Privacy Policy

Di person wey responsible under di General Data Protection Regulation na:

Certentis dey process di data wey e need for account, Humanizer, KI-Scanner, plagiarism check, history, credit and billing.

We no dey use customer texts to train our own or other people generative models. We dey process dem only to provide and secure di exact service wey you request, and show am for your personal history.

• Account data: email address, encrypted authentication information, display name, language settings and session data.
• Text tools: input text, generated text, detected language, word and character counts, protected text parts, check results and technical status data.
• Plagiarism check: content wey you upload or enter, file name, report status, places wey dem find am, sources and similarity values.
• Billing: credit, bookings, plan, Stripe-, Apple-App-Store and Google-Play transaction references, plus subscription status.
• Operation and security: IP address, time, resource wey you request, status code, browser information, Request-ID, and limited error and abuse signals.
• Anonymous free tests: random device ID for one necessary HttpOnly cookie, device and network pseudonyms wey na HMAC alone generate, tool type, quota status, and the result wey person request for short time.
• Optional mobile notifications: Expo-Push-Token, device platform, language setting, and cleaned-up delivery status.

• Contract performance and steps before contract (Art. 6 Abs. 1 Buchst. b DSGVO): registration, text processing, reports, history, credit, checkout and support. If you clearly start a text tool for inside di app, we go send di text wey you enter to di processors listed below only as much as e take to run di tool wey you request.
• Legal obligations (Art. 6 Abs. 1 Buchst. c DSGVO): especially records wey trade and tax laws require.
• Legitimate interests (Art. 6 Abs. 1 Buchst. f DSGVO): IT security, stopping abuse, service stability, error analysis and legal defence.
• Consent (Art. 6 Abs. 1 Buchst. a DSGVO): optional mobile result notifications, wey go remain switched off until you activate dem. Di same one dey happen for di support chat wey dey for di public pages: e no dey load until you click di chat button.

For registration, login, session management, account data and application database, Certentis dey use Supabase. E dey process especially email address, encrypted authentication information, session IDs and account data.

Supabase dey use cookies wey session wey you don log in need technically. If no be for these cookies, we no fit provide the protected account area.

Person wey receive am: Supabase, Inc. Dem dey process am based on data-processing agreement. If dem process data outside the European Economic Area, the transfer dey rely on the applicable safeguards under Chapter V DSGVO, especially adequacy decisions or EU Standard Contractual Clauses.

For the text revision wey you request, dem go transfer the input text server-side to Google Cloud Vertex AI. Before transfer, dem fit replace technically protected parts of the text with placeholders, then put dem back afterward.

Dem dey save input, result, word counts, language, scan values and technical run data for your personal history. By default, dem go automatically delete completed Humanizer runs after 30 days, unless dem need keep am to clarify errors, defend legal claims or meet legal obligations.

Abeg, no send another person business secrets or special categories of personal data wey no necessary. Na you dey responsible for the legality of the content wey you enter.

For AI scan, dem go transfer the text to one specialized external analysis service. Certentis dey process the document and sentence values from the service, and show probabilities for human, mixed and AI-style language patterns.

These values na statistical estimates; dem no be measurement of the percentage of text parts and dem no prove who author am. False-positive and false-negative results fit happen. No use scanner values as the only basis for academic, employment-law or other serious decisions.

Independent AI scan reports go remain saved for your account until you request their deletion or delete the account, unless legal obligations or legitimate needs to keep evidence stop am.

Checkout, payment processing, invoicing and subscription management for the website dey happen through Stripe. Purchases and subscriptions for the mobile app dey happen through the Apple App Store or Google Play. Each store dey process payment, contact, device and transaction data according to its privacy information.

Certentis no dey store complete card or account details. The things wey dem store na the store, product and transaction IDs, cryptographic hash of the purchase token, plan, payment status, credit entries and subscription lifecycle data. Dem only use the unchanged purchase token server-side to verify am with the relevant store, and dem no dey store am permanently.

When you move to Stripe, dem fit use technically necessary cookies and similar technologies there.

Certentis dey send necessary emails for account confirmation, sign-in, password reset, security and, where applicable, purchases and subscriptions. For this, dem dey process email address, message type and the account or contract data wey the specific message need.

Account-related authentication emails dey trigger through the sending function configured inside Supabase. Dem no go send promotional emails without the legal basis wey dem need for am.

If you clearly activate mobile result notifications, Certentis go send general success or error notice through Expo Push Service. The notification no go contain any text wey you enter, Scores, report titles or sources. Dem go delete the device token when you disable notifications, log out for the device or delete your account.

Certentis dey provide the website and server-side application functions through Vercel. Vercel dey run global infrastructure; because of this, connection and operation data fit dey processed for the United States and other countries. When you open the site, dem dey process technically necessary data like IP address, time, requested resource, status code and browser information.

Operation and security logs wey Certentis control normally no contain complete customer texts, and dem go delete them latest after 30 days. Vercel fit process its own technically necessary logs according to the contract, data protection and retention terms wey apply. If security incident happen or we need defend legal rights, dem fit secure the necessary logs until dem clarify the matter.

Certentis dey currently use only technically necessary session, language and security cookies for login, account protection and the functions wey you expressly request.

To protect registration and login from automated abuse, Certentis dey use Cloudflare Turnstile. The service dey process the connection, device and browser signals wey security checking need, especially IP address, browser and device information, timing details and the check result. Cloudflare no dey receive customer texts wey you enter for forms. Turnstile fit use technically necessary cookies or similar storage technologies.

For di support chat, Certentis dey use di service wey dem dey call Crisp. For di public pages, di chat no dey load together with di page: na only one button you go first see, and na when you click am di service go load and go fit put im own cookies and local storage entries. For di account area wey you don log in, di chat dey load one time, because di help wey dey there na part of di service wey di contract cover; dem go send di e-mail address and di display name so dat dem fit join your question to your account. Dem no dey send di text wey you type, di things wey dey inside your report, or your credit data.

We no build any personal analytics, advertising, or marketing cookies into the product. So, for now, no general consent banner dey show.

If we add technologies wey no dey necessary later, dem go block them until person give valid consent, and we go update this notice.

Na only after you give clear consent (Art. 6 Abs. 1 Buchst. a DSGVO) Certentis Google Analytics 4 dey measure how people use pages, scroll depth, sign-ins, purchases, subscription events, and conversion paths. Dem no go load di Google-Analytics tag before you give consent.

For dis process, dem fit handle pseudonymous client and session IDs, page path and page title, referring page without search parameters, browser and device information, rough location, language, scroll depth, interactions, plus events related to purchases and plans. No customer texts wey you enter, report content, complete URLs with search parameters, or complete payment details dey sent to Google Analytics.

Google signals and personalised advertising dey turned off. After you agree, Google Analytics and your browser fit use cookies or similar storage technologies. Google Ireland Limited na di recipient; if Google LLC or other bodies outside di European Economic Area process di data, dem go transfer am based on applicable safeguards, especially adequacy decisions or EU Standard Contractual Clauses.

Through di Cookie settings wey you fit reach anytime, you fit withdraw your consent for anything wey go happen from now on. Once you do am, di Analytics identifiers linked to Certentis and Analytics events wey never send go delete, and we go stop sending any more. Event data wey don already send dey follow di retention and deletion rules wey dem configure for Google Analytics; aggregated statistics wey no connect directly to your account fit remain for longer.

Na only after you clearly gree (Art. 6 Abs. 1 Buchst. a DSGVO) Certentis go use the Google-tag and Google Ads to check whether person wey visit page go register, use tool, reach checkout, or buy something. If you no gree, we no go send any Google-Ads conversions.

For this process, we fit handle pseudonymous ad and click IDs like gclid, gbraid, or wbraid, approved campaign parameters, client and session IDs, page path, conversion type, and for purchases, value, currency, and technical transaction ID. We no go send any customer text wey person enter, report content, complete payment details, or URL parameters wey nobody control to Google.

Certentis dey use Google Consent Mode v2, and by default e dey refuse analytics and ad storage. The Google-tag no go load until you gree. The ad_user_data and ad_personalization signals go remain refused; Certentis no go use personalised ads or Enhanced Conversions with email address or phone number through this.

You fit withdraw your consent anytime through Cookie Settings, and e go apply from that time go forward. After that, Certentis go remove the local campaign data and Analytics IDs wey dem link to you, and stop any further sending. Conversion data wey dem don already send go follow the retention and deletion rules wey dem configure for Google.

For di public pages, di support chat no dey load until you click di chat button; dat click na your consent (GDPR Art. 6 para. 1 lit. a). For di signed-in area e dey load one time, because support for dia na part of di service wey di contract say we must give (GDPR Art. 6 para. 1 lit. b). Di provider na Crisp IM SAS wey dey for France; dem dey run dia main infrastructure inside di European Union.

After e load, Crisp dey keep one identifier for your browser and dey tie your messages to am; from di signed-in area, your e-mail address and display name dey join. You fit pull back your consent any time, for wetin go happen from now: di button wey dey below dey end di chat session wey dey run, e dey clear di identifier wey dey save for dis browser, and di chat for public pages go only load again after anoda click. Messages wey you don send already dey remain for di support inbox, and dem go delete am if you ask for di address wey we mention on top.

• Supabase for authentication and database.
• Vercel for hosting, delivery and server-side application functions.
• Cloudflare, Inc. with the Turnstile service to protect registration and login from bots and automated abuse.
• Google Cloud Vertex AI for text rewriting.
• One specialised AI analysis service for classifying texts.
• PlagiarismSearch for creating plagiarism reports.
• Stripe for checkout, payment and subscription management.
• Apple App Store and Google Play for mobile purchases, subscriptions, refunds and checking Store transactions.
• Expo Push Service for optional general result notifications inside the mobile app.
• Crisp IM SAS wey dey for France, for di support chat. Di provider dey run im main infrastructure inside di European Union.
• Government agencies, courts or advisers, if the law require am or if e necessary to defend legal rights.

Certentis dey make service providers agree by contract say dem go protect personal data at least as well as this notice, and dem fit process am only for the service purpose wey we instruct. If any recipient dey process data outside the European Economic Area, we go transfer am only when legal requirements don complete, like an adequacy decision or EU Standard Contractual Clauses with extra protection measures.

We dey store account data until you delete the account. When you request deletion, the account dey locked immediately, and we normally complete am within five minutes through a secured background process; if external cleanup need another try, e fit take longer. As part of this, the Stripe customer object, including the payment methods and subscriptions linked to am, go delete; after that, we go remove the local account data in a way we fit trace. Deleting the Certentis account no cancel any App-Store or Google-Play subscription, and the subscription renewal status no go block the deletion. You need stop future renewals separately inside the right store. Store transaction records wey law or contract require fit remain with the store.

We dey keep completed Humanizer runs and the technical request data wey follow dem for 30 days by default. Standalone AI-scan and plagiarism reports dey remain until you or the account owner delete dem.

We dey keep billing and transaction data until the legal retention periods for commercial and tax matters don expire. We generally keep security and operations logs for 30 days; if any specific incident happen, we fit secure necessary evidence until we resolve am.

For anonymous free tests, na only for the processing wey person request we dey use the text wey e enter. For asynchronous plagiarism checks, dem go remove am spätestens when the check finish or error happen; dem go delete abandoned inputs and short-term replay results spätestens after 24 hours. Dem go delete the pseudonymised network signal after 30 days, and the device claim after 180 days.

As long as the law allow, you get the right to ask for access, correction, deletion, restriction of processing, data portability, and objection. You fit withdraw your consent anytime, and e go apply to things wey happen in future.

You fit also complain to a data protection supervisory authority. The authority for your usual place of residence, workplace, or where the suspected breach happen go usually be the right one.

For the account area, you fit request a machine-readable export of your account data and saved histories.

For that same place, you fit start account deletion immediately. Stripe subscriptions go end during the deletion process. The App-Store or Google-Play subscription dey managed by the store wey provide am, and account deletion no cancel am; you fit use the link inside the app to stop future renewals. If your account dey linked to Apple, deleting am go revoke the authorization for „Sign in with Apple“ from the iOS app. We go lock billing data wey law require us to keep until the right retention period don expire, and handle am separately from active product data.

Contact: info@certentis.com

Certentis no dey use only Humanizer-, AI-scanner, or plagiarism scores to make any automated decision wey get legal effect on you or seriously affect you in a similar way.

Certentis dey use technical and organisational measures wey match the risk. Dem include encrypted transfer, secrets protected on the server, row-based database access controls, payment webhooks wey signature don verify, limited request rates, and separate service accounts.

No system dey completely free from risk. Dem dey review and improve these measures based on the current technical standard and level of risk.

Dem go update this privacy statement whenever features, processing purposes, service providers, legal bases, or deletion periods change. Na the version published on this page at the time go apply.