What we collect, why we collect it, how long we keep it, and what you can ask us to do about it. We are the data controller for account data and a processor for the content you run through the service.
Account data: name, work email, organization name, billing details handled by our payment provider. Site data: the site names, URLs, and CMS credentials you enter so we can publish. Content data: topics, drafts, published posts, and the results of every quality and policy check. Usage data: sign in times, screens visited, actions taken, and technical logs from our servers.
To run the service you asked for, to publish to sites you connect, to bill you, to keep the platform secure, to investigate problems you report, and to improve reliability. We do not sell personal data and we do not use your content to train third party models.
WordPress application passwords are encrypted at rest and used only to publish or verify a connection. They are never shown back to you in full and never included in logs. Deleting a site deletes its stored credentials within twenty four hours.
We use a cloud host for infrastructure, a payment provider for billing, an email provider for notifications, and model providers to generate and check content. Each is bound by a data processing agreement. The current list is available on request and is updated when it changes.
Account data is kept while the account is open and for six years after closure where tax law requires it. Drafts, runs and audit records are kept for twenty four months so the audit log remains meaningful, then deleted. You can request earlier deletion of drafts and runs.
If you are in the UK or the EEA you can ask for a copy of your data, ask us to correct or delete it, object to certain processing, or ask us to move it elsewhere. Write to privacy@quillrun.com and we will answer within thirty days. You can also complain to your local supervisory authority.
Data is stored in the United Kingdom and the European Union. Where a sub processor operates outside those regions, transfers rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.
We use a session cookie so you stay signed in and a small number of first party analytics cookies to count page views. No advertising cookies and no cross site trackers.
Encryption in transit and at rest, least privilege access for staff, audit logging on internal access to customer data, and annual penetration testing. If a breach affects you we will tell you and the regulator within seventy two hours of becoming aware.