Security, and who handles your data
Last updated: 1 October 2026
Who we are
Writ is run by Writ AI Limited, a company registered in England and Wales (number 17467334), registered office 128 City Road, London, EC1V 2NX. We are registered with the Information Commissioner’s Office as a data controller, reference ZC253257.
How we protect your work
- Every connection to Writ is encrypted, and stored data is encrypted by our host.
- The database itself decides who can read what: your drafts are readable by you, by the tutor assigned to you while they are assigned, and by staff who run the service, not by other students. For school accounts, your school’s UCAS lead can see your work, as the student privacy guide explains.
- Paid features are checked on our servers, not just in your browser, and payments go through Stripe, so card details never reach us.
- Every change to Writ runs through more than 2,000 automated tests first, including checks on who can read each table and on what the AI may return. We also review the whole system for security weaknesses, most recently in October 2026.
- We do not use advertising trackers or sell anybody’s data.
Every company that handles your data for us
Each processes data only to provide its service to us. Where one is outside the UK, transfers are covered by UK adequacy rules or the UK international data transfer agreement, as our privacy policy sets out.
| Company | What it does for us | What it handles |
|---|---|---|
| Supabase | Our database, sign-in, file storage and server functions. | Everything in your account, stored encrypted. |
| Lovable | Builds and hosts the website, and manages our Supabase backend. | What the website needs to serve your pages. |
| Anthropic | The AI behind the coach (Claude). | Your drafts and the profile details the coach needs. May not train on it. |
| Stripe | Takes payments for individual plans. | Your payment details. We never see your card number. |
| Resend | Delivers our emails. | Your email address and the email itself. |
| Sign-in, only if you choose “Continue with Google”; and the fonts our pages load. | Who you are, if you sign in with it; your IP address when a page loads its fonts. |
How long we keep it
Your account, drafts and coaching history stay while your account is open and are deleted when you close it or ask us to. Payment records are kept for six years, as UK tax law requires. The full table is in the privacy policy, section 6.
Your choices
Everything optional is off until you say yes: see your permissions. What the AI reads, and what it may not do, is on how our AI works.
Report a security problem
If you think you have found a weakness in Writ, email enquiries@writai.co.uk with “Security” in the subject. Please do not look at other people’s data to prove it. We will reply, fix what is real, and thank you for it.