Privacy Policy

WriteGap (“we”, “us”, “our”) operates the WriteGap service at writegap.com. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your data.

1. Who we are

WriteGap is a SaaS product built for indie founders and small SaaS teams. We are the data controller for the personal data described in this policy. If you have any questions about this policy, contact us at contact@writegap.com.

2. What data we collect

Account data

When you sign up, we collect your email address and a password (hashed — we never store it in plain text). This is managed by Supabase Auth.

Site data

During onboarding you provide your site URL and optionally a product description. We store this to run your weekly keyword analysis.

Google Search Console data

If you connect Google Search Console (optional), we request read-only access to your GSC property (webmasters.readonly). We use this data to identify quick-win keywords, detect keyword cannibalization, and track ranking improvements. We store an OAuth refresh token in our database (Supabase, EU region) so we can refresh your data weekly, along with the ranking and query metrics returned by the API. You can revoke this access at any time from your Google account settings or from WriteGap settings; revoking deletes the stored token.

Limited Use disclosure. WriteGap’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only access and use Google Search Console data to provide and improve the user-facing keyword, ranking, and content features inside WriteGap.
• We do not use Google user data to train, fine-tune, or otherwise develop AI or machine-learning models. Google Search Console data is never sent to Anthropic or any other AI provider for model training.
• We do not sell Google user data, share it with third parties for advertising, or use it for any advertising purpose.
• We do not transfer Google user data to others except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger or acquisition, and never in a way inconsistent with this policy.
• No human at WriteGap reads your Google user data except with your explicit consent (for example, when you ask us to debug a specific issue), where required for security or legal purposes, or on data that has been aggregated and anonymized.

Usage data

We collect basic usage logs (API requests, errors) for debugging purposes.

We also use PostHog (EU region) for product analytics, to understand which features are used and where the product is confusing. Analytics only runs if you accept it in our cookie banner. If you reject, or ignore the banner, no analytics events are collected — on our website or on our servers.

When you have accepted, PostHog records page views and product events (for example: a draft was generated, a tab was opened, a subscription checkout was started). Once you are signed in, these events are associated with your user ID and email address so we can support your account. We do not use PostHog for advertising, and we do not sell this data. Google Search Console data is never sent to PostHog.

One exception is not covered by the banner: when a subscription is created, changed, or cancelled, our payment provider notifies our server directly and we record that fact (plan name and status only — no browsing activity). This happens server-to-server with no browser involved, so no cookie or consent signal exists. We rely on this record to administer your subscription, which is necessary to perform our contract with you.

3. How we use your data

• To generate your weekly keyword brief and article drafts
• To send you weekly brief emails and scheduled article reminders (you can unsubscribe at any time)
• To manage your subscription and process payments via Lemon Squeezy
• To debug errors and improve the service
• To measure product usage through analytics, so we know which features to build and fix

We do not sell your data. We do not use your data to train AI models.

Legal basis for each purpose

4. Subprocessors

WriteGap relies on the following providers to operate. Each processes personal data on our behalf under its own data processing terms.

Transfers to providers outside the EU or UK are covered by the safeguards described in section 5. We will update this list before adding a new subprocessor that handles personal data.

5. Data storage and security

Your data is stored in Supabase (EU region). We use row-level security to ensure users can only access their own data. All connections are encrypted via HTTPS/TLS.

International transfers. Some of our providers process data outside the EU — notably Anthropic (AI generation), DataForSEO, ScrapingBee, Resend, Lemon Squeezy, Vercel and Railway. Where data leaves the UK or the EEA, transfers are covered by the providers’ data processing agreements together with the appropriate safeguards — the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Your account database (Supabase) and, if you consent to it, your analytics data (PostHog) are held in the EU.

Credentials. If you connect Google Search Console or a publishing platform, the access token or password is encrypted at rest with a key held separately from the database. These credentials are never included in a data export and are deleted when you disconnect the integration or delete your account.

6. Data retention

We retain your data as long as your account is active. Deleting your account deletes it immediately — your sites, competitors, keywords, briefs, drafts, clusters, rankings history and stored credentials are removed straight away, not queued for later deletion, and the deletion cannot be undone.

Records we are legally required to keep — principally billing and tax records held by our payment provider — are retained for as long as the applicable law requires, independently of your account.

Google Search Console data and the associated OAuth token are deleted immediately when you disconnect Google Search Console in WriteGap settings, and immediately on account deletion. Revoking WriteGap’s access from your Google account permissions page also stops all further access.

7. Your rights

Regardless of where you are located, you have the following rights under the UK GDPR, the EU GDPR, and comparable laws:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and data
• Portability — request your data in a machine-readable format
• Objection — object to processing for marketing purposes

Two of these are self-serve, and you do not need to contact us to use them:

• Export — Settings → Account → “Export my data” downloads everything we hold about you as a JSON file.
• Deletion — Settings → Account → “Delete account” erases your account and data immediately.

To exercise any other right, email us at contact@writegap.com. We will respond within 30 days.

You can also opt out of our weekly brief and article-reminder emails at any time — use the unsubscribe link in any of those emails, or the toggle in Settings → Account. Account and billing emails are not optional while you have an account.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner’s Office (ICO); in the EU it is the data protection authority in your country of residence.

8. Cookies

Strictly necessary cookies

• Authentication cookies (set by Supabase Auth) — keep you signed in between page loads.
• wg_active_site — a preference cookie remembering which of your sites is currently selected.
• wg_consent — records your choice in the cookie banner, so we do not ask again on every page.

These are required to deliver a service you have requested, or to record a legal preference, and cannot be switched off.

Analytics cookies (optional)

Our analytics provider (PostHog, EU region) is off until you accept it. Before you choose, and if you reject, PostHog stores nothing on your device and sends us no events. If you accept, it stores an identifier so we can recognise a returning session.

We do not use advertising, retargeting, or profiling cookies, and we do not share cookie data with advertising networks.

A full table of every cookie, its purpose and its lifetime is in our Cookie Policy. You can change your mind at any time by clearing the wg_consent cookie for this site, which brings the banner back.

9. Children

WriteGap is a business tool and is not directed at minors. Accounts require you to be at least 18 years old, as stated in our Terms & Conditions. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy from time to time. We will notify you by email if we make material changes. Continued use of the service after changes constitutes acceptance.

11. Contact

For any privacy-related questions: contact@writegap.com