Privacy Policy

1. Who we are and how to contact us

For individual accounts, Writ is the data controller for your personal data. For accounts provided through a Writ for Schools licence, your school is the controller and Writ acts as its processor (see section 4). [Operator details: Writ is operated by [legal entity name], registered in England and Wales under number [company number], registered office [address]; ICO registration reference [number]. Data protection contact: [name / role]. To be inserted before commercial launch.] You can reach us about anything in this policy at enquiries@writai.co.uk.

2. What we collect

Account data (email, password hash); application profile data you provide (course shortlist, subjects, predicted grades, academic ledger, supercurricular records and any certificates you upload); your drafts, coaching questions and answers, and reviewer feedback; and product usage data (drafting activity events, coaching usage, and technical logs) used to operate and improve the service. We ask you not to include special-category data (for example about health, religion or ethnicity) in your statement; the service does not require it.

2a. If you send us a statement you already applied with

Separately from having an account, anyone can send us the personal statement they actually applied with, at /submit-statement. This is optional, it is not part of the service, and nothing about it is required to use Writ.

If you do, we collect: your name and email; the subject you applied for; your grades as you describe them; the universities and courses you applied to and what each of them decided; the text of your statement; and anything you choose to add. We record the exact wording of the consent you agreed to alongside your submission, so that a later change to that page can never alter what you actually agreed to.

Our legal basis is your consent, and consent alone. You can withdraw it at any time by replying to the email we send you or writing to us, without giving a reason, and we will delete the submission.

If you are under 18 we also require a parent or guardian to agree. We ask for their name and email, we record the separate wording they agreed to, and we email them a copy of it so they can object. Our database refuses to store a submission from someone under 18 that does not carry all of this. We do not ask for your date of birth: whether a parent must agree is a single yes or no, and a birthday would be more information about you for no additional purpose.

What we do with it. A person here reads it. We use it, in anonymised form, to improve the coaching we give other students. It is never published, never shown to another student, and never used to write anybody else’s statement. If we decide a submission is worth keeping for that purpose, a member of staff moves it by hand into our teaching material under a label carrying the subject and year, never your name. The AI coach never reads submissions or teaching material while it is coaching anyone.

3. How we use it, and our legal bases

We use your data to provide the coaching service (your drafts and profile are processed by our AI provider to generate coaching output); to enable review by the tutor assigned to you or, for school accounts, your school's staff; to operate features you use (referrals, submissions); to keep the service secure; and to understand aggregate product usage. Legal bases under UK GDPR: performance of contract (to deliver the service you or your school signed up for), legitimate interests (service operation, security, and improvement, balanced against your rights), and consent where required. We do not sell personal data, and we do not use your statement for advertising or to train AI models.

4. Who sees your data

Individual accounts: the tutor assigned to you can see your statement, coaching transcript, and academic profile — only while assigned to you. Our administrators can access data to operate and support the platform, under least-privilege controls.

School accounts (Writ for Schools): if your account is linked to a school licence, your school is the data controller and we act as its processor under the Writ for Schools Agreement & DPA. Within your school:

• Your school's head of UCAS can see your progress and your in-progress work — drafts and coaching conversation — to oversee and support your application. This is oversight by the staff member your school has made responsible for UCAS, and it applies while you draft, not only after you submit.
• A teacher assigned to you sees your progress, and sees your statement and coaching transcript only after you press "Send to my school".
• Staff at any other school can never see you.

Your school is responsible for the lawful basis for your use (including any parental consent required if you are under 18), for informing you and your parents or guardians about the service, and for handling data rights requests, which we support. We never use school students' data for marketing, and we do not market to under-18s. A plain-English version of who-sees-what is in our Student & parent privacy guide.

5. Processors and international transfers

We rely on a small number of processors, each of which processes data only to provide their service to us: Supabase (hosting, database, authentication and storage), Anthropic (AI provider — processes drafts, profile context and answers to generate coaching output; our agreement does not permit training on this data), and Stripe (payments — individual plans only; not used for school-licence students). Where a processor is located outside the UK, transfers rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum; we will provide details of the applicable safeguard on request.

6. How long we keep it

We keep your data while your account is active, and delete or anonymise it on the timescales below unless the law requires us to keep it longer.

You may request deletion of your account and data at any time via enquiries@writai.co.uk; deletion removes your account, drafts, profile, uploads and coaching history, subject to any records we must keep by law.

7. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. For a school account, your school (as controller) leads on these requests and we support it; for an individual account, contact us directly. To exercise any right, contact enquiries@writai.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we hope you will contact us first.

8. Cookies and children

We use only strictly necessary storage to run the product — see our Cookie Policy. We design in line with the ICO Age Appropriate Design Code: data minimisation, no advertising trackers, no marketing to under-18s, and plain-language explanations of who can see what (see the Student & parent privacy guide).

Most of our users are 16 to 18. Where we rely on consent rather than contract — which today means only the optional statement submission described in section 2a — a user under 18 cannot give it alone: we require a named parent or guardian, record the wording they agreed to, and email them a copy so they can object. That requirement is enforced by our database, not only by the form.

A parent or guardian can ask us to delete anything we hold about their child by writing to the address in section 1. We do not require a reason and we do not charge for it.

9. Changes

We may update this policy; material changes will be notified in the product or by email. This policy is governed by the laws of England and Wales.