Privacy Policy

HumanizeIt ("we", "our", or "us") is run by Boubaker Jouini, who is the controller of the personal data described in this policy. Postal address: A3-8 RESD. EXPRESS, Centre Urbain Nord, Tunis 1087, Tunisia. Email: support@humanizeit.app.

We are committed to protecting your personal information. This Privacy Policy explains what we collect when you use humanizeit.app, why, on what legal basis, how long we keep it, and who processes it for us.

• Account data: your email address and name, through Clerk (email, Google or GitHub sign-in).
• Your documents (signed-in users): when you check, rewrite or upload text in your dashboard, we save it as a document in your account so it appears in History. A document holds the original text (for PDF and DOCX uploads, the text extracted from the file; we don't keep the file itself), the rewritten text if you humanized it, the scores and pattern analysis, the tone, the word count and the date.
• Voice profiles (Voice Match, paid plans): when you create a voice, the writing samples you paste are sent once to our AI provider to build a short description of your style (sentence length, word choice, tone and similar traits). We store only that description (it may quote a short phrase you use often), the name you give the voice and the samples' word count, never the samples themselves. You can delete a voice from the Voice page at any time, and deleting your account deletes them all.
• Usage data: words processed, number of rewrites, quota resets and timestamps, used to apply your plan's limits.
• Subscription data: your plan (Free, Pro or Team) and billing status, through Lemon Squeezy. We never see your full card details.
• Free tools without an account: the instant AI detector runs in your browser, so that text stays on your device. The optional deep scan and the free humanizer send your text to our server and our AI provider for a one-time analysis or rewrite; we don't store that text. To stop abuse, we keep short-lived counters keyed by your IP address (deleted after about a day).
• Email and lead data: when you give us your email on a form (a free guide, the emailed detector report, the Chrome extension waitlist or the Founding 100 list), we store your email, which form and resource it was, the topics you opted into, and how you found us (see Attribution below). The detector report email contains your scores and fix list, never your text.
• Consent records: for every opt-in, confirmation or unsubscribe: the topic, the exact wording you saw (by version), how you gave it (checkbox, confirmation button, preference page), the page, the time, your browser's user-agent string (shortened) and a keyed hash of your IP address rather than the address itself.
• Email delivery records: for each email we send: which email it was, when, and whether it was delivered, bounced or marked as spam. These records store a hash of your address and its domain, not the address.
• Attribution: two first-party cookies remember how you first and most recently arrived (referring site, landing page, campaign tags such as utm_source). They are copied to your record when you sign up or submit a form. They are not set in the EU, the EEA, the UK or Switzerland (judged by your device's time zone) or when your browser sends Global Privacy Control, and you can refuse them anywhere else. Where they aren't set, a form you send still carries how you arrived on that visit (nothing is stored on your device for it), unless you refused attribution. See the Cookie Policy.
• Customer record: to decide which emails and personal notes are relevant, we keep a simple record per person built from the data above: a lifecycle stage (for example lead, active user or customer), an activity score, a timeline of key events (signed up, first document, plan changes, emails) and the founder's notes. It contains no document text.
• Technical data: IP address, browser type and pages visited, through our hosting and analytics tools (Sections 6 and 7).

• Providing the humanization and detection service, including History
• Enforcing daily and monthly word quotas based on your plan
• Processing payments and managing subscriptions
• Sending transactional and account emails: what you requested (a guide, your report, a confirmation link), receipts, and notices about your account such as a plan that is about to end. You can turn off non-essential account emails in your email preferences.
• Sending marketing emails, only with your consent (Section 5)
• Occasional personal emails from the founder about your account, which you can stop by replying or through your email preferences
• Understanding which pages and sources bring people to the site, and improving the service

We never sell your data, and we never use your documents to train AI models.

Under the GDPR and the UK GDPR, we rely on these legal bases:

• Contract: to provide what you sign up for or ask for: your account, documents and History, checks and rewrites, the free tools, your plan's quotas and subscription, a free guide or report you request, and the transactional and account emails that go with them.
• Legitimate interests: to keep the service secure and stop abuse (the IP-based counters), to understand which pages and sources bring people to the site and improve it (analytics and attribution, Section 6), to keep the customer record and send occasional personal emails about your account, and to keep consent records and the suppression list so we can prove your choices and never email you after you opt out. You can object at any time (Section 10); the button on our Cookie Policy page turns off Google Analytics, PostHog and the attribution cookies on your browser.
• Consent: marketing emails (Section 5). You can withdraw it at any time, without affecting what was sent before.

• What we send: writing tips and occasional offers (about 2 emails a month; if you sign up through a free guide or the AI detector, a short series of 5 emails over the first 2 weeks comes first), and, if you joined the waitlist, a few updates about the Chrome extension and its launch.
• Legal basis: your consent. Boxes start unticked, and getting a free guide never requires subscribing. After you opt in on a public form, we ask you to confirm with a button on our site before we send any marketing email (double opt-in).
• How to stop: use the unsubscribe link in any email, the email preferences page linked from every email, or your dashboard settings. Unsubscribing takes effect immediately.
• What we keep: your consent records (Section 2) as proof of what you agreed to, and a suppression list so we never email you again after you unsubscribe, an email bounces, or you ask us to delete your data. The suppression list stores a hash of your address, not the address.

How we measure use of the site depends on where your device is, judged by its time zone, and on your choices:

• Everyone: Vercel Web Analytics and Speed Insights count page views and page speed without cookies. Vercel counts visitors with a hash of the request that it discards after 24 hours.
• Outside the EU, the EEA, the UK and Switzerland, unless your browser sends Global Privacy Control or you refuse on our Cookie Policy page: PostHog keeps a random visitor ID in your browser's storage and, once you sign in, links your usage events to your account ID (never your email or name), and Google Analytics sets its _ga cookies to count visits and traffic sources.
• In the EU, the EEA, the UK and Switzerland, or when your browser sends Global Privacy Control: no Google Analytics, and PostHog runs in cookieless mode: nothing is stored on your device, your browser's events aren't linked to your account, and PostHog's servers count visits with an ID made from your IP address and browser details plus a key that changes every day, so visits on different days aren't connected.
• If you refuse on our Cookie Policy page, wherever you are: neither Google Analytics nor PostHog reports anything from your browser.
• Events from our server, wherever you are: our server also tells PostHog about a few actions, such as a finished check or rewrite, a processed document, a new voice profile, a started checkout or a form you sent. These events can carry counts (such as words), your plan and how you arrived, never your text, email or name, and some carry your account ID or the internal ID of your record with us. Nothing is stored on your device for them.

We don't use analytics for advertising. The Cookie Policy lists what each tool stores and has the button to refuse.

We use the following services to operate HumanizeIt. They process data on our behalf, except Lemon Squeezy, which handles your purchases as merchant of record under its own privacy policy:

• Clerk — Authentication (stores your email and sign-in details). Privacy Policy
• Lemon Squeezy — Payment processing (stores billing information). Privacy Policy
• Neon — Database hosting (stores your account, documents, usage, email and consent records)
• Vercel — Application hosting (processes all web requests), plus Vercel Web Analytics and Speed Insights (aggregate, cookieless page and performance statistics)
• Anthropic — AI processing: the text you submit for a deep scan, a rewrite or a document, and the writing samples for a voice profile, are sent to the Claude API. Anthropic does not train on API data.
• Resend — Email delivery: receives your email address and the content of each email we send you, and reports whether it was delivered. Privacy Policy
• PostHog — Product analytics, hosted in the EU: pseudonymous usage events, linked to your account ID (never your email or name) once you sign in, or counted without storing anything on your device (Section 6)
• Google Analytics — Website analytics: pages visited, traffic sources and interactions such as scrolling and outbound clicks, plus, when you submit a form on our site, a hashed copy of the contact details you typed, such as your email address (Google's user-provided data collection). Only where Section 6 allows it, with Google signals and ad personalization turned off. How Google uses data from sites that use its services

HumanizeIt is run from Tunisia, and the services in Section 7 process data in the United States and the European Union. When personal data from the EU, the EEA, the UK or Switzerland goes to a country that hasn't been found to protect it adequately, it is covered by the EU-US Data Privacy Framework where the provider is certified under it, or otherwise by the European Commission's Standard Contractual Clauses (with the UK and Swiss versions where they apply) in the provider's data processing terms. Email support@humanizeit.app for a copy of the safeguards that apply.

• Account data and documents: kept while your account exists. You can delete any document from History at any time, and deleting your account deletes your documents. The Free plan's History shows your 5 most recent documents; older documents stay stored in your account until you delete them or your account.
• Backups: deleted data can remain in database backups for up to 90 days.
• Text sent to the free tools: not stored (Section 2).
• Lead and customer records: kept until you ask us to delete them.
• Consent records and the suppression list: kept after you unsubscribe or ask for deletion, because they prove your choice and stop us from emailing you again. The suppression list holds only a hash of your address.
• Email delivery records: kept in our database with a hashed address; Resend keeps its own delivery logs for a limited period.
• Analytics: PostHog keeps usage events for up to 7 years, the retention of our PostHog plan. Google Analytics keeps its user-level and event-level data for 2 months (its data-retention setting). Vercel Web Analytics keeps no visitor ID beyond 24 hours (Section 6).

If you are in the EU, EEA, UK or Tunisia, you have the right to:

• Access your personal data
• Request correction or deletion of your data
• Export your data (portability)
• Withdraw consent at any time, without affecting what was done before
• Object to processing, and complain to your data protection authority

To exercise these rights, contact us at support@humanizeit.app. When we delete your data, we keep only the hashed suppression entry so we never email you again.

We use session cookies (required for sign-in via Clerk), two first-party attribution cookies and, where Section 6 allows it, Google Analytics cookies. See our Cookie Policy for details and to refuse the ones that aren't required.

For privacy questions or requests: support@humanizeit.app, or by post to the address in Section 1.