Privacy policy
Effective date: 07.10.2026
PlagScanX provides tools for plagiarism checking, AI detection, rewriting, humanizing, and grammar checking. This policy explains how we handle personal data when you visit our websites, use our tools, create an account, make a purchase, or contact us.
Personal data means information that identifies someone or can reasonably be linked to them. Submitted writing, filenames, report findings, and AI scores can contain personal data even when they do not include a name.
The main points are:
- We do not use your submitted writing to train models by default.
- Our staff may access submitted content only for support, security, legal needs, or a separate purpose you have consented to.
- Providing a tool can require sending text to OpenAI or Copyscape. Saving a report, adding a Private Library document, and enabling a sharing link have separate privacy effects.
- You can contact [email protected] about your information and privacy rights.
1 Who is responsible for your data
PlagScanX, established in Finland, is responsible for deciding how personal data is used for our own websites, account administration, customer service, security, and other activities described in this policy. In data protection law, this role is called a controller.
Privacy contact: [email protected].
Where we process content only on a school’s, employer’s, or other customer’s documented instructions under a data processing agreement, that customer may be the controller and PlagScanX its processor. The applicable agreement and the organisation’s notice explain that arrangement. An organisation buying an account does not automatically determine every data protection role.
This policy explains our practices; it is not a request for blanket consent. Accepting our Terms or using the website does not constitute consent to optional analytics, marketing, or model training.
2 Information we collect and where it comes from
| Information | Examples | Source |
|---|---|---|
| Account and profile | Name, username, email, account credentials, preferences, account status, and sign-in records | You, your browser, and a sign-in provider you choose |
| Writing and documents | Pasted text, extracted file text, document titles or filenames, language and tool selections, and Private Library material | You or someone authorised to submit the material |
| Results and reports | AI assessments, scores, explanations, matching passages, source links, suggested wording, report settings, and sharing status | Our tools and processing providers |
| Purchases and usage | Plan, order and payment references, payment or subscription status, word allowances, tool use, dates, and usage totals | You, our systems, and Dodo Payments |
| Technical and security information | IP address, browser or device details, request and error records, security signals, and identifiers used to manage access or prevent abuse | Your device, our systems, and security providers |
| Website measurement | Pages and events, referral information, device/browser characteristics, approximate location where derived, and analytics identifiers | Google Analytics and your interaction with the website, subject to your applicable choices |
| Communications and choices | Support messages and attachments, complaints, privacy requests, feedback, email preferences, and cookie or privacy choices | You and people communicating with us about your account or content |
If you choose Google sign-in, we receive the information needed to authenticate you, such as your Google account identifier, email, name, and available profile picture. This sign-in does not give us general access to your Gmail messages or Google Drive files.
Plagiarism results can include information from publicly accessible sources and documents added to a Private Library. We may also receive personal data about someone who does not have a PlagScanX account when another user submits their work or shares a report about them.
Some account, security, content, and payment information is necessary to provide the feature you request. Without it, we may be unable to create an account, run a check, process a purchase, or answer a request. Optional information and consent choices are identified separately.
3 Why we use personal data
Where GDPR applies and we act as controller, we rely on the following legal grounds for the relevant activity:
| Purpose | Legal ground and scope |
|---|---|
| Create and manage your account, provide requested tools, save chosen reports, and administer purchases | Performing our contract with you or taking steps you request before entering it, where the processing is necessary for that purpose |
| Answer support requests and send service, security, or billing messages | Performing our contract for account-related assistance; legitimate interests in responding to other enquiries and operating the service |
| Protect accounts, investigate misuse, enforce fair usage, and maintain reliable systems | Legitimate interests in preventing fraud, securing the service, and allocating resources fairly, balanced against individuals’ rights |
| Keep records and respond to binding legal requirements | Compliance with applicable legal obligations, including accounting and tax duties |
| Handle complaints and legal claims | Legal obligations where applicable, or legitimate interests in establishing, exercising, or defending legal claims |
| Use optional analytics or similar device tracking | Consent where required; the relevant purpose and controls are explained when consent is requested |
| Send optional promotional emails or carry out separately offered content research | Separate consent where required, limited to the purpose explained when it is requested |
We do not treat a contract with an uploader as a contract with every person mentioned in their document. For third-party personal data processed under our own responsibility, we assess the appropriate legal ground and necessary safeguards separately. This may involve a legitimate-interest assessment for providing an authorised check; it is not an automatic justification for every submission.
When we process on an organisation’s instructions, that organisation determines its lawful grounds. We still have our own duties as a processor. If you ask about a legitimate-interest assessment relevant to your data, we will explain the interest and how your rights are considered.
4 How submitted writing is processed
AI and writing tools
Our AI Detector, Humanizer, Rewriter, and Grammar Checker use OpenAI to process the text needed for your selected task and return results. Requests can also include task settings and a pseudonymous account identifier used for safety and abuse prevention. A pseudonymous identifier replaces a direct identifier but is still personal data where it can be linked back to a person.
Plagiarism checking and the Private Library
The Plagiarism Checker sends the text being checked to Copyscape. An ordinary check does not automatically add the document to your Private Library.
When you choose to add a document to the Private Library, its text, title, and an account reference are sent to Copyscape’s private index so future checks can compare against it. We keep the information needed to identify and manage that library entry. This is storage for your requested comparison feature, not permission to train models or publish the document in a public matching database.
Uploads and saved reports
Uploaded files are temporarily handled to extract their text. Removing a temporary original file does not remove the extracted text from a saved report, a provider’s permitted processing records, or a Private Library entry you created. A report title may also contain the original filename.
Your report-saving choice affects account history. Turning saving off does not stop the processing needed to provide the result, associated usage and security records, or applicable provider retention. The retention section below explains the separate categories.
5 Model training and human access
We do not use submitted text, uploaded documents, report content, excerpts, or content-derived training examples to train or fine-tune our models by default. We do not enable optional provider training on that content as part of ordinary tool use.
If we offer an optional contribution of content for research or model improvement, we will explain the specific material, purpose, recipients, retention, and withdrawal arrangements and request separate consent before using it for that purpose. Refusing that optional use will not prevent access to the ordinary service. Withdrawing consent stops future consent-based processing; it does not make earlier lawful processing unlawful.
Authorised personnel may access submitted content only when necessary to provide support, investigate security or misuse, meet a legal need, or carry out a separate purpose you have consented to. Access must be limited to what that task requires and subject to confidentiality and access controls. Routine reading of customer documents for general quality improvement is not included in this permission.
OpenAI states that API data is not used for model training unless the customer opts in. Its service can still retain data for purposes such as abuse monitoring. No training and no retention are different commitments. See OpenAI’s API data controls and the retention section below.
6 Who receives personal data
We use the following providers for the indicated purposes. Information is limited to what the relevant service needs; every provider does not receive every category of data.
| Provider | Purpose and relevant information |
|---|---|
| Vultr | Hosts our application and database on a server in Germany. Hosted data can include accounts, stored reports, library records, and operational records. Backup and support arrangements are addressed below. |
| OpenAI | Processes submitted text, instructions, results, and relevant safety identifiers for AI detection and writing assistance. |
| Copyscape | Processes text for plagiarism checks and stores documents deliberately added to the Private Library. |
| Dodo Payments | Handles checkout, payments, subscriptions, refunds, fraud checks, and related tax obligations. It receives purchase and customer information and returns payment references, status, and entitlement information to us. |
| Google Analytics | Measures website use through activity, device, and analytics information, subject to applicable consent choices and the configuration described below. |
| Google reCAPTCHA | Helps protect the Rewriter, Humanizer, and Grammar Checker from automated abuse using information such as IP addresses, browser/device signals, interaction data, and verification results. |
| Google sign-in | Authenticates users who choose this sign-in option and supplies the basic profile information described above. |
| Purelymail | Handles service and support email, including addresses, message contents, attachments, and delivery information. |
Dodo Payments acts as an independent controller for its merchant-of-record payment, fraud, tax, and legal-seller activities. Its own Privacy Policy explains those activities. We remain responsible for our own handling of account and purchase records. Full payment-card details are entered through the payment service; our application receives transaction information rather than storing the full card number or card security code.
Providers can act on our instructions or independently for particular activities, depending on the service and their role. Their notices explain their independent activities, including their own legal obligations and service administration. Those notices do not replace PlagScanX’s responsibilities for its own processing.
We may disclose relevant information to professional advisers, regulators, courts, or law enforcement where there is a lawful reason to do so. If our business is reorganised or transferred, personal data may be disclosed or transferred where lawful, with appropriate safeguards and notices. A change of ownership does not automatically authorise unrelated uses of submitted writing.
People you give access to a shared report also receive its contents, as explained next.
7 Shared reports and information about other people
Enabling a report-sharing link can make the report and its included text accessible to anyone who obtains the link, without an account. Only share material you are authorised to disclose. You can disable the link, but this does not recall copies someone already downloaded or copied.
If you submit another person’s writing, make sure the submission is permitted and that any required information has been given to them. Remove personal details that are unnecessary for the check. These responsibilities do not remove PlagScanX’s own data protection duties.
If a report or submission contains your personal data even though you are not a customer, you may contact [email protected]. You do not need to create or purchase an account to ask about your rights. We may need enough information to locate the material and protect other people’s information when responding.
8 Cookies analytics and email preferences
We use cookies and similar browser storage for sign-in, security, preferences, and selected features. Browser storage can also hold text you entered before signing in so it can be handed over to the tool after authentication. That local copy is separate from saved account history and may remain on the device until the handover completes or the browser’s site data is cleared.
Google Analytics helps us understand website activity and improve navigation and performance. We request your consent before activating optional analytics where consent is required. You can use the cookie banner and, where displayed, its Cookie preferences control to change your analytics choice. Our Cookie Policy explains the controls and how stored cookies are handled. Refusing optional analytics does not prevent use of the core service.
We do not use submitted documents or report contents for website analytics. Our Cookie Policy explains the cookies and similar technologies used, their purposes, providers, duration, and available controls, including those associated with security checks.
We use Purelymail for account and support messages. Marketing preferences are off by default. If you separately subscribe to promotional emails, you can unsubscribe through the route provided in those messages or contact us for help. Unsubscribing from marketing does not prevent essential security, account, or transaction messages.
9 How long information is kept
Retention depends on why information is needed, the service you request, your deletion choices, and applicable legal duties. We consider whether an account or enquiry remains active, whether information is needed for a requested feature, and whether a specific dispute, security incident, or legal obligation requires continued retention.
| Category | Retention period or criteria |
|---|---|
| Account and profile | Retained to operate your account and handle its closure. Any continued retention is limited to necessary legal, security, or dispute-related purposes. |
| Saved report text and results | Retention depends on your saving choice, the report-history service being provided, deletion requests, account closure, and any necessary legal retention. You can delete saved reports or contact us about erasure. A plan’s report-access window is not a storage or deletion deadline. |
| Original uploaded files | Temporarily processed for text extraction, with cleanup after extraction and request-end cleanup as a fallback. Extracted text and report titles have separate storage rules. |
| Private Library documents | Stored for the comparison feature until you remove them or account erasure is completed, subject to any necessary legal retention. Removing a library entry involves deleting its indexed copy with Copyscape. |
| Usage and request records | Retained where needed to administer word allowances, verify transactions and tool use, investigate errors or misuse, and address related disputes. These records can outlast a deleted report and include the tool, word count, score, and time. |
| Support messages and attachments | Retained to resolve the enquiry and any related follow-up, complaint, or legal claim. The subject of the enquiry and any applicable limitation period affect how long records are needed. |
| Security and access-restriction records | Retained while necessary to address the relevant risk, enforce a justified restriction, investigate an incident, or establish or defend a claim. |
| Purchase and accounting records | Retained for applicable accounting, tax, payment-dispute, and legal-claim requirements. The record type and the relevant statutory period determine retention. |
| Website analytics | We use Google Analytics’ default two-month retention setting for user-level and event-level data covered by that setting. Deletion is processed monthly. Standard aggregated reports are outside this setting, and user identifiers can be retained longer where reset-on-new-activity applies. |
| Backups and server logs | Retention depends on recovery needs, backup rotation, troubleshooting, security investigations, and applicable legal duties. A copy removed from active systems can remain in a backup until that copy is replaced or deleted. |
Google explains its default Analytics retention period and retention controls, including the treatment of aggregated reports and renewed user identifiers.
Losing access to an older report is not the same as deleting it. A locked report that can be reopened after a qualifying purchase remains stored. Deleting an individual report removes its saved text and result payload, but associated usage records can remain for the purposes described above.
Account deletion can require separate cleanup with external providers. A failed remote operation may delay completion; contact us if deletion cannot be completed through your account. Deletion is not necessarily immediate across backups, provider systems, and legally required records.
OpenAI’s standard API abuse-monitoring records can include inputs and outputs and are normally retained for up to 30 days. Longer retention may apply where required by law or reasonably necessary to prevent harm. Other feature-specific retention can apply. Our requests disable optional response storage where supported, but this does not mean zero provider retention. See OpenAI’s API data controls.
Copyscape’s processing records are separate from your saved PlagScanX reports. Removing a report from PlagScanX does not by itself remove a document you separately added to the Private Library or every provider record associated with an earlier check.
After account deletion, we temporarily retain keyed identifiers derived from email or Google sign-in identity, together with consumed word allowances and their original reset dates, to prevent repeated new Free allowances. These records do not contain document text, reports, or payment details. They stop applying at the original reset dates and are removed through scheduled cleanup. They are pseudonymous, not anonymous.
An account-access restriction can require retaining the email address, restriction reason, and related dates after account closure. You can ask us to review the restriction and whether continued retention is justified.
Where a legal obligation or specific claim requires information to be kept longer, its continued use is limited to that purpose. You can contact [email protected] about the retention of particular information or to exercise your deletion rights.
10 Where information is processed
Our main application server is hosted by Vultr in Germany. External providers may also process information outside the European Economic Area. Purelymail identifies its email hosting location as Northern Virginia in the United States. Dodo Payments identifies payment infrastructure in India. Other processing locations can arise through providers’ services, support teams, and subprocessors.
International transfers are subject to applicable data protection requirements. Depending on the recipient and processing, relevant safeguards may include an applicable adequacy decision or the European Commission’s Standard Contractual Clauses with any necessary additional protections. These arrangements must cover the particular transfer; a recipient’s country alone does not establish the applicable safeguards.
You can contact [email protected] for information about the arrangements relevant to your data and how to obtain a copy of applicable safeguards, subject to lawful redactions. Accepting this policy does not constitute general consent to routine international transfers.
11 How we protect information
We use technical and organisational measures appropriate to the information and risks involved. These include limiting access to authorised people, protecting account access, maintaining the service, and addressing security incidents. No system can be guaranteed completely secure.
Do not include passwords, payment-card security codes, or unnecessary sensitive information in text submitted for checking or in support messages. If you believe your account or a report link has been exposed, contact [email protected].
Where a personal data breach requires notification, we will notify the relevant authority and affected people in accordance with applicable law. A supplier incident does not automatically remove our own obligations.
12 Sensitive information and automated assessments
Writing can reveal health, religion, political views, ethnicity, sexual orientation, criminal allegations, or other sensitive matters. Submitting it does not automatically provide a lawful basis for every use. Avoid unnecessary sensitive details. Where such processing is necessary and permitted, the applicable additional legal conditions must also be met; accepting the Terms is not blanket explicit consent on behalf of everyone mentioned.
The AI Detector evaluates writing patterns and returns assessments, scores, and explanations. The Plagiarism Checker compares text with available sources and returns matches. These results may concern an identifiable writer and can be incorrect or incomplete.
PlagScanX’s reports do not themselves decide a grade, admission, disciplinary action, or employment outcome. Our service rules require human review and prohibit treating a detector score as the sole basis for an adverse decision. An organisation using the tools remains responsible for its decisions and any additional notices and safeguards required by law.
If you believe an automated security or access check has incorrectly affected your account, contact [email protected] to request a review.
13 Your privacy rights
Depending on the law and the circumstances, you may have the right to:
- Learn how your personal data is used and obtain access to it.
- Correct inaccurate data or complete missing information.
- Request deletion or restriction of processing.
- Receive eligible data you provided in a commonly used, machine-readable format and have it transferred where the portability right applies.
- Object to processing based on legitimate interests, taking account of your situation.
- Object at any time to direct marketing and related profiling.
- Withdraw consent as easily as it was given, without affecting earlier lawful processing.
- Obtain the safeguards applicable to solely automated decisions with legal or similarly significant effects, including human intervention and contesting a decision where required.
Email [email protected] to make a request. Available account controls can also be used to manage reports, sharing, preferences, and account deletion. You do not have to pay for a plan to exercise privacy rights.
We may ask for proportionate information to verify a request, locate the relevant data, or confirm an authorised representative’s authority. We do not routinely require government identification. We protect other people’s rights when providing copies or deleting shared material.
For requests covered by GDPR, we respond without undue delay and normally within one month. Where legally permitted because of complexity or the number of requests, we may extend by up to two further months and explain the extension within the first month. If we cannot fulfil a request, we will explain the reason and available complaint routes. Requests are normally free; any exceptional fee or refusal must meet the law’s requirements.
Where we process solely for an organisational customer, we may direct or forward the request to that controller and assist it. We still address requests concerning information for which we are responsible ourselves. A technical deletion failure or pending provider cleanup does not cancel your privacy rights.
14 Complaints
You may contact us about a privacy concern at [email protected]. You also have the right to complain to the competent supervisory authority, including one in the EEA country where you live or work or where you believe a breach occurred.
In Finland, the authority is the Office of the Data Protection Ombudsman. Information on making a complaint is available through its complaint guidance. This policy does not require you to waive that right or to complete a private dispute procedure first.
15 Children and educational use
Account eligibility is governed by our Terms. Documents submitted by an adult or an organisation may still contain information about children. That information remains subject to applicable data protection requirements, including an appropriate legal basis, notices, and safeguards.
A school’s use of the service does not automatically establish parental consent or authorise unrelated use of students’ writing. The organisation remains responsible for the requirements applying to its use of the service, alongside PlagScanX’s own duties.
If you believe a child has created an account contrary to the applicable account rules, or that their information has been submitted unlawfully, contact [email protected] so we can assess the matter and take appropriate action.
16 Additional information for California residents
This section applies where your personal information is covered by the California Consumer Privacy Act, as amended by the California Privacy Rights Act. It supplements the information above and does not restrict rights provided by other laws.
The data described in section 2 can fall within California categories including identifiers; customer records; commercial information; internet or electronic activity; approximate geolocation derived from technical data; and inferences such as an assessment associated with a writer. Submitted material may also contain professional, education, protected-characteristic, or sensitive information, depending on its contents. We do not ask for all of those details merely to run a check.
Sources, purposes, recipients, and retention are described in sections 2 to 10. Disclosure to a provider operating under the required service-provider restrictions differs from selling information or sharing it for cross-context behavioural advertising.
Where applicable, you may request access to or knowledge of your personal information, correction, or deletion; opt out of sale or sharing; and limit qualifying uses and disclosures of sensitive personal information. You may use an authorised agent, subject to appropriate authority and verification requirements. We will not unlawfully discriminate against you for exercising these rights.
Requests can be sent to [email protected]. We do not require an account solely to submit a request. Verification is proportionate to the request; opt-out requests are not subject to the identity verification used for access to specific information. Where applicable law requires a business to recognise opt-out preference signals, such as Global Privacy Control, that requirement is separate from ordinary cookie preferences.
For covered requests to know, correct, or delete, we acknowledge receipt within 10 business days and respond within 45 calendar days, subject to a permitted extension with notice. Covered sale/sharing opt-outs and sensitive-information limitation requests are handled as soon as feasible and within the applicable maximum of 15 business days. If a request is denied, we explain the applicable reason. Any additional rights concerning automated decisionmaking apply according to their legal scope and effective requirements.
17 Changes to this policy
We may update this policy to reflect changes in the service, providers, legal requirements, or privacy practices. We will give appropriate notice of material changes before they take effect where required.
A revised policy does not by itself authorise a new incompatible use of previously collected data. Where a change requires fresh consent or another legal step, we will complete that step before the new processing begins.
18 Contact us
PlagScanX
Email: [email protected]
For privacy requests, tell us which account, report, or activity your request concerns where possible. Do not send a complete confidential document or identity document unless we explain why it is needed and provide an appropriate way to send it.