Privacy

This page explains what personal data InWriting (getinwriting.com) holds and why. For anything privacy related, email privacy@getinwriting.com.

What we collect

• Your email address, when you create an account.
• The agreements you write: the text, the optional reference date, and the recipient's email address.
• Any file attached to an agreement, with its name, size, and a fingerprint (hash) of its contents.
• Each agreement's outcome: whether it was agreed, declined, or expired, and when.
• Records of the emails we send (sign-in links, agreement requests, confirmations).

That is the full list. We also collect anonymous, cookieless page view counts (via Vercel) to see which pages are used. These aren't linked to you or your agreements. There are no advertising trackers, and the only cookies are the ones that keep you signed in.

If someone sent you an agreement

The sender gave us your email address so we could send you their agreement. We use it only for that: sending you the agreement and the confirmation of your response. Your response and its time become part of the agreement record that both of you receive.

Why we hold it

To provide the service: signing you in, sending agreements, and keeping the timestamped record that both parties rely on. That record is the product. Our lawful bases under UK GDPR are performance of a contract (providing the service to account holders) and legitimate interests (keeping the record and contacting recipients on a sender's behalf). We may also email account holders about changes to the service. We do not sell personal data or share it with anyone except the service providers below.

Who processes it for us

• Supabase: database and sign-in.
• Vercel: web hosting and anonymous page view counts.
• Resend: sending email.

Each processes data on our instructions under a data processing agreement. Some of this processing happens in the United States, covered by safeguards such as standard contractual clauses.

How long we keep it

Agreement records are kept while the sender's account exists, since a record you can point back to later is the point of the service. On the free plan, attached files are stored for 1 year; the file's name, size, and fingerprint stay on the record after that. If you delete your account, we delete your data within 30 days. To delete your account, email us.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, or object to our holding it. Email privacy@getinwriting.com and we'll respond within a month. Where a request affects an agreement record that the other party relies on, we may need to balance both parties' interests. If you're unhappy with how we handle your data, you can complain to the ICO at ico.org.uk.

Changes to this page

If we change how we handle personal data, we'll update this page and the date at the top. For significant changes we'll email account holders.