Privacy Policy
Last updated: 20 August 2026
This policy explains what personal data Era Write collects, why we collect it, who we share it with, and what you can ask us to do with it. The data controller is Era Write. If you have a question about anything here, email support@erawrite.com.
1.The short version
- We collect the account details you give us, the work you do in the app, and technical details about the device and network you sign in from.
- The technical details exist mainly to stop fraud, duplicate free accounts and stolen-card abuse.
- We never see or store your card number — payments are handled by Stripe, PayPal or Lemon Squeezy.
- We do not sell your personal data, and we do not run advertising trackers on this site.
- You can ask us for a copy of your data, or to delete it, at support@erawrite.com.
2.What we collect
2.1 Account data
- Your name and email address.
- Your phone number, if you choose to add one — it is optional.
- Your password, stored only as a one-way hash. We cannot read it.
- Your account status, role and credit balance.
2.2 Usage and content data
- The campaigns you create, the keywords you enter and the campaign settings you choose (tone, length, language, publishing options and so on).
- The articles generated for you, including titles, body content, images, citations and quality scores.
- Campaign and publishing logs — a record of each generation run, its outcome, error messages, and the credits deducted.
- Details of the WordPress sites you connect: the site URL, the username, and an application password, which is stored encrypted and used only to publish on your instruction.
- Billing records: orders, the pack purchased, amount, currency, payment method, payment status and the provider's transaction reference.
2.3 Technical and security data
To keep the service secure and to detect duplicate or fraudulent sign-ups, we record the following. This is an exact list of what the application stores — nothing more.
| At sign-up | IP address, approximate country, region and city derived from that address, the internet service provider or network operator, a flag for whether the address looks like a VPN, proxy or Tor exit, a flag for whether it belongs to a hosting or datacentre network, plus the device type, browser, and operating system, and the raw browser user-agent string. |
|---|---|
| At each login | A login history entry containing the date and time, IP address, approximate country and city, the internet service provider, the VPN/proxy and hosting/datacentre flags, and the browser user-agent string. |
| While you are signed in | A "last seen" timestamp and your most recent IP address, along with the approximate country, region and city, the internet service provider, and the VPN/proxy and hosting/datacentre flags for that address. This is refreshed at most once a minute, and the location lookup only reruns when your address changes or the stored result is more than a week old. |
Location here means approximate city-level location derived from your IP address. We do not use GPS, we do not ask for device location permission, and we do not track you across other websites.
2.4 Payment data
We never receive or store your card number, CVC or bank credentials. When you pay, you enter those details directly with Stripe, PayPal or Lemon Squeezy, who process them under their own privacy policies. We receive back only what we need to activate your order — a transaction reference, the amount, the status, and sometimes a card brand and last four digits or a billing country. If you pay by offline bank transfer, we see the payment reference and whatever your bank includes on the transfer.
2.5 Support data
If you email us, we keep the message and our reply so we can follow up and keep a record of what was agreed.
3.Why we use it
- Running the service — creating your account, generating and storing your articles, publishing to your WordPress sites, tracking your credit balance and its expiry.
- Fraud and abuse prevention — the technical data in section 2.3 lets us spot duplicate accounts created to farm promotional credits, sign-ups from VPNs and datacentre networks used to hide identity, and account takeovers where a login suddenly arrives from an unexpected country.
- Support — answering your questions, investigating a failed generation, and restoring credits where something went wrong on our side.
- Billing — taking payment, issuing receipts, handling refunds and disputes, and keeping the accounting records the law requires.
- Improving the product — looking at aggregated usage and failure patterns to find bugs and make generation more reliable.
- Service messages — telling you about expiring credits, failed jobs, security events, or changes to these policies.
We do not sell your personal data, and we do not share it with advertisers or data brokers.
4.Our legal bases
If you are in the UK, EU or another region with similar law, these are the grounds we rely on:
| What for | Basis | In plain English |
|---|---|---|
| Account, generation, publishing, billing | Contract | We cannot deliver what you paid for without processing this data. |
| Fraud checks, security logging, login history | Legitimate interest | We have a genuine need to protect the service, our customers and ourselves from abuse, and the data used is limited to that purpose. |
| Accounting and tax records | Legal obligation | We are required to keep financial records for a set period. |
| Optional marketing email, if we ever send it | Consent | Only if you opt in, and you can withdraw at any time. |
You can object to processing based on legitimate interest — see section 8. Note that we may not be able to keep an account open if we cannot run basic fraud checks on it.
6.Your content and generation processing
To generate an article we send your keyword, brief and campaign settings to generation infrastructure providers, and receive the generated text and images back. We select providers with the intention that content sent through the service is not used to train their models. Their handling of that data is governed by our agreements with them and by their own terms, which can change; we will update this policy if the position changes materially.
Please do not paste confidential information, personal data about other people, health data, or payment details into keywords, briefs or campaign settings. Those fields are meant for publishing topics, not sensitive records.
7.How long we keep it
| Data | Kept for |
|---|---|
| Account data (name, email, phone) | For as long as your account is open, then deleted or anonymised within [RETENTION PERIOD — to be confirmed] of closure. |
| Generated articles and campaigns | Until you delete them, or until your account is closed. Please export anything you want to keep before closing your account. |
| Campaign and publishing logs | [RETENTION PERIOD — to be confirmed] — currently kept alongside the campaign they belong to and removed with it. |
| Login history (IP, location, user agent) | [RETENTION PERIOD — to be confirmed]. The application does not currently prune this table automatically, so entries persist for the life of the account unless we remove them on request. We intend to set a fixed window (12 months is typical for security logs). |
| Sign-up security fingerprint and last-seen data | Held on the account record for as long as the account exists, and deleted with it. |
| Billing and order records | Kept for the period required by tax and accounting law in England and Wales, typically 6–7 years, even after an account is closed. |
| Support email | [RETENTION PERIOD — to be confirmed]. |
8.Your rights
Wherever you live, we will honour the following requests:
- Access — get a copy of the personal data we hold about you.
- Correction — fix anything inaccurate. Your name and email address can also be edited directly in your profile page; email us for anything else.
- Deletion — have your account and data erased, subject to records we must keep for tax and fraud-prevention reasons.
- Export (portability) — receive your account data and your articles in a machine-readable format.
- Objection and restriction — object to processing we base on legitimate interest, or ask us to pause processing while a dispute is resolved.
- Withdraw consent — at any time, where we relied on consent.
- No sale, no sharing for cross-context advertising — we do not sell or share personal information as those terms are used in California law, so there is nothing to opt out of. We will not discriminate against you for exercising any right.
To exercise any of these, email support@erawrite.com from the address on your account. We will confirm your identity and respond within 30 days. There is no charge unless a request is clearly excessive or repetitive.
10.Children's data
Era Write is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, email support@erawrite.com and we will delete it.
11.International transfers
Era Write is operated from England and Wales and our providers — payment processors, hosting, generation infrastructure and IP intelligence — operate in several countries, including the United States. That means your data may be transferred outside your own country.
Where data leaves the UK or the European Economic Area, we rely on an adequacy decision where one exists, or on the Standard Contractual Clauses (and the UK Addendum) with appropriate safeguards. You can ask us for details of the safeguards used for a particular provider.
12.How we protect your data
- All traffic to the application is served over HTTPS.
- Passwords are stored as one-way hashes, never as readable text.
- Secrets are encrypted at rest — including WordPress application passwords and the API keys stored in the admin settings.
- Access to production data is limited to staff who need it to run and support the service.
- Login history and network-level fraud signals let us spot unusual access to an account.
No system is perfectly secure. If a breach affects your personal data and creates a real risk to you, we will tell you and the relevant regulator as required by law.
13.Changes to this policy
We will update this page when our data practices change, and revise the "last updated" date at the top. For material changes we will also notify you by email or in the app before they take effect.
14.Contact and complaints
Era Write
Privacy contact: support@erawrite.com
Data protection officer / representative: [DPO CONTACT — to be confirmed, if required]
If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to your local data protection authority — for UK residents that is the Information Commissioner's Office, and in the EU it is the supervisory authority in your country. Our lead supervisory authority, if one applies, is the Information Commissioner’s Office (ICO), ico.org.uk.