Privacy, in plain language.

Driftmoth LLC operates phras.ai and determines how account and service information is used. This notice covers phras.ai. Other Driftmoth products may have their own notices.

What we collect and why

• Account information: email, optional name, salted password hash and accepted policy versions, to create and administer your account.
• Writing: drafts, revisions, editing settings and quality reports, to deliver the edits you request. Anonymous analysis runs on our server without an LLM request or a saved draft in the application database.
• Security and service records: session identifiers, IP addresses, browser user-agent, job identifiers, timestamps, errors and usage counts, to keep the service working and limit abuse.
• Payments and vouchers: subscription/customer identifiers, invoice references, credit activity, redemption records and payment status. Stripe handles card details; phras.ai does not store full card numbers or security codes.
• Support: information you send when requesting help, a refund, account recovery or an exercise of your privacy rights.

Legal bases where data-protection law requires them

We process information necessary to perform our contract with you, including account access, requested editing and billing. Our legitimate interests include service security, fraud prevention, diagnosing faults and handling support or legal claims, balanced against your rights. We retain information when required by applicable accounting or other law. If an optional activity requires consent, we will request it separately; acknowledging this notice is not consent to advertising or model training.

Who receives information

• netcup: hosts the application and database on our server in Vienna, Austria.
• Alibaba Cloud Model Studio and DeepSeek Open Platform: receive editable prose and editing/review instructions through their APIs. A job may use more than one provider, including retries or fallback. We do not send your account password or payment information as part of an editing request. Personal information included in your prose is still part of that request.
• Stripe: receives billing and payment information when you use paid checkout or subscription management.
• Cloudflare: provides domain/DNS services. The current application connection goes directly to the hosting server; Cloudflare is not used as an application traffic proxy.
• Email providers: handle messages you send to our support mailbox. Automated password-recovery messages, when enabled, are delivered by Resend and contain your email address and a time-limited reset link. Our contact page shows whether automated recovery is currently available.

Protected code, tables and HTML blocks stay outside model rewrite requests. We do not operate a model-training pipeline on your drafts or sell your drafts to advertisers. Provider processing is subject to the applicable API terms; we do not promise every provider has zero retention. See Alibaba Cloud’s data-handling information and the DeepSeek Open Platform terms. Consumer chat policies do not replace this notice for phras.ai users.

International processing

The application is hosted in Austria, but model requests leave that server. We use Alibaba’s international API and a China-based model provider, DeepSeek. Information may be handled outside your country, including outside the EEA or UK. phras.ai does not offer an EU-only processing guarantee. Contact us before submitting information that requires a particular location, contractual safeguard or confidentiality arrangement. We do not claim an adequacy decision or signed transfer safeguard that has not been established for the relevant processing.

Retention and deletion

• Completed, failed and canceled job text is scheduled for purging 72 hours after the job finishes. The periodic purge removes input, output and content-derived diagnostics; it is not an instantaneous deletion guarantee.
• Session records are cleaned up more than 7 days after expiry or revocation. Other account and credit records remain while your account is open and as needed to resolve requests, security issues, payment disputes or applicable legal obligations.
• Encrypted production backup snapshots rotate after approximately 14 days. They can contain text already removed from the live database. Individual records are not edited inside a backup; deletion instructions must be reapplied if a backup is restored.
• Support records, necessary billing records, operational logs and any separately retained recovery copies are assessed when a deletion request is handled. We will explain any information that must be retained and why. Provider copies follow their applicable processing arrangements and are not covered by the application’s 72-hour purge.

Cookies and automated processing

Essential cookies keep you signed in. The application does not include advertising trackers. Writing scores are automated style heuristics, not decisions about your employment, creditworthiness, academic conduct or legal rights. You decide whether to use a revision.

Your choices and rights

Depending on applicable law, you may request access, a copy, correction, deletion, restriction or portability of your information, object to processing based on legitimate interests, or withdraw consent for an activity that relies on consent. Withdrawal does not change processing that was lawful before it. You may also complain to the competent data-protection authority; you do not need our permission to do so.

Email support@phras.ai with “phras.ai privacy request” and describe your request. We may take proportionate steps to verify account ownership. Never send a password or full card number. We aim to respond within one month and will follow any shorter applicable deadline; if an extension is permitted and necessary, we will explain it. Account deletion and cancellation of subscription renewals are separate requests—tell us if you want both.

Do not upload passwords, full payment-card details, or sensitive personal information you are not authorized to share. Contact us if a child’s information was submitted or you believe information was processed improperly.

Changes and contact

We date and version this notice. Material changes will be explained in the service or through an appropriate account contact method. Contact and support details are available without signing in.