What we do with your data
Last updated: 21 September 2026
This policy explains what personal data AI Cordon processes, on what basis, and what you can require of us. It follows the General Data Protection Regulation (EU) 2016/679.
The short version: we hold the data needed to run your account and bill it, and we keep security records so the service cannot be abused. The text you send to the detector is not stored and is never used to train models.
1. Who is responsible
The controller is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], registration number [REGISTRATION NUMBER AND REGISTER], VAT number [VAT NUMBER, OR STATE THAT THERE IS NONE].
For anything to do with your data, write to [PRIVACY EMAIL ADDRESS]. We have not appointed a Data Protection Officer; the Regulation does not require one for processing of this kind, and naming one we do not have would be worse than saying so.
2. What we collect
Account
Email address; a hash of your password, never the password itself; whether the address has been verified; your role in the dashboard; the dates of registration and last sign-in.
Security and abuse prevention
IP address, browser user-agent, declared language, and the times of your requests. These are what rate limiting and fraud detection are made of; without them an API key found in a public repository could be run to the account's limit before anyone noticed.
Consents
Whether and when you accepted the Terms and this policy, and which version; whether you opted in to product email. Your cookie answer is kept in your browser, not in our database — see section 5.
How you found us
Campaign parameters (utm_source, utm_medium, utm_campaign) and the referring page, read from the address you arrive on and recorded once, at signup.
Your organisation
For an address on a company domain we look that domain up in public sources and keep a short profile of the organisation — name, description, country, the technology it publishes. This describes a company rather than a person; where it does identify someone, it is processed on the basis set out in section 3.
Use and billing
How many requests you make and to which detector, your credit balance, and the movements on it. This is how a bill is produced and how you can check it.
What you submit for checking
Documents and prompts you send to the detector are processed in transit only: for as long as it takes to produce a verdict, and no longer. They are not written to our database, not retained after the response, and not used to train or improve any model. If what you send contains other people's personal data, you are the controller of it and remain responsible for having a basis to send it.
Anonymous signals about attacks
We keep derived, non-reversible records of detected injections — technique, language, structural features, hashes, aggregate counts. They cannot be turned back into your text and identify nobody, so they are not personal data. Our own library of examples is built from open, research and synthetic sources, not from customer traffic.
3. Why, and on what basis
| Purpose | Data | Legal basis (Art. 6) |
|---|---|---|
| Running your account and the API | Account, use, billing | Performance of the contract, 6(1)(b) |
| Service email — verification, password reset, notices | Email address | Performance of the contract, 6(1)(b) |
| Keeping the service from being abused | IP, user-agent, timestamps | Legitimate interests, 6(1)(f) — securing a paid API against fraud and overload |
| Understanding where signups come from | Campaign parameters, organisation profile | Legitimate interests, 6(1)(f) — knowing which channels work |
| Analytics cookies | See the Cookie Policy | Consent, 6(1)(a) — withdrawable at any time |
| Product email and news | Email address | Consent, 6(1)(a) — a separate box, never pre-ticked |
| Accounting and tax records | Billing | Legal obligation, 6(1)(c) |
Where we rely on legitimate interests you may object under Article 21, and we will stop unless we can show compelling grounds that override yours. We make no decisions about you by automated means that produce legal effects.
4. Who else sees it
We do not sell personal data. It reaches these processors, each under a contract that binds them to our instructions:
| Processor | What for | Where |
|---|---|---|
| [HOSTING PROVIDER] | Servers and database | European Economic Area |
| [EMAIL PROVIDER] | Delivery of service and product email | European Economic Area |
| Cloudflare | Content delivery and protection of the public site | Global edge network |
| Google (Analytics) | Audience measurement — only if you allow analytics cookies | United States |
Servers and the database are in the European Economic Area. The two exceptions are Cloudflare, which serves the public site from whichever edge location is nearest you, and Google Analytics, which runs only on your consent and can be withdrawn at any time; both providers rely on the EU–U.S. Data Privacy Framework and the Commission's standard contractual clauses. We also disclose data where a law obliges us to.
5. Cookies
Every cookie, what it does and how long it lasts is listed in the Cookie Policy, together with the control that changes your answer. Nothing but the strictly necessary is stored before you allow it.
6. How long we keep it
| Data | Kept |
|---|---|
| Account | While the account exists; up to 30 days after deletion, backups included |
| Record of consents | Account lifetime plus 3 years, to show what was agreed and when |
| Security records (IP, user-agent, timestamps) | 12 months |
| Campaign parameters, organisation profile | While the account exists |
| Use and billing | Account lifetime, then the retention the tax law requires |
| Text submitted for checking | Not stored at all |
| Analytics | As stated in the Cookie Policy |
7. Your rights
You may ask us to:
- tell you what we hold about you, and give you a copy (Art. 15);
- correct anything inaccurate (Art. 16);
- erase it (Art. 17), where we are not obliged to keep it;
- restrict what we do with it while a dispute is resolved (Art. 18);
- hand it to you or another provider in a machine-readable form (Art. 20);
- stop processing based on legitimate interests (Art. 21).
Consent can be withdrawn at any time, and withdrawing it is as easy as giving it — the cookie control sits in the footer of every page, and product email carries an unsubscribe link in every message. Withdrawal does not undo what was lawful beforehand.
Write to [PRIVACY EMAIL ADDRESS] and we will answer within one month. If we have not satisfied you, you may complain to the supervisory authority of [SUPERVISORY AUTHORITY COUNTRY], or to the authority where you live or work.
8. How it is protected
Traffic runs over TLS. Passwords are stored only as hashes. Access to production data is limited to the people who need it and is logged. Submitted text is never written down, which is the strongest protection available for it: there is nothing to leak.
9. Product email
Product and marketing email goes out only to people who ticked the separate box at signup. Unsubscribing takes one click and does not affect service messages — verification, password resets, billing and security notices — which are part of running your account.
10. Changes
A new version is published here with its date. If a change is material we tell account holders by email or in the dashboard before it takes effect.
11. Contact
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Data protection enquiries: [PRIVACY EMAIL ADDRESS].