Privacy Policy

Your documents

We treat your paper as private. Uploaded files are automatically deleted within 24 hours of processing. Generated reports are retained for 30 days so you can re-download them, then permanently removed.

We strip identifying metadata (author, title, organization) from your file before it is processed. Your submission is never added to any Turnitin repository or database.

Third-party processing

To generate reports, your document is processed through third-party detection services. These providers process the content solely to return a report and do not retain it for training.

For the free AI-writing detector (the instant estimate at /free-turnitin-ai-checker), the text you paste is sent to Pangram Labs, Inc. (United States) to analyze it. Per Pangram’s published policy, content submitted through their API is processed transiently and discarded — it is not retained, indexed, or used to train models. We do not store the text you paste into the free tool on our servers.

Data location

Uploaded files and application database records are stored in the European Union. Aggregate website analytics are processed by our self-hosted Plausible instance on Tencent Cloud infrastructure in the United States. We do not sell your data to anyone, for any purpose.

Cookies

We use strictly necessary cookies to keep you signed in and secure your session. We also set one first-party attribution cookie for 30 days. It records the campaign parameters in the link you followed (including a Google Ads click identifier when one is present), the landing-page path, the referring website’s hostname, and an on-site source label. It does not contain your paper or payment details, and we do not use it to follow you across unrelated websites. In the EEA, the United Kingdom, Canada, Australia, and New Zealand we set it only after you allow it. Elsewhere we set it by default, on the basis of our legitimate interest in knowing which links bring visitors, and you can decline below at any time.

Your attribution choice is remembered for 180 days and always overrides the regional default. Our self-hosted Plausible Analytics separately provides aggregate, cookieless page and interaction analytics. Report IDs and signed report-download URLs are removed before analytics events are sent. We do not use advertising, profiling, or third-party tracking cookies. If you buy credits while attribution is allowed, the same source fields are saved with that order so we can compare campaign checkouts, paid orders, and revenue.

Checkout reminders

When you start a checkout, our hosting provider supplies the two-letter country code associated with the request. We use it only to select the reminder policy and save that country code and policy with the order; we do not save your IP address for this purpose. In the EEA, UK, Canada, Australia, New Zealand, or when the country is unavailable, a reminder requires your affirmative checkbox choice. In other recognized countries, one reminder may be sent automatically after an unpaid checkout expires.

Stripe Checkout expires after two hours and can then provide a secure recovery link. We send at most one reminder for each unpaid checkout and never more than one checkout reminder per account in any 24-hour period. We send it only if the order remains unpaid and you have not completed a later purchase. Every reminder includes an unsubscribe link; unsubscribing prevents all future checkout reminders without affecting account, payment, or report emails.

Resend delivers these messages and sends us delivery-event callbacks. We store the Resend message ID and the first recorded timestamps for sending, delivery, opening, the checkout button being clicked, and the unsubscribe link being clicked. Open counts are approximate because email clients may block or prefetch tracking pixels. We do not save the click IP address, browser details, or full clicked URL in our application database, and we do not send these email events to Plausible.

For internal reporting, we record a direct recovery when Stripe confirms that the same Checkout recovery link led to payment. If a different checkout is paid within 24 hours of a reminder, we classify it as click-assisted when the checkout button was clicked first, or send-assisted when only the send is known. Assisted classifications are attribution estimates, not proof that the email caused the purchase.

Referral links and invitations

If you follow a customer’s referral link, we set a strictly necessary signed referral cookie for up to 30 days so a later new-account signup can be attributed to the first valid invitation. We also set a random first-party visitor cookie for up to one year. It is used only to avoid counting the same browser repeatedly in aggregate link statistics; it is not used to block rewards, advertise, or track you across websites.

We do not store your IP address or device fingerprint for the referral program. We store a keyed, non-reversible hash of the canonical account mailbox to reject recognized aliases, together with referral status and qualifying order/task identifiers. Hashed visit records are kept for a rolling 30-day measurement window. A qualifying refund reverses its referral reward.

Eligible paid customers may receive a referral-program announcement containing their permanent link and code. Each message includes an unsubscribe link. Unsubscribing affects referral invitation emails only and does not affect sign-in, payment, or report emails.

Data controller & legal basis

SubmitSense is the data controller for personal data processed through this service. We process your account email and uploaded documents to perform the check you request (performance of a contract) and to meet legal obligations. Source attribution is processed on the basis of our legitimate interest where local law permits, and only after your consent where an affirmative choice is required; you can decline or withdraw above at any time. Where checkout-reminder consent is required, we send the reminder only after your affirmative choice. Third-party detection providers act only as processors on our instructions and do not retain or train on your content. For any data question, contact support.

Your rights

If you are in the EEA or UK, you have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing. You can exercise any of these, or request deletion of your account and associated records, at any time by contacting support. We will action requests within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.