Draft — pending legal review
This document is a working draft prepared for review by WriteStuff's owner and legal counsel. It is not yet a binding agreement, may change substantially, and will be replaced by a reviewed version before WriteStuff accepts paying customers. Text in [square brackets] is a placeholder.
Privacy Policy Draft
Draft prepared September 25, 2026. Not yet in effect.
This policy explains what personal data WriteStuff collects, why, who we share it with and the choices you have. We collect what we need to run the service, we don't sell personal data, and we don't use your content for advertising or to train AI models.
1. Who we are
WriteStuff is operated by [LEGAL ENTITY NAME], [ADDRESS] (“we”, “us”). For account data and our website we are the controller. For content that customers store in their workspaces, we act as a processor on the customer's behalf. See our Data Processing Addendum. Privacy contact: [PRIVACY CONTACT EMAIL]. [EU/UK REPRESENTATIVE, IF REQUIRED]
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password hash, role, workspace membership, notification preferences | You, or the workspace admin who invites you |
| Workspace content | Content items, comments, files, templates, and anything personal they happen to contain | Customers and their teams, including content imported from other tools |
| Billing data | Billing contact, plan, subscription status. Card details go directly to our payment processor and never reach our servers | Workspace owners |
| Security and usage logs | Sign-in events, IP address, browser user agent, audit-log entries (who changed what, when) | Generated when you use the service |
| Integration credentials | API keys you give us for the importer or webhooks (encrypted at rest) | Workspace admins |
3. How we use it, and our legal bases
- To provide the service (contract): accounts, workspaces, collaboration, notifications, exports, imports and integrations.
- To keep it secure (legitimate interests): authentication, rate limiting, abuse prevention, audit logs and incident response.
- To bill you (contract, legal obligation): subscriptions, invoices, tax records.
- To communicate (contract, legitimate interests): transactional emails such as sign-in links, invitations and mentions. Product announcements only where permitted, with an opt-out.
- To improve WriteStuff (legitimate interests): aggregated, non-content usage metrics. [CONFIRM IF ANY ANALYTICS TOOL IS ADDED]
We don't sell or rent personal data, don't use workspace content for advertising, and don't use it to train machine-learning models.
6. International transfers
[DESCRIBE WHERE DATA IS STORED AND THE TRANSFER MECHANISM, e.g. Standard Contractual Clauses / UK IDTA / Data Privacy Framework, TO BE CONFIRMED BY COUNSEL.]
7. How long we keep it
- Account data: while your account is active, then deleted or anonymized within [30] days of account deletion, unless we must keep it longer by law.
- Workspace content: until the customer deletes it or closes the workspace, then [30] days for export before deletion. Backups are overwritten within [BACKUP RETENTION PERIOD].
- Security and audit logs: [RETENTION PERIOD].
- Billing records: as long as tax and accounting law requires.
8. Security
We protect data with encryption in transit (TLS), salted slow password hashing, encryption at rest for integration secrets, strict workspace isolation on every request, least-privilege access and security headers. No system is perfectly secure. If a breach affects your personal data, we'll notify you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise them, contact [PRIVACY CONTACT EMAIL]. If your data sits in a customer's workspace, we'll direct your request to that customer, who controls it. You can also complain to your local data-protection authority.
10. Children
WriteStuff is a business tool and isn't directed at children. We don't knowingly collect personal data from anyone under [16].
11. Changes to this policy
We'll post updates here and give notice of material changes by email or in the product.