text, instructions, settings, and other content you intentionally submit for an AI action. Selecting text in the extension does not submit it. Submission occurs only after you choose a RewritePal action. RewritePal does not intentionally store submitted writing or generated output in its application database or application logs after the requested processing finishes.
• Account and authentication information. If you create an account, we process information such as your name, email address, profile image, authentication method, account identifiers, verification status, plan, and account preferences. If you sign in through an authentication provider, that provider sends us the account information needed to authenticate you. Passwords are stored only in hashed form when password sign-in is available.
• Payment and transaction information. Our payment processor collects payment method and billing information. RewritePal receives and stores limited transaction information such as your account ID, purchase status, amount, currency, offer or cohort, timestamps, and processor transaction references. RewritePal does not receive or store full payment card numbers.
• Usage, analytics, and device information. We process feature and page interactions, approximate location derived from IP address, browser and device information, referring pages, session and persistent analytics identifiers, account ID and limited account properties for signed-in users, performance measurements, and error information. Analytics information is personal information when it can be connected to a browser, device, or account. Submitted writing and generated output are not intended to be included in analytics events.
• Security and service-operation information. We process IP addresses, user-agent strings, session records, authentication events, rate-limit and quota counters, request metadata, error details, and similar records needed to secure and operate the Service. These records do not intentionally include submitted writing.
• Communications. If you contact us or request support, we receive your contact details, message, attachments, and information needed to respond. Please do not include sensitive writing or confidential information unless it is necessary for us to address your request.
• Information stored on your device. The website and extension store settings, feature selections, local drafts, temporary history, authentication state, usage identifiers, and preferences in browser cookies, local storage, session storage, or Chrome storage. Some local history is cleared when the browser session ends. Other preferences remain until you clear them or uninstall the extension.

3. How we use information

We use information for the following purposes:

• Provide requested rewriting, explanation, detection, authentication, account, and payment features.
• Apply usage allowances, rate limits, fair-use controls, and paid entitlements.
• Process purchases, refunds, disputes, taxes, accounting records, and customer support.
• Send verification, security, transaction, support, legal, and service-related communications.
• Measure feature use, diagnose failures, improve usability, and understand Service performance.
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms.
• Establish, exercise, or defend legal claims and comply with applicable legal obligations.
• Create and use aggregated or de-identified information that does not reasonably identify a person.

We do not use submitted writing to build advertising profiles. We do not use submitted writing to train RewritePal-owned AI models. We do not currently send promotional newsletters or general marketing campaigns. If we introduce promotional communications, we will obtain consent where required and provide a way to unsubscribe. Opting out of promotions will not stop essential account, security, legal, or transaction messages.

4. Legal bases

Where a law requires us to identify a legal basis, our bases depend on the purpose and may include:

• Contract. Processing needed to provide requested features, maintain an account, complete a purchase, and provide support.
• Legitimate interests. Operating, securing, measuring, and improving the Service, preventing abuse, and protecting legal rights, when those interests are not overridden by your rights.
• Consent. Processing for which applicable law requires consent, such as certain communications or device technologies. You may withdraw consent without affecting earlier lawful processing.
• Legal obligations and legal claims. Processing required for tax, accounting, regulatory, law-enforcement, dispute, and compliance purposes.

5. When we disclose information

We disclose information only as described below. The provider categories are public so you can understand the data flow without exposing RewritePal's model selection, routing logic, prompts, credentials, pricing, security configuration, or other proprietary methods.

• AI inference and routing providers. When you request an AI feature, the submitted writing and selected options are transmitted to one or more providers solely to generate the requested result. Providers may process limited content and metadata for security, abuse prevention, legal compliance, and service operation under their contracts and configured data controls. We restrict provider training or data collection where the selected provider offers those controls, but we cannot promise that every request receives zero-retention processing.
• Hosting, database, and network providers. These providers host the Service and may process account, transaction, usage, technical, and transient request information as needed to provide infrastructure.
• Authentication providers. If you choose third-party sign-in, the provider and RewritePal exchange the identifiers and profile information needed to authenticate and secure your account.
• Analytics and error-monitoring providers. These providers process usage, device, identifiers, account properties, performance, and error information to help us understand and improve the Service.
• Payment and email providers. Payment providers process purchases and payment disputes. Email providers deliver account, transaction, support, and any permitted promotional messages.
• Professional advisers and authorities. We may disclose information to auditors, accountants, attorneys, insurers, regulators, courts, law enforcement, or other parties when reasonably necessary to comply with law, protect rights and safety, or address a dispute.
• Business transactions. Information may be reviewed or transferred as part of financing, due diligence, a merger, acquisition, reorganization, bankruptcy, or sale of some or all of the business or assets, subject to applicable confidentiality and notice obligations.
• At your direction. We may disclose information when you ask us to or provide valid consent.

You may contact us for current information about the service providers that receive your personal information. We may protect confidential commercial information while still providing disclosures required by law.

6. No sale or targeted advertising

RewritePal does not sell personal information for money. We do not share personal information with advertisers for cross-context behavioral or targeted advertising, and we do not display third-party advertisements in the Service. If these practices change, we will update this Policy and provide any notice or choice required by law before the new practice begins.

7. Cookies, local storage, and analytics

RewritePal uses cookies and similar browser technologies for authentication, security, quota enforcement, preferences, analytics, and performance measurement. Some technologies are necessary for the Service to work. Analytics technologies help us understand visits and feature use and may assign a persistent identifier to a browser or device.

You can use browser controls to delete or block cookies and local storage. Blocking necessary technologies may prevent authentication, saved preferences, or usage limits from working correctly. Privacy-focused browsers and extensions may also block analytics. RewritePal does not currently provide an in-product analytics preference control. Where applicable law requires consent before using non-essential analytics technologies, this current limitation may affect whether we can lawfully activate those technologies for you.

8. Retention

We retain personal information only while reasonably needed for the purposes described in this Policy, including legal, accounting, security, fraud-prevention, and dispute obligations. The following criteria apply:

• Submitted writing. RewritePal does not intentionally retain submitted writing or generated output in its application database or application logs after processing. AI and infrastructure providers may retain request content or metadata for periods established by their contracts, settings, security needs, or legal obligations.
• Accounts. Account data is generally retained while the account is active and until it is deleted, followed by the time reasonably required for backups, security, fraud prevention, and legal obligations.
• Authentication, quota, security, and technical records. These records are retained for their configured expiration periods or while needed to enforce limits, secure the Service, investigate incidents, and resolve disputes.
• Transactions. Purchase, refund, tax, accounting, and dispute records are retained for the periods required by applicable financial, tax, consumer, and recordkeeping laws.
• Analytics. Analytics identifiers and events are retained according to our configured provider settings and then deleted or aggregated. You may contact us to request the current applicable period.
• Communications. Support and legal communications are retained while needed to address the request, maintain business records, and establish or defend legal claims.
• Device storage. Information stored on your device remains until its configured expiry, the session ends, you clear it, or you uninstall the extension.

We may retain information longer when law requires it, a dispute is pending, or deletion would interfere with security or fraud prevention. We may retain aggregated or de-identified information that cannot reasonably be linked to you.

9. International transfers

RewritePal operates from Brazil and uses providers that may process information in Brazil, the United States, Europe, and other countries. Those countries may have privacy laws different from the laws where you live.

Where required, we rely on recognized transfer mechanisms, contractual protections, or another lawful basis for international processing. The available mechanism depends on the countries, provider, and information involved. You may contact us for information about safeguards applicable to your personal information.

10. Security

We use administrative, technical, and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. The measures vary based on the nature of the information and the Service component involved. No internet transmission, provider, or storage system is completely secure, so we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your credentials and for activity under your account. Contact us promptly if you believe your account or information has been compromised.

11. Your rights and choices

Depending on your location and subject to legal exceptions, you may have rights to:

• Confirm whether we process your personal information and obtain access to it.
• Correct incomplete, inaccurate, or outdated personal information.
• Request deletion, anonymization, portability, or restriction of applicable information.
• Object to processing based on legitimate interests or opt out of direct marketing.
• Withdraw consent for future processing that relies on consent.
• Receive information about entities with which we shared your personal information.
• Ask for review of a qualifying automated decision, where applicable.
• Complain to the Brazilian National Data Protection Authority or another competent regulator.

To exercise a right, email privacy@rewritepal.com. Describe your request and the account or browser information needed to locate the relevant records. We may verify your identity and authority before acting. We will respond within the period required by applicable law. We may retain information when a legal exception applies and will explain the reason where required.

You may request account deletion through the available account controls or by contacting us. Deleting an account does not automatically delete information that must be retained for transactions, fraud prevention, security, disputes, or legal compliance.

12. Automated processing and AI

RewritePal automatically generates writing suggestions and may automatically apply quotas, rate limits, and abuse-prevention controls. AI output may be inaccurate, incomplete, or unexpected. RewritePal does not use AI output to make decisions about your employment, credit, health, legal rights, or access to public services. If applicable law grants a right to review a qualifying automated decision, contact us using Section 14.

13. Children

The Service is not directed to children under 18. We do not knowingly create accounts for or collect personal information from children under 13. If you are under the age of legal majority where you live, you may use the Service only with the involvement and agreement of a parent or legal guardian. If you believe a child provided personal information without appropriate authorization, contact us so we can review and delete it where required.

14. Contact

For privacy questions, requests, or complaints, email privacy@rewritepal.com. For general support, email hello@rewritepal.com.

15. Changes to this Policy

We may update this Policy to reflect changes in the Service, our practices, or applicable law. We will post the updated version and revise the date above. If a change materially affects how we use personal information, we will provide additional notice or obtain consent when required by law. Earlier versions may be requested by contacting us.