Privacy Policy

What We Collect

We collect the minimum data necessary to provide and improve the Service. Here is a breakdown:

Account Information:

• Email address — collected via Google OAuth sign-in
• Full name — optional, provided by your Google profile
• Google user ID — for authentication purposes only

Scan Metadata (Authenticated Users):

• AI probability scores returned by the detector
• Word count of submitted text
• Timestamp of each scan
• Scan type (standard / API)

Payment Information:

• Billing is handled entirely by Stripe. We never receive, process, or store your card details.
• We receive a Stripe customer ID and subscription status to manage your account tier.

Usage Data:

• Page views and feature interactions (via Google Analytics 4, anonymised)
• IP address (retained by Google Analytics for geographic analytics)
• Browser type and device type

What We Don't Do

• We do not sell personal data to data brokers or advertisers
• We do not use your submitted text to train or improve our AI detection models
• We do not share your data with third parties except as described in Section 4 (processors) or required by law
• We do not store guest users' text submissions
• We do not use cross-site tracking cookies for retargeting across the web

Text & Scan Storage

Authenticated Users: Text submitted via the web application is stored in our database using AES-256 encryption, solely to power the Scan History feature. This allows you to review past analyses within your account dashboard.

• Stored text is end-to-end encrypted — we process it for detection but don't use it for any other purpose
• You can request deletion of any or all scan history at any time
• Data is stored on Supabase infrastructure (see Section 4)

Guest Users: Text submitted by unauthenticated users is never stored. It is processed in-memory and discarded immediately after detection results are returned.

Third-Party Processors

We work with the following sub-processors to deliver the Service. Each is subject to appropriate data processing agreements:

Where processors are located outside of Australia, we ensure appropriate data transfer safeguards are in place (e.g., Standard Contractual Clauses for EU data transfers).

Cookies & Analytics

We use the following technologies to store session data and measure usage:

• Authentication Token — Stored in localStorage as veredict_auth_token. Required for authenticated sessions; cannot be deleted while signed in without logging out.
• Google Analytics 4 — Anonymised usage data including page views, session duration, and feature interactions. Used to understand how the Service is used. IP addresses are anonymised.
• Google Ads Conversion Tag — Measures the effectiveness of our advertising campaigns (tag ID: AW-17905343433). Triggers when users sign up or complete key actions.

How to opt out: You can control cookies via your browser settings. To opt out of Google Analytics tracking, use the Google Analytics Opt-out Browser Add-on.

Your Rights Under GDPR (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Our legal basis for processing is primarily legitimate interests (providing the Service) and contract performance for account holders.

Your Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know — Request disclosure of the categories and specific pieces of personal information we collect, use, and share
• Right to Delete — Request deletion of personal information we have collected from you (subject to certain exceptions)
• Right to Opt-Out of Sale — We do not sell personal information. There is nothing to opt out of.
• Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, email [email protected] with the subject line "CCPA Privacy Request".

Australian Privacy Act Rights

SYLLABUS PTY LTD complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are in Australia, you have the right to:

• Access your personal information held by us
• Correct personal information that is inaccurate, out of date, incomplete, or misleading
• Complain to us about a breach of the APPs, and if unresolved, to the Office of the Australian Information Commissioner (OAIC)

To make a request under the Australian Privacy Act, contact us at [email protected].

Data Retention

We retain your personal data only for as long as necessary:

• Account data is retained while your account is active
• Following an account deletion request, data is deleted within 90 days
• Scan text submitted by authenticated users is retained in encrypted form until you delete it or your account is deleted
• Payment records are retained for 7 years as required by Australian tax law (records held by Stripe)
• Analytics data is retained per Google Analytics' standard retention settings (14 months by default)

Security

We take data security seriously. Our measures include:

• AES-256 encryption for stored scan text
• HTTPS / TLS for all data in transit
• Authentication tokens scoped with minimal privilege
• Supabase Row Level Security (RLS) to ensure users can only access their own data
• Regular security reviews and dependency audits

No system is perfectly secure. In the event of a data breach that affects your personal information, we will notify you and the relevant supervisory authority within legally required timeframes.

Contact Us

For any privacy-related enquiries, requests, or complaints, please contact our Privacy Team:

• Email: [email protected]
• Response time: We aim to respond within 5 business days, and to action requests within 30 days
• Company: SYLLABUS PTY LTD, 2 Tyrell Court, Mawson Lakes, South Australia, 5095, Australia (ACN 699 802 492 / ABN 69 699 802 492)