1.What we collect
We handle four kinds of data.
- Account data: your email address, a name and an avatar if your sign in provides them, and the workspaces you belong to with your role in each.
- Workspace data: the brands, brand documents, briefs, keywords, content, versions, comments in your workspace; the runs and their traces; the members you invite; the destinations you connect and, encrypted, the credentials they need; the API keys you create, stored as a hash.
- Records of use: the usage ledger that meters credits, the audit log that records who did what in a workspace, invoices and subscription state from the payment processor, and the last time an API key was used.
- Technical data: the address a request comes from, its user agent, and the time, kept in server logs for security and for the per address rate limit.
2.Why we use it
We use data for these purposes and no others.
Legal bases where they apply Purpose Basis Running the service and billing Performance of the contract with you Security, abuse prevention, logs Our legitimate interest in keeping the service safe Transactional email Performance of the contract; you cannot opt out of sign in codes Support Performance of the contract, or your request - Running the service: generating and storing content, publishing it where you ask, showing the trace of each run, and sending transactional email such as sign in codes and invitations.
- Billing: metering credits, taking payment through the processor you choose, and keeping invoices.
- Security and abuse prevention: rate limits, the audit log of each workspace, and the logs that let us investigate a problem.
- Support: answering the email you send us, with the workspace data needed to answer it.
3.Model providers
To write, the pipeline sends the relevant parts of your workspace to a language model: the brief, the brand document, the research it gathered, the draft as it moves between stages. Today the provider is OpenAI, through its API. A deployment can also be configured to use Anthropic; where it is, the same applies.
We use the providers' API services under their business terms. Under those terms the providers do not use the data sent through the API to train their models and retain it for a limited time for abuse monitoring. We do not send your account data to a provider; only the content a run needs.
6.How long we keep it
Workspace data stays for as long as the workspace exists. Deleting a workspace, which its owner can do from Settings, removes its brands, its content with every version, its runs and traces, its integrations and their credentials, its members and its audit log, all at once through database cascades. Deleting content inside a workspace removes that content and its versions.
Invoices and subscription records stay for as long as tax and accounting law requires, which is up to ten years in some countries. Our hosting provider keeps server logs for a short period measured in days, and they are not tied to a workspace.
Your account itself stays until you ask us to delete it. Write to hello@writerdean.com from the account's address; we delete it within thirty days, along with any workspace only you belong to.
7.Your rights and choices
Owners and admins can export a whole workspace as JSON from Settings with every trace included, and can delete it there. For anything else, including the email on your account, access to the data we hold about you, correction, deletion, restriction, portability or an objection, write to hello@writerdean.com. We answer within thirty days.
If you live in the European Economic Area, the United Kingdom or another place with a data protection authority, you can also complain to that authority. We would rather hear from you first.
8.Security
The database enforces row level security, so every query runs as the signed in member and cannot see another workspace's rows. We encrypt credentials for connected services at rest with AES-256-GCM. We store API keys as a SHA-256 hash and show them once. We sign outbound webhooks so their receiver can verify them. Every connection to the service is over HTTPS.
No system is perfectly secure. If we learn of a breach that affects your data, we tell you without undue delay and say what happened and what to do.
9.Children
The service is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has created an account, write to us so we can remove it.
10.Changes to this notice
We may update this notice as the service changes. The date at the top says which version applies. For a change that affects what we collect or who handles it, we tell you by email or in the app before it takes effect.
11.Contact
WriterDean is the controller for the data described here. Write to hello@writerdean.com with any question about it.
This text took effect on Sep 25, 2026. Earlier versions are available on request from hello@writerdean.com.