Privacy Policy

1. Who we are and how to contact us

For individual accounts, Writ is the data controller for your personal data. For accounts provided through a Writ for Schools licence, your school is the controller and Writ acts as its processor (see section 4). Writ is operated by Writ AI Limited, registered in England and Wales under company number 17467334, registered office 128 City Road, London, EC1V 2NX. We are registered with the Information Commissioner's Office under reference ZC253257. Data protection contact: Rayan Raheel, Director. You can reach us about anything in this policy at enquiries@writai.co.uk.

2. What we collect

Account data (email, password hash); application profile data you provide (course shortlist, subjects, predicted grades, academic ledger, supercurricular records and any certificates you upload, and, only if you choose to record them, the decisions universities made on your applications); your drafts, coaching questions and answers, and reviewer feedback; product usage data (drafting activity events, coaching usage, and technical logs) used to operate and improve the service; and visit counts for every page of the site (the page, the website that sent you, device type and country, counted without cookies and without storing your IP address; see the Cookie Policy). We ask you not to include special-category data (for example about health, religion or ethnicity) in your statement; the service does not require it. There is one place where we do invite it, optionally and for a single stated purpose — see section 2b.

2b. The one question that may touch sensitive information

When we ask for your predicted grades, we also ask whether there is anything about them that the numbers do not show. It is optional, it defaults to “no, nothing”, and skipping it costs you nothing except what is described below.

We ask because UK universities run formal contextual admissions schemes — many will make a reduced offer, sometimes by two grades, to an applicant whose circumstances qualify. If we do not know, we cannot point you at a single one of them.

Some honest answers to this question are special-category data under UK GDPR — disrupted schooling because of illness, or being care-experienced, are the obvious examples. So it is treated differently from everything else on this page:

• Our legal basis is your explicit consent, and nothing else. Answering the question is the consent; leaving it as “no, nothing” is a complete answer.
• It is used to build your course shortlist and for nothing else. It is deliberately withheld from the AI that coaches your writing, and that is enforced by an automated check that fails our build if anyone wires it through. A writing coach that knows a student was ill steers them toward writing about being ill, and admissions tutors mark that down.
• It is not shown to a reviewer. A tutor’s view of your work is your drafts, your coaching rounds and your writing activity; this answer is not part of it. To be precise rather than reassuring: a tutor currently assigned to you has database access to your profile record, so this is a limit of what their view displays rather than a lock on the data. We are narrowing that access; until we have, we would rather say so than imply a guarantee we have not yet built.
• School accounts are the one exception, and you are told before you answer. If your account came from a school licence, your school’s head of UCAS can see this answer in the same student view that shows them your drafts — they are the staff member who handles contextual applications, and your school is the data controller for your account. The question says so on screen when it applies to you, because whether a teacher can read it is exactly the fact that decides whether somebody discloses.
• You can remove it at any time, on its own, without deleting anything else, from Settings → What you told us. It is erased rather than hidden.

It is never used for advertising, never used to train an AI model, never used to improve our coaching (even if you later share your statement with us), never shared with a university, and never a factor in what we charge you.

2a. If you send us a statement you already applied with

Separately from having an account, anyone can send us the personal statement they actually applied with, at /submit-statement. This is optional, it is not part of the service, and nothing about it is required to use Writ.

If you do, we collect: your name and email; the subject you applied for; your grades as you describe them; the universities and courses you applied to and what each of them decided; the text of your statement; and anything you choose to add. We record the exact wording of the consent you agreed to alongside your submission, so that a later change to that page can never alter what you actually agreed to.

Our legal basis is your consent, and consent alone. You can withdraw it at any time by replying to the email we send you or writing to us, without giving a reason, and we will delete the submission.

If you are under 18 we also require a parent or guardian to agree. We ask for their name and email, we record the separate wording they agreed to, and we email them a copy of it so they can object. Our database refuses to store a submission from someone under 18 that does not carry all of this. We do not ask for your date of birth: whether a parent must agree is a single yes or no, and a birthday would be more information about you for no additional purpose.

What we do with it. A person here reads it. We use it, in anonymised form, to improve the coaching we give other students. To do that we may ask our AI provider to study it and describe, in its own words, how it is built and what makes it work; that description is checked so it cannot repeat a run of your wording, and our AI provider does not train on anything we send it. It is never published, never shown to another student, and never used to write anybody else’s statement. If we decide a submission is worth keeping for that purpose, a member of staff moves it by hand into our teaching material under a label carrying the subject and year, never your name. The AI coach never reads submissions or teaching material while it is coaching anyone.

3. How we use it, and our legal bases

We use your data to provide the coaching service (your drafts and profile are processed by our AI provider to generate coaching output); to enable review by the tutor assigned to you or, for school accounts, your school's staff; to operate features you use (referrals, submissions); to keep the service secure; and to understand aggregate product usage. Legal bases under UK GDPR: performance of contract (to deliver the service you or your school signed up for), legitimate interests (service operation, security, and improvement, balanced against your rights), and consent where required. We do not sell personal data, and we do not use your statement for advertising.

Recommendations learn from what students did, never from one student. Which courses students shortlist, and the university decisions students choose to record, are counted together to improve the course suggestions shown to students after them. A course’s decisions are only counted once at least eight students with similar grades have recorded one, nobody is identified, and no student is ever shown a prediction of their chances. Legal basis: legitimate interests (improving the service).

No automated decisions about you. The coach’s questions, its reading of your draft and your course suggestions are suggestions for you to weigh. We make no decision with legal or similarly significant effects about you by automated means, and nothing Writ produces is sent to a university or to UCAS.

Emails about Writ are opt-in. We send you tips, news, offers or the results-day question only if you have said yes, on your dashboard or in Settings, and you can stop them there at any time. Emails about your account, payments, tutor feedback and your own deadlines are part of the service and arrive either way, as do important notices about your account: a change to our terms or this policy, a security or data incident that affects you, or the service not working as it should. Those never advertise anything. Every email with tips or news has an unsubscribe link that works without signing in, and your mail app's own unsubscribe button works too. If an email to you bounces or is reported as spam, our email provider tells us and we stop emailing that address. Every permission you can give us, and what each one means, is listed at writai.co.uk/permissions.

We never use your statement to train an AI model unless you have said yes to that, separately, and our AI provider is not permitted to train on it either way. We do not learn from the statement you write in Writ at all unless you say yes, as section 3a explains.

3a. Learning from your statement, only if you say yes

What we never do without your yes. Training an AI model means changing the AI itself so that it learns from your text. We do not do that with your statement unless you have said yes to the “Learning from your statement” permission below, and the AI provider that runs our coach does not train on what we send it, whatever you choose.

What we would do, only with your yes. A statement next to what each university decided is evidence of what admissions tutors reward. If you agree, a person here reads yours alongside your decisions and writes down general lessons: what kind of evidence carried weight, what fell flat. Our AI provider may help with that reading, in the same way as described in section 2a, never training on it. Those lessons are added to the written guidance our coach follows when it coaches other students. Your words are not. Your statement is stored under a label with your name taken off, and it is never published, never shown to another student, never given to a university, and never used to write anybody else’s statement.

How we ask. There are two ways to say yes, and both start unticked:

• The “Learning from your statement” permission, in Settings. It lets us use your statement, with your name and personal details removed, to improve the coaching we give future students, which may include training Writ’s own AI in future. You can withdraw it in Settings at any time: that stops any future use, though anything already learned from it stays.
• Sharing one statement at /share-statement. We offer it when your statement is finished (on your dashboard and under a whole-statement review that says it is ready, and once by email if you said yes to emails from us), and once more when a university has replied, and the results-day email offers it if you said yes to that. “No thanks” stops each of those asks. It shows you the exact statement you would be sharing and the decisions you got. That page’s yes covers the general lessons described above, not training.

A separate box asks whether we may email you after results day; that is only permission to ask, and nothing of yours is used because of it. If you are under 18, we will not use your statement under either yes until a parent or guardian has agreed as well (or you have turned 18), and on /share-statement we email them a copy of the wording they agreed to. We do not ask students whose account comes through a school licence; for those accounts the school decides how data is used.

Our legal basis is your consent. You can withdraw it at any time in Settings or by emailing enquiries@writai.co.uk, without giving a reason, and we delete any statement you shared with us. Deleting your Writ account deletes it too. General lessons already written from it stay in our guidance, because they contain none of your words and nothing that identifies you.

4. Who sees your data

Individual accounts: the tutor assigned to you can see your statement, coaching transcript, and academic profile — only while assigned to you. Our administrators can access data to operate and support the platform, under least-privilege controls.

One exception, in your favour: the optional grade-context answer in section 2b is not part of what a tutor sees. Their view of your work is your drafts, your coaching rounds and your writing activity: when you opened and saved each section, how much each save changed, and how long you took to start answering the coach’s questions. That helps them see where you were stuck. It is never used to grade or rank you.

School accounts (Writ for Schools): if your account is linked to a school licence, your school is the data controller and we act as its processor under the Writ for Schools Agreement & DPA. Within your school:

• Your school's head of UCAS can see your progress and your in-progress work — drafts and coaching conversation — to oversee and support your application. This is oversight by the staff member your school has made responsible for UCAS, and it applies while you draft, not only after you submit.
• A teacher assigned to you sees your progress, and sees your statement and coaching transcript only after you press "Send to my school".
• Staff at any other school can never see you.

Your school is responsible for the lawful basis for your use (including any parental consent required if you are under 18), for informing you and your parents or guardians about the service, and for handling data rights requests, which we support. We never use school students' data for marketing, and we email nobody about Writ unless they have said yes. On their instructions we email you the deadline your school or partner sets, and remind you before it, and we show you the name of the teacher or mentor they assign you, so you know who your statement goes to. You can stop sharing with them at any time in Settings. A plain-English version of who-sees-what is in our Student & parent privacy guide.

5. Processors and international transfers

We rely on a small number of processors, each of which processes data only to provide their service to us: Supabase (database, authentication, file storage and server functions), Lovable (builds and hosts the website and manages our Supabase backend), Anthropic (AI provider — processes drafts, profile context and answers to generate coaching output; our agreement does not permit training on this data), Stripe (payments — individual plans only; not used for school-licence students) and Resend (delivers our emails, so it handles your email address and the email’s contents). If you choose “Continue with Google”, Google confirms who you are under its own privacy policy, and our pages load their fonts from Google, which receives your IP address when they do. The full list, kept current, is at writai.co.uk/trust. Where a processor is located outside the UK, transfers rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum; we will provide details of the applicable safeguard on request.

6. How long we keep it

We keep your data while your account is active, and delete or anonymise it on the timescales below unless the law requires us to keep it longer.

You can delete your account and data at any time yourself, in Settings → Delete my account, or by emailing enquiries@writai.co.uk. Deletion removes your account, drafts, profile, uploads, coaching history, permissions and any statement you shared with us, subject to the payment records we must keep by law.

7. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. For a school account, your school (as controller) leads on these requests and we support it; for an individual account, contact us directly. To exercise any right, contact enquiries@writai.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we hope you will contact us first.

Withdrawing the one consent we rely on. Where processing rests on your consent you may withdraw it at any time, and for the grade-context answer described in section 2b you do not need to ask us: clear it yourself in Settings → What you told us and it is erased. Withdrawing consent does not affect anything done before you withdrew it, and it affects nothing else about your account.

8. Cookies and children

We use only strictly necessary storage to run the product — see our Cookie Policy. We design in line with the ICO Age Appropriate Design Code: data minimisation, no advertising trackers, every permission off until you say yes, and plain-language explanations of who can see what (see the Student & parent privacy guide).

Most of our users are 16 to 18. Where we rely on consent rather than contract, it depends on what the consent is for. You can say yes to emails and to the results-day question yourself (UK law lets anyone aged 13 or over agree to an online service). Anything that uses your statement, the submission in section 2a or the permissions in section 3a, needs a named parent or guardian as well if you are under 18: we record the wording they agreed to and email them a copy so they can object. For submitted statements, that is enforced by our database, not only by the form.

A parent or guardian can ask us to delete anything we hold about their child by writing to the address in section 1. We do not require a reason and we do not charge for it.

9. Changes

We may update this policy; material changes will be notified in the product or by email. This policy is governed by the laws of England and Wales.

5 October 2026 — what changed. Section 4 now spells out what “writing activity” means. Section 6 replaces “retained in a reduced form” with fixed periods: writing activity and error logs are deleted after 13 months, and records of AI requests go with your account. Nothing about what we collect or who sees it changed.

4 October 2026 — what changed. Sections 2a and 3a now say that our AI provider may help us study a statement you have chosen to share, under the same rules: your words are not kept or passed on, and it does not train on them. We added a line on automated decisions in section 3. Nothing about what we collect or who sees it changed.

17 September 2026 — what changed. We added section 3a. We had written that we never use your statement “to train AI models”, which is true, but it did not say that, with a separate yes after results day, we may learn general lessons from a statement. Section 3a now says exactly what that means, how we ask, and how to withdraw. Nothing is learned from any statement without that yes.

5 September 2026 — what changed. We added section 2b, covering the optional question about anything your predicted grades do not show. That question is new, some honest answers to it are special-category data, and it is the only thing on this site we process on the basis of your explicit consent. Nothing else about what we collect or who sees it changed.