Privacy notice
Signed-in scans keep a record with the document’s fingerprint and results; its text is kept in the record only if you choose. Batch and source checks temporarily store their input while queued or running. Authentication, optional analytics and referral cookies are described below.
1. Who is responsible
KNOW NOTA Inc., a Delaware corporation (registered agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA), is the controller for personal data described here. Contact: hello@knownota.com.
2. The text you submit is discarded by default
Individual text scans are processed in memory and are not saved as document text unless you choose to keep that text in your record. Uploaded files are parsed in memory to extract their text and are not saved as files. Text is sent server-to-server to the configured detector and, for evidence or watermark checks, to the AI Text Mark service. Our application does not use submitted text to train models.
Batch scans and source checks store the submitted text in our database job queue while waiting or running. The worker clears the input when it records a completed or failed job. An interrupted or stalled job can retain its input until the job is resolved; this is not a zero-retention workflow. If you run a source check, short passages of about ten words are sent to search.sh and OpenAlex to find candidate sources; text fingerprints are also sent to the search index. Our source-check logs record status and counts, not those passages. The stored source result contains URLs, titles, counts and offsets. Results can be reused for 30 days before a fresh search is requested; this freshness window is not an automatic deletion schedule.
If you are signed in, each scan keeps its Nota Record: model version, word count, result, measured false-positive rate when available, character-check counts, source-check results when run, and a SHA-256 fingerprint of the exact submitted text. Optional writing history and declarations are stored as browser-submitted information whose origin is not independently verified. By default, the complete text-bearing record exists only in the file you download at scan time. If you switch on “keep the document in my record”, that scan’s stored record includes the text. Batch jobs keep result numbers and the file names you supplied after their input is cleared.
3. What we do store
| Data | Why | Kept |
|---|---|---|
| Email address, and display name if given | To create and authenticate your account | Until you delete the account |
| Plan, subscription status, and a Stripe customer reference | To run the plan you bought | While you have an account; Stripe keeps its own billing records |
| Words used per day, and scan metadata | To meter your quota and show you your usage | Rolled up daily; deleted with the account |
| API key name, prefix, and a SHA-256 hash of the key | To authenticate API calls; the key itself is shown once and never stored | Until you revoke it or delete the account |
| Usage counts per endpoint per day, with timing | To keep the service running and show your usage | Rolled up daily; deleted with the account |
Usage counters record nothing about the content of requests. Anonymous use is rate-limited per address: a counter keyed by the address is kept for the length of the rate window (one minute) and then overwritten; it is tied to no account and no content, and is not used for anything else.
4. Cookies and browser storage
Signing in sets the authentication cookies of our identity provider (Supabase) so that your session survives a page load. They are strictly necessary and are removed when you sign out. Detect keeps the text you were about to check in your browser’s session storage only long enough to move from the home page to the detect page. No advertising or cross-site cookies are set.
5. Analytics
Two tools count how the site is used. Vercel Analytics is cookieless and aggregate — page views and web-vitals, no profile. The AI CMO, a marketing-analytics product built by KNOW NOTA Inc., records page views and clicks and may set a first-party cookie so that repeat visits are counted as one visitor; it is used to understand which pages and campaigns bring people here. Neither tool ever receives the text you verify — that goes only to the checks described above — and neither sells or shares data with advertisers.
6. Who else processes data
- Supabase — authentication and database hosting, for accounts, plans, quotas, API keys, scan history and usage counters.
- Vercel — hosting and delivery of the site. Vercel processes request metadata, including IP addresses, as part of serving and protecting the site.
- The AI CMO (theaicmo.com, a KNOW NOTA Inc. product) — site analytics as described in section 5; it may use PostHog (EU region) as its own event store.
- Railway and our inference provider — run batch jobs and the Nota model. They receive the text of a scan in memory and nothing about who you are beyond an opaque job identifier.
- AI Text Mark — processes interim detector, optional writing-statistic and watermark checks.
- search.sh and OpenAlex — receive selected passages for source searches; search.sh also receives text fingerprints for index lookup.
- Stripe — payment processing for paid plans. We never see your card details.
- AffiliateBase (affiliatebase.io) — our referral programme. If you arrive through a partner’s link (
?via=…), a cookie namedab_referralholds a referral token for that partner so they are credited if you later buy a plan. It identifies the partner, not you, and carries no name or email; when you pay, the token goes to Stripe with the order so the partner can be paid.
Typefaces are served through the site build rather than a third-party font host. We do not sell personal data, and we do not share it for advertising.
7. Legal basis and international transfers
Where the UK GDPR or EU GDPR applies, we rely on contract, for running an account or plan you asked for; legitimate interests, for keeping the service secure and for aggregate usage counts; and consent, for optional analytics, which you may withdraw at any time. Our processors may store or process data outside Delaware, including in the EU, the UK and the United States, under the transfer safeguards those providers offer.
8. Your rights
Subject to applicable law, you may request access to your personal data, correction, deletion, a portable copy, or restriction of processing, and you may object to processing based on legitimate interests. Deleting your account removes your profile, plan record, API keys, scan history and usage counters. Write to hello@knownota.com. You also have the right to complain to your local data protection authority.
9. Security, children, and changes
API keys are stored only as SHA-256 hashes, passwords are handled by our authentication provider and never seen by us, and database access is restricted per user by row-level security. No system is perfectly secure, and we do not claim otherwise. The service is not intended for children under 16. We may update this notice; the effective date above will change, and material changes will be signalled in the interface.