Updated on 13 October 2026.
Our privacy policy
Learn which data we collect, what we use it for, when we delete it and how you can have it removed.
Every tool run on the website is saved in your history while you are signed in, whether your account is free or paid. Each entry includes the tool, date, language, submitted text, output, any title you add and the word count. Outputs include rewrites and summaries, detector figures, ranges, confidence ratings and headlines, and grammar issues. Entries are deleted after one year. You can remove individual entries or clear your history at any time on the history page. We do not save API runs or runs made without signing in.
About us
We are a software company based in the United Arab Emirates and run Textlume under the laws of the UAE. We determine how the data covered by this policy is used. For questions about this policy, contact support@textlume.com.
Text submitted to tools
We process text you paste into a tool to produce your result. We retain it only in signed-in account history, as explained below. We neither sell your text nor use it to train models.
Our server extracts plain text from uploaded files in memory. The file is discarded when the request ends and is not saved.
- AI detector: our detector processes your text with our AI service provider only while handling the request.
- Humanizer and paraphraser: an AI service provider sends your text to language models whose providers do not retain it or use it for training. Our detector also receives the text to assess the result. For paid plans, the humanizer may instead use our AI service provider's humanizer or our own rewriting model hosted by our AI service provider, when those options are enabled.
- Summarizer: an AI service provider passes your text to a language model whose provider does not retain it or use it for training.
- Grammar checker: your text is checked by our own grammar service, which runs with our AI service provider. On a paid plan, a language model reached through an AI service provider also reads it to suggest style changes.
- Word counter and character counter: text you type or paste remains within your browser.
- File uploads in any tool: your file is transferred to our server once to extract its text, then discarded.
Account information
Your account records include your email address, plan, invoices, monthly usage totals and any remaining top-up balance.
If you save a writing sample in the Custom tab on Pro, it stays in your account until you remove it.
We retain a salted hash of each API key, not a readable copy of the key.
Your browser stores detector reports locally. We do not store them on our servers. Reports more than 24 hours old are hidden and removed when you next visit any page on the site.
Website tool runs, including submitted text and results, remain in history for one year for all signed-in users, on free and paid accounts. The history page lets you remove individual entries or clear them all. If you request account deletion, your history is removed too. API runs and runs by visitors who are not signed in are not saved.
Free-use limits and misuse
Free use has a daily ceiling. To count it, we store a keyed hash made from your address together with the cookie id of your browser, one entry per tool and UTC day. Only today and yesterday are kept, and the next count clears anything older. Because the hash can be linked back with the key, this data counts as pseudonymised, not anonymous.
Minute-based limits use the same method. Entries remain for the current minute and the previous minute, with older entries removed on the next request.
Automatically collected data
Requests you make on Textlume, together with your IP address, pass through our hosting provider.
The counters behind the free limits store a keyed hash built from your IP address and the cookie id of your browser. Each tool gets its own count per UTC day, and only today and yesterday stay on record. The limits per minute are counted the same way. None of this feeds analytics. It exists only to keep the free limits fair.
Analytics runs only when enabled. Its provider receives the page address, browser and device information, and a rough location calculated from your IP address. We use these measurements to count visits and improve the website, not to advertise.
When analytics is enabled, every visitor receives the _ga and _ga_<ID> cookies without a consent step. When it is disabled, only cookies required to operate the site are set, and no consent banner appears.
Card payments
Our payment processor handles card payments and receives your card information directly. That information does not pass through our servers. Our records include each invoice's date and amount.
During card checkout, we pass the country identified by our host from your IP address to the payment processor. This country may also be recorded with your plan.
Email messages
Account and plan emails include a welcome after registration, a receipt when a plan begins or a payment is made, a failed card payment notice and a cancellation confirmation. Registration also triggers a confirmation link, and password reset requests trigger a reset link. We do not send newsletters or marketing emails.
Our email delivery provider handles all outgoing emails, including those for accounts and passwords.
Reasons for using data
Your text and account information let us deliver the tools and plan you request. Hashed usage counters help keep free tools available to everyone. We retain invoices to meet legal recordkeeping duties.
Retention periods
- Checked or rewritten text: discarded when the request ends, except for copies saved in history.
- Rewrites using “Take more time”: the result remains available until your page retrieves it, with a maximum of 15 minutes from the start. The submitted text is not saved.
- Signed-in account history: each run is removed after one year, unless you delete it or your account earlier.
- Daily usage counters: only today and yesterday remain, with older records removed on the next count.
- Minute-based limit records: only this minute and the previous minute remain, with older records removed on the next request.
- Detector reports: stored locally in your browser and removed at 24 hours old.
- Account information: retained while your account exists.
- Invoices: after account deletion, retained for the legally required bookkeeping period with the link to you removed.
Protecting data
Connections use TLS encryption. The website is available only through HTTPS, and HSTS instructs browsers to connect over HTTPS. Our hosting and database providers use AES-256 to encrypt data in storage. The database provider's sign-in service manages passwords and retains them as hashes only.
API keys are retained as salted hashes, never as the original keys. Stripe receives your card information directly, without it passing through our servers.
Uploaded files are converted to plain text in memory and discarded when the request ends. Detector reports stay only in your browser. Once a report reaches 24 hours old, it is hidden and then removed when you next visit any site page.
Rights over your data
To request a data copy, correct information or delete your account and its data, email support@textlume.com using your account's email address. A person on our support team replies within 24 hours. We carry out the request within the legal deadline.
Account deletion first ends any active plan, then removes your information and signs you out of all sessions.
People in the European Union or the United Kingdom may also lodge a complaint with their data protection authority.
Age requirements
The service is available from age 13. If you have not reached the age of majority where you live, a parent or guardian must agree to your use.
Please contact support@textlume.com if you think an account belongs to a child younger than 13.
Automated text assessments
Our detector automatically assesses text. It does not make decisions about people, and its assessment must not be used alone to make such a decision.
The result estimates how our model interprets the text and includes a range and confidence rating. You can find measured error rates on our accuracy page.
An assessment cannot establish how text was produced. Never rely on it alone when deciding something about a person. We do not promise that another detector or an institution will reach the same assessment.
Our data processors
The providers below use data solely to perform their role in delivering the service.
| Processor | Role | Data received |
|---|---|---|
| Website hosting | Runs the website on United States servers. | All requests, your IP address and content submitted to tools. |
| Database service | Manages account access, accounts and database storage. | Email address, hashed password, plan, usage, invoices, saved writing sample and signed-in tool history, including submitted text and results. |
| Email delivery service | Delivers account confirmations, sign-in links, password reset links, receipts, plan updates and contact form messages. | Email address, any name you supply and message content. |
| Stripe | Processes card charges, issues receipts and provides card update pages. | Card information and billing email entered at Stripe, billing country and plan. Our direct contribution is limited to your account number and plan. |
| AI hosting (our models) | Operates our detector, grammar service and our rewriting model when enabled. | Submitted text for checking or rewriting, plus its language, only while processing the request. |
| AI service (external models) | Provides humanizing, paraphrasing, summaries, rewrite quality checks and paid-plan grammar style advice. | Submitted text, sent exclusively to providers that do not retain it or use it for training. |
| Support email hosting | Hosts the mailbox used by support. | Messages emailed to our support team. |
| Internal operations system | Maintains account billing and usage records for administration and support. | Email address, order and plan identifiers, amounts, country and usage totals. No text submitted for checking or rewriting. |
| External sign-in provider | Lets you sign in using another account if you choose. | Email address, name and profile image associated with that account. |
| Site analytics | Measures visits and site activity across all pages. | Page address, browser and device information, and rough location derived from your IP address. |
Processing locations
Processing by our providers takes place in the United States and other countries, subject to their data processing terms with us.
Policy updates
We update the date at the top whenever we revise this policy.