Privacy Policy

Effective Date: 2026-01-01  ·  Version: 1.0

1. Who We Are

AICheckHub ("we", "us", or "Service") is operated by an individual developer based in the United Kingdom. We are the data controller for information processed through aicheckhub.uk.

For privacy questions or requests: [email protected]. We aim to respond within 5 business days.

2. What This Policy Covers

This policy explains what personal data we collect when you visit aicheckhub.uk, how we use it, who we share it with, how long we keep it, and the rights you have over it. It applies to all visitors, registered users, and paying subscribers.

3. Data We Collect

3.1 Account Data

• Email address — collected when you create an account. Used to send one-time sign-in codes (OTP) and service notifications. We use Resend to deliver these emails.
• Account metadata — plan type (Free / Pro / Lifetime), plan status, registration date, and trial usage flag.

3.2 Text You Submit

• Free tier: Your submitted text is sent to our detection models for analysis and then discarded. We store only a hash of the text (not the text itself) for rate-limiting and abuse prevention.
• Pro / Lifetime: If you use the history or share feature, your text and detection results may be stored associated with your account so you can access them later. You can delete them at any time.

3.3 Detection Results

Scores, per-model results, divergence values, and sentence-level data generated by your detection requests may be stored if you are signed in and have a paid plan (to power your history). Anonymous or Free tier results are not persisted.

3.4 Usage and Technical Data

• IP address hash — we hash your IP to enforce rate limits. We do not store your raw IP address beyond the immediate request context.
• Session cookie — __session (HttpOnly, 30-day expiry) to keep you signed in.
• Browser and device signals — collected by analytics tools we use (see Section 5). We do not build fingerprints ourselves.

3.5 Payment Data

Payment card details are handled entirely by Stripe and never touch our servers. We store your Stripe customer ID and subscription status to manage your plan. See Stripe's Privacy Policy.

4. Legal Basis for Processing (GDPR)

Where UK / EU GDPR applies, we rely on the following legal bases:

• Contract performance — processing necessary to provide the Service you signed up for (account, detection, results).
• Legitimate interests — security, fraud prevention, abuse detection, and improving the Service, where these interests are not overridden by your rights.
• Consent — analytics and advertising cookies (where your cookie consent applies). You may withdraw consent at any time via our cookie banner or by emailing us.
• Legal obligation — where we are required by law to process data.

5. Third-Party Services

We use the following third-party services. Each has its own privacy policy:

5.1 Infrastructure

• Cloudflare (Workers, Pages, D1, R2) — hosting, edge delivery, and database. Your requests pass through Cloudflare's global network. See Cloudflare Privacy Policy.

5.2 AI Detection Models

• Hugging Face Inference API — we send your submitted text to Hugging Face to run AI detection models. Text is transmitted over HTTPS and is not retained by us after detection is complete. See Hugging Face Privacy Policy.
• Sapling AI — an additional detection model. Text may be transmitted to Sapling's API. See Sapling Privacy Policy.
• Google Gemini API — used for one of the detection layers. Text may be transmitted to Google's API. See Google Privacy Policy.

5.3 Payments

• Stripe — processes all payments. Card data goes directly to Stripe and is never stored on our servers. See Stripe Privacy Policy.

5.4 Email

• Resend — sends transactional emails (sign-in OTP, billing notifications). Your email address is shared with Resend for this purpose. See Resend Privacy Policy.

5.5 Analytics (all users)

• Google Analytics 4 — page views, sessions, and usage patterns. Data is sent to Google. See Google Privacy Policy.
• Microsoft Clarity — session recording and heatmaps. See Microsoft Privacy Statement.
• Plausible — privacy-friendly, cookieless page analytics. No personal data or cookies are stored by Plausible. See Plausible Privacy Policy.
• Ahrefs Analytics — traffic measurement. See Ahrefs Privacy Policy.

5.6 Advertising (Free tier only)

Free and anonymous users see advertisements to support the Service. Pro and Lifetime subscribers do not see ads.

• Google AdSense / Google Ad Manager — serves display ads. Google may use cookies and device signals to personalise ads. See Google Privacy Policy and Google Ad Settings.
• Adsterra — serves native banner and other ad formats. See Adsterra Privacy Policy.

6. Cookies and Tracking

We use cookies and similar technologies. See our Cookie Policy for the full list of cookies used, their purpose, and duration. You can manage your preferences via your browser settings.

7. How We Use Your Data

• Provide, operate, and improve the detection and humanizer service.
• Authenticate you and manage your account and subscription.
• Send transactional emails (OTP codes, billing receipts, material policy changes).
• Enforce rate limits and prevent abuse.
• Understand usage patterns and improve the product (analytics).
• Serve relevant advertisements to Free tier users.
• Comply with legal obligations.

We do not sell your personal data. We do not use your submitted text to train our own AI models.

8. Data Retention

• Free / Anonymous — submitted text is not stored. IP hash retained for up to 24 hours for rate limiting.
• Account data — retained while your account is active and for 30 days after deletion (to allow recovery). After 30 days, all personal data is permanently deleted.
• Detection history (Pro/Lifetime) — stored while your account is active. You can delete individual results at any time.
• Stripe payment records — retained per Stripe's policy and applicable financial regulations (typically 7 years).
• Analytics data — governed by each analytics provider's own retention policies.

9. International Transfers

Our services are hosted on Cloudflare's global network. Your data may be processed in the United States or other countries where our third-party providers operate. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms for transfers outside the UK / EEA.

10. Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your account and personal data. You can do this directly at /account (→ "Delete Account"). Deletion takes effect within 30 days.
• Export — download a copy of your account data at /account (→ "Export Data").
• Restriction / Objection — object to or restrict certain processing, particularly for direct marketing or legitimate interest grounds.
• Withdraw consent — withdraw cookie consent at any time via the cookie banner or your browser settings. This does not affect the lawfulness of processing before withdrawal.
• Lodge a complaint — you have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).

To exercise any right, email [email protected]. We will respond within 30 days.

11. Children's Privacy

The Service is not directed at children under 13 years old (or 16 in the EU/UK). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Security

We use HTTPS throughout, HttpOnly cookies, hashed credentials, and Cloudflare's edge security. No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please email [email protected] responsibly.

13. Changes to This Policy

We will notify registered users of material changes by email at least 14 days before they take effect. The current version and effective date are shown at the top of this page. Continued use of the Service after changes take effect constitutes acceptance.

14. Contact

For all privacy-related questions and requests:

• Email: [email protected]

We respond within 5 business days for general enquiries and within 30 days for formal rights requests.