OwnVoice privacy notice

DRAFT — for legal review. Not yet approved for publication. Square brackets mark details still to be confirmed. Notes for the reviewer are at the end of this file and are not part of the notice.

Last updated: [DATE OF PUBLICATION]

This notice explains what personal data OwnVoice collects, why, how long we keep it and what your rights are. We have tried to write it in plain English. If anything is unclear, contact us (see "Who we are").

Who we are

OwnVoice is provided by [CONTROLLER NAME], [CONTROLLER ADDRESS]. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact for anything about your data: [CONTACT EMAIL]. [DATA PROTECTION OFFICER, IF APPOINTED.]

The short version

• Your drafts and writing samples belong to you. We use them only to give you the service.
• We do not use your drafts or samples to train any AI model. The AI providers we use are told not to train on the text we send them, and where a provider offers it we use zero data retention, so it does not keep that text.
• Our servers, database and file storage are in the EU. Data leaves the UK and EU in two cases only: if you turn on the optional AI features, the text you choose to send for AI help goes to an AI provider in the United States; and for personal accounts, our payment provider Stripe may process payment details in the United States.
• The text of your drafts (including their section headings), voice samples and grammar suggestions, the wording in your change record, the notes you add, and the reasons we give for flags are encrypted before we store them. Some other details, such as your email address and the titles you give your work, are not (see "Where your data is stored").
• You can delete a voice sample, all your samples, or your whole account at any time.
• We do not share anything with your university unless you choose to.
• We use one essential cookie to keep you signed in. No advertising or tracking cookies.

What we collect

Account details. Your email address; whether you chose a student or a personal account; for students, the university AI policy setting you picked; for personal accounts, the date you accepted the personal-use terms and your plan status. We also record when you last signed in by email link, and whether (and when) you turned on the AI features.

Your writing. Drafts and chapters you upload (.docx, .pdf or .txt) and every version of them; writing samples you add to your voice library (essays, assignments, emails and messages); the titles you give them; and the record of changes to your drafts (typed by you, grammar fix accepted, AI-assisted, or marked as your own writing), with any short notes you add. When you paste a message thread, we keep only your own messages.

Things we work out from your writing. Your voice profile (patterns such as sentence length, spelling variant and favourite linking words), likelihood flags on passages, and grammar suggestions.

Sign-in data. A random session token in a cookie, and a record of the session on our server, so you stay signed in. One-time sign-in links sent to your email.

Payment data (personal accounts only). Payments are handled by Stripe. We do not see or store your card details; we keep only your plan status and Stripe's reference for you as a customer.

Service records. Records of AI provider calls kept for cost and reliability: which feature, provider and model, how many tokens, how long it took and whether it worked. These records do not contain your text and are not linked to your account. Administrators' changes to settings are logged; these logs contain no user text.

We do not ask for, and you should not upload, special category data (such as health information) about yourself or anyone else beyond what is genuinely part of your thesis.

Why we use it, and our lawful bases

We do not use your data for advertising, we do not sell it, and we do not use automated decision-making that has legal or similarly significant effects on you. Likelihood flags are guidance only, not a decision about you, and you can always mark a passage as your own writing.

Where your data is stored

OwnVoice runs on servers, databases and file storage provided by Hetzner Online GmbH in the European Union, in Germany (Falkenstein or Nuremberg) or Finland (Helsinki). Backups are kept in the same EU locations. The UK recognises the EU as providing adequate protection for personal data.

OwnVoice encrypts the following before storing them, with a key kept separately from the database: the text of your drafts and every version of them; the section headings in your drafts (for example "Chapter 2: Methods"), which we use to show where a passage is; your voice samples; grammar suggestions (the original wording, the suggested wording and the explanation); the wording in your change record (the words added, removed or replaced, and the short notes you add when marking a passage as your own writing); and the reasons we give for likelihood flags, because they can quote words from your draft. Anything we put in file storage is encrypted the same way.

Other data is stored without this extra encryption, so that it can be searched, sorted and shown to you: your email address and account settings (including when you accepted the personal-use terms or turned on AI features); the titles you give voice samples and documents; for each voice sample, its type (essay, assignment, email or message), word count and your confirmation that it is your own writing; uploaded file names and file types, version numbers and upload times; the band of each likelihood flag ("likely", "possible" or "unlike you") and which passage it is on; for grammar suggestions, the kind of error, whether it was offered as a fix or a note, where it is, how many words it would change, and whether and when you accepted or rejected it; the record of which kind of change was made, where in the text and when, how long you spent typing a passage you rewrote yourself, and for AI-assisted changes which AI provider and model was used; and sign-in records. [CONFIRM WHETHER THE DATABASE, FILE STORAGE AND BACKUPS ARE ALSO ENCRYPTED AT DISK LEVEL BY THE HOSTING SET-UP, AND SAY SO HERE IF THEY ARE.]

Stripe, which takes payments for personal accounts, stores payment details on its own systems, which may be in the United States.

[EMAIL PROVIDER NAME AND LOCATION] sends our sign-in emails from the [UK/EU].

Optional AI features (text sent to the United States)

Some features use an AI model to suggest wording, for example a declared AI-assisted line edit or paragraph rewrite where your university policy allows it, or drafting help on a personal account. These features are off by default. They only work after you turn them on in Settings, and you can turn them off at any time.

When they are on:

• Only the text you choose to send for AI help (for example, the paragraph you asked to have rewritten) is sent, with the instructions needed to do the job. We do not send your whole draft or your voice library.
• The text is processed by the AI provider chosen for that feature: Anthropic (Anthropic, PBC), OpenAI (OpenAI, L.L.C.) or, through OpenRouter (OpenRouter, Inc.), the model provider OpenRouter routes to. These providers are based in the United States, outside the UK and EU.
• Providers are told not to use your text to train their models. Where a provider supports it, we use zero data retention, so the provider does not keep your text after replying. Where zero data retention is not available, the provider may keep it for a short period for abuse monitoring under its own terms ([PROVIDER RETENTION PERIODS TO CONFIRM]).
• The transfer is protected by [UK INTERNATIONAL DATA TRANSFER ADDENDUM / UK EXTENSION TO THE EU-US DATA PRIVACY FRAMEWORK, TO CONFIRM PER PROVIDER].
• Every line or paragraph written with AI help is permanently labelled "AI-assisted" in your authorship record and PDF.

Payments for personal accounts are processed by Stripe, which may also process payment data in the United States under [TRANSFER MECHANISM TO CONFIRM].

Sharing

We do not share your data with your university, supervisor or anyone else unless you choose to, for example by downloading your authorship record and sending it yourself.

We use the service providers named above (Hetzner, our email provider, Stripe, and the AI providers only if you turn AI features on). They act on our instructions and may not use your data for their own purposes. We may disclose data if the law requires it.

Stripe (payments, personal accounts only). Stripe ([STRIPE CONTRACTING ENTITY TO CONFIRM]) processes payments for us. When you subscribe we send Stripe your email address, an internal reference number for your OwnVoice account (not your name, drafts or anything you write), and the plan you chose. You type your card details into Stripe's own payment page, so they go to Stripe, never to us. Stripe keeps the invoices and payment records for each payment, because the law requires them to be kept for tax and accounting. Student accounts are free and nothing about them is sent to Stripe.

How long we keep it

Deleting your data

You can, at any time and without asking us:

• delete a single voice sample, or all your voice samples, from the voice library;
• delete your whole account from Settings. This permanently deletes your account, drafts, versions, samples, voice profile, change record and sign-in sessions, from both our database and our file storage.

If you have a personal plan, deleting your account first cancels it with Stripe straight away: you are not billed again, and there is no refund for the rest of the current period. We then remove your saved payment cards, name, email address, postal address and OwnVoice reference from your customer record at Stripe. Stripe keeps your past invoices, which show the name and email they were issued to, because the law requires it (see "How long we keep it"). If we cannot finish this with Stripe, we do not delete your account, so that it never goes on billing after it is gone; you can try again a few minutes later.

Deleted data stays in our encrypted backups until they expire ([7] days), and is not restored from them except to recover from a failure, in which case we delete it again.

[PER-DOCUMENT DELETION: TO CONFIRM, see reviewer note 2.]

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased (you can do most of this yourself, as described above);
• restrict or object to our use of your data, including where we rely on legitimate interests;
• data portability: receive the data you gave us in a commonly used format;
• withdraw consent for the AI features at any time, by turning them off in Settings. This does not affect anything done before you withdrew it.

To use any of these rights, email [CONTACT EMAIL]. We will reply within one month.

Cookies

We use one essential cookie, which holds a random session token so you stay signed in (__Secure-authjs.session-token, or authjs.session-token when not on HTTPS), plus the short-lived security cookies our sign-in system needs while you sign in. They are strictly necessary for the service, so we do not ask for consent. We use no analytics, advertising or tracking cookies.

Complaints

If you are unhappy with how we handle your data, please contact us first at [CONTACT EMAIL]. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.

Changes to this notice

If we change this notice in a way that matters, we will tell you by email or in the app before the change takes effect.