Privacy Policy

ProofedAI is an AI proofreading service at proofed.ai. Proofed Inc. (“Proofed,” “we,” “us” or “our”) runs it and is responsible for your personal information. In EU and UK law, that makes us the “controller.” Proofed is a Delaware company, file number 6566631, with its registered office at 8 The Green, Dover, DE 19901, USA.

This policy covers the ProofedAI website and app, our API, our MCP server and documents you send us by email. Proofed’s human proofreading service at proofed.com has its own privacy policy. Our Terms of Service set out the rules for using ProofedAI.

Your account

• Your name, email address and password. We store only a scrambled version of your password (a hash), never the password itself.
• If you sign up or sign in with Google: the ID, name and email address of your Google account, and the sign-in tokens Google gives us, which we store encrypted.
• Your settings, such as two-factor authentication if you turn it on.

Your documents and results

• The files you upload (DOCX, PDF, PPTX, ODT, HTML, EPUB, RTF or TXT, up to 96 MB each), the text you send through the API or MCP server, and files we fetch from links you give us.
• The options you choose, such as the dialect and human review, any note you leave for an editor, and the style guide used for your account.
• What we send back: the corrected file, the list of changes, our notes and fact-check reports.

Your documents can contain personal information about you or other people. We handle it as this policy describes. Section 12 explains your part when a document contains other people’s information.

Documents you email to us

When you email a document to our inbound address, our email provider, Mailgun, receives it and passes it to us. We keep the sender’s address and name, the subject line, the results of the checks that confirm who sent it, and the attachments. We read the subject and message only to see whether you named a language. We do not keep the message itself.

Our Google Docs extension

If your account uses our extension for Google Docs, it sends us the address and the text of the document you review. We delete that text from our servers within two days.

Payments

What you bought, the amount, the date, and Stripe’s references for the payment and the receipt. We give Stripe your email address for the checkout and the receipt. Stripe collects your card details directly, and we never see or store your full card number. We also keep your token balance and a record of what each job cost.

API and MCP access

The names of your API keys and when they were last used. We store only a scrambled version of each key. When you connect an AI assistant through MCP, we keep the access tokens for that connection. If you give us a webhook address or extra details for a job, we keep those too.

How you use the Service

Our servers keep standard logs of requests, including IP addresses, browser details, the pages and API endpoints requested, and errors. We also keep records of each job, such as when you sent it, its word count, its cost, its progress and whether it worked. If you reject suggested changes, we may record which ones.

Messages you send us

If you email us, we keep your message and our reply, so we can help you and answer later questions.

We use your information for the purposes below. For people in the EU and the UK, we also give the legal basis for each one.

• To provide the Service (to perform our contract with you): to create and secure your account, log you in, proofread and fact-check your documents, arrange human reviews, take payments, and send you service emails such as log-in links, password resets and “your document has been proofread” notices.
• To keep the Service safe and working (our legitimate interests): to prevent fraud and abuse, check who sent an email before we charge an account, alert our team when a job fails, and find and fix problems.
• To improve the Service (our legitimate interests): to measure the quality, speed and cost of our proofreading, test changes to it against past documents and results, and learn which suggestions people reject. Only Proofed staff and contractors bound by confidentiality do this work.
• To meet legal duties (legal obligation): to keep payment records for tax and accounting, and to respond to lawful requests.
• With your consent: for anything else we ask your permission for, such as using a personal user’s name in our marketing. You can withdraw your consent at any time.

We do not sell your personal information. We do not use it for advertising or share it for targeted advertising. We do not make decisions about you that have legal or similarly significant effects based only on automated processing.

Our AI proofreading service runs on Amazon Web Services servers in Ireland, in the EU. To proofread or fact-check a document, it sends the document’s content and our instructions to third-party AI model providers. We use Anthropic and OpenAI, both based in the US. Which one handles a document depends on the task and on availability. If one is unavailable, we may use the other.

We send the document and the settings for the job, such as the dialect and the style guide. We do not send your name or email address with it, though the document itself may contain them.

For a fact-check, the AI searches the web for sources through our AI provider’s web search. The searches are based on the claims in your document.

Our AI providers do not use your documents to train their models under the terms we use them on. They may keep what we send them for a limited time to detect abuse, and then delete it, unless the law requires them to keep it longer.

Our proofreading service deletes the files it receives after 14 days and the files it produces after 30 days. The copies in your ProofedAI account are kept as section 8 explains.

A Proofed editor sees your document only if you buy a human review. When you do, we place an order with Proofed’s human editing service. The editor gets a private link that stops working after a set time. Through it, the editor downloads your original and the AI’s version and uploads the final file.

We send Proofed your note for the editor, the dialect and your style guide. We do not send your name or email address. Proofed’s editors are freelance professionals bound by confidentiality agreements, and they may work in another country. Proofed’s human editing service handles the order under the proofed.com privacy policy.

We use these service providers. They handle your information for us, under contract, to provide their service. Some, such as Stripe and Google, also handle it under their own privacy policies.

• Amazon Web Services: runs our AI proofreading service in Ireland.
• Anthropic and OpenAI: the AI models that proofread and fact-check your documents.
• Proofed’s human editing service and its editors: only for documents you buy a human review for.
• Stripe: card payments.
• Mailgun: receives documents you email to us.
• Our email delivery provider: sends account and service emails.
• Google: if you choose to sign in with Google.
• Slack: our team’s internal alerts. If a job fails, we post your email address and the file name to our team’s Slack so we can fix it.
• Bunny Fonts: our pages load their fonts from Bunny Fonts, so your browser sends it your IP address.
• Have I Been Pwned: when you set a password, we check it against passwords exposed in known data breaches. Only the first five characters of a scrambled version of the password leave our servers.
• Our cloud hosting providers: run our website, database and file storage.

We also share information:

• with the places you tell us to send it, such as your webhook address or the AI assistant you connect through MCP;
• when the law requires it, for example in response to a court order;
• to protect people, our rights or the Service, for example with the police or the courts if we believe fraud or another crime has happened or is about to happen;
• if Proofed is bought by, sells a large part of its business to, or merges with another company. The new owner must then protect your information as this policy does.

ProofedAI uses only the cookies it needs to work:

• a session cookie, which keeps you logged in as you move between pages;
• an XSRF-TOKEN cookie, which protects our forms against cross-site request forgery;
• a “remember me” cookie, set only if you check “Remember me” when you log in, or log in with a link we send you, so you stay logged in.

Your browser also stores your light or dark appearance setting on your own device.

We do not use analytics, advertising or tracking cookies on ProofedAI. When you pay, you use Stripe’s checkout page, and when you sign in with Google, you use Google’s pages. Those pages set their own cookies under Stripe’s and Google’s policies.

• Your account: while your account is open.
• Your documents and results: while your account is open, so you can download them again. You can ask us to delete any document at any time.
• Copies at our AI proofreading service: the files it receives for 14 days and the files it produces for 30 days. Then they are deleted automatically.
• Text from Google Docs: deleted within two days.
• Log-in links: they work for 15 minutes, and we delete them a week after they expire.
• Payment records: kept after you delete your account, for as long as tax and accounting rules require.
• Server logs: kept for a limited time, for security and to fix problems.

When you delete your account in your settings, we delete your account along with the records of your documents, results, fact-checks, API keys and log-in connections. Some stored files can stay on our servers until we erase them. To have every copy erased, email legal@proofed.com and we will do it within 30 days.

• We encrypt connections to ProofedAI with HTTPS.
• We store passwords, API keys and log-in links only in scrambled (hashed) form, and we encrypt the sign-in tokens Google gives us.
• You can turn on two-factor authentication.
• Download links from our API are signed and expire.
• Only Proofed staff who need to see your documents can open them.

No system is perfectly secure. If you think you have found a security problem, email legal@proofed.com.

Proofed is a US company, and our AI providers are based in the US. Our AI proofreading service runs in Ireland. Proofed’s editors work in many countries. So your information may be processed outside the country where you live, including in the US.

When we transfer personal information out of the EU or the UK, we rely on the safeguards the law requires, such as the European Commission’s standard contractual clauses and the UK addendum to them in our providers’ data processing terms.

Wherever you live, you can:

• see and update your name and email address in your settings;
• download your documents and results;
• revoke API keys in your settings;
• delete your account in your settings.

If you are in the EU, the UK or another place with similar laws, you also have the right to:

• access the personal information we hold about you and get a copy of it;
• have information that is wrong corrected;
• have your information deleted (the “right to be forgotten”);
• get your information in a portable format;
• object to our use of it, or ask us to restrict it, where we rely on our legitimate interests;
• withdraw your consent at any time, where we rely on consent;
• complain to a data protection authority. In the EU, that is usually the authority where you live or work. In the UK, it is the Information Commissioner’s Office (ICO).

If you live in a US state with a privacy law, such as California, you can ask what personal information we hold about you, and ask us to correct or delete it. Using these rights will not change how we treat you. We do not sell your personal information or share it for targeted advertising.

To make a request, email legal@proofed.com with your full name and the email address on your account. We may ask for proof of identity if those details do not match our records. We reply within 30 days. If you ask us to delete your information, we remove your data and documents and email you to confirm.

Your documents may contain personal information about other people, such as the names in a report. You are responsible for having the right to share it with us. If you are a business user, we process that information on your behalf and on your instructions, to provide the Service. If you need a data processing agreement, email legal@proofed.com.

ProofedAI is not for children under 16. We do not knowingly collect personal information from them. If you think a child under 16 has given us personal information, email legal@proofed.com and we will delete it.

We may update this policy. When we do, we will post the new version on this page and change the date at the top. If a change is significant, we will also tell account holders by email or in the app.

• Privacy questions and data requests: legal@proofed.com
• Help with ProofedAI: ai@proofed.com
• Post: Proofed Inc., 8 The Green, Dover, DE 19901, USA