Privacy Policy
Last updated
At OriginalityScan we believe academic integrity tools should respect the privacy of the people who use them. This Privacy Policy explains what information we collect, how we handle it, and the controls you have. It applies to originalityscan.com, our API, and any related services we operate (collectively, the "Service").
1. Information we collect
1.1 Account information
When you create an account we collect your name, email address, and password. Your password is stored using strong symmetric encryption with a key managed in a secrets manager separate from our database.
1.2 Billing information
When you purchase a credit pack, our payment processor collects card details and tokenizes them. We never see or store full card numbers. We retain a transaction reference, the amount, and the pack purchased for accounting and tax purposes.
1.3 Documents you submit for scanning
Documents are uploaded over TLS to our temporary processing environment. They live only as long as needed to:
- Extract text content from the file
- Run plagiarism cross-referencing
- Run AI-content classification
- Generate the similarity and AI reports
Once the report is generated and made available to you, the original document and all extracted text are deleted from our systems. Generated reports remain accessible to your account for 30 days unless you delete them manually first; after 30 days, reports are also deleted automatically.
1.4 Usage information
We log basic technical information — IP address, browser, timestamps, URLs visited within the Service — to operate the platform, prevent abuse, and debug errors. These logs are retained for up to 90 days and never cross-referenced with document content.
2. How we use your information
- To provide and operate the Service
- To process your credit purchases and prevent fraud
- To send service-critical communications (receipts, security alerts)
- To respond to support requests you initiate
- To comply with applicable law
We do not use your documents, scans, or report content for marketing, analytics, profiling, or model training of any kind.
3. Sharing
We do not sell or rent your personal information. We share information only with:
- Sub-processors who help us operate the Service (payment processor, cloud storage, email delivery). These providers operate under written data-processing agreements.
- Authorities, when compelled by valid legal process. We push back on overbroad requests and notify you unless legally prohibited.
4. International transfers
Our infrastructure is hosted on Supabase. For individual accounts, documents are processed only as needed to generate your report and then deleted.
5. Your rights
You can access, update, export, or delete your account information at any time from your account settings. You may also request:
- A copy of all personal data we hold about you
- Correction of inaccurate information
- Erasure of your account and associated data
- Restriction or objection to certain processing
To exercise these rights email [email protected]. We respond within 30 days.
6. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.
7. Cookies & sessions
We use a single session cookie to keep you signed in, and minimal functional cookies for theme preference and CSRF protection. We do not use third-party advertising or cross-site tracking cookies.
8. Security
See our Security page for technical details. In summary: documents transit over TLS 1.3, are processed in isolated environments, and are deleted after report generation.
9. Changes to this Policy
We may update this Policy from time to time. Material changes will be announced via email and on the Service at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
10. Contact
Email [email protected] for any privacy-related question or request.