Privacy policy
Last updated 1 November 2026. This policy explains what personal data AI Humanizer collects when you use noai.devprithwiraj.in, the editor and the API, why we collect it, and the choices and rights you have.
- The text you rewrite is processed in memory and never stored on our servers.
- We collect only what we need to run your account, the API and payments.
- We don't sell your data, show ads or use tracking cookies.
- Razorpay handles payments; we never see your card, UPI or bank details.
- You can ask to access, correct or delete your data at any time.
1. Who we are
AI Humanizer (“we”, “us”, “our”) runs this website and service and decides how your personal data is used. Under India’s Digital Personal Data Protection Act, 2023 we are the “Data Fiduciary”; under the EU and UK General Data Protection Regulation we are the “controller”.
2. Information we collect
Information you give us
- Account details: your username and email address, and your password, which we store only as a salted one-way hash (scrypt). We cannot see or recover your password.
- API key names you choose when creating keys.
- Billing details, if you add them for your invoices: business name, GSTIN, state and billing address.
- Messages you send us, such as support or refund requests.
Information from Google or GitHub, if you sign in with them
- Google: your name, email address, whether Google has verified it, your Google account ID and the address of your profile picture (the standard “openid”, “email” and “profile” permissions).
- GitHub: your username, GitHub account ID, your primary verified email address and the address of your profile picture (the “read:user” and “user:email” permissions).
We use these only to create your account, sign you in and show your profile picture in the site’s menu bar. The picture itself stays on Google’s or GitHub’s servers and loads from there; we keep only its address, updated each time you sign in with them. We never receive your Google or GitHub password, and the access tokens they issue are used once during sign-in and not stored.
Information created when you use the service
- API keys: a one-way hash of each key and its first 12 characters (so you can tell keys apart), its name, creation date and whether it is active or revoked.
- API usage records: for each API request, the time, endpoint, status, processing time and, for failures, the type of error. These records never contain the text you sent.
- Email confirmation: whether you have confirmed your email address. Confirmation links are signed and expire after 3 days; we don’t store them.
- Plan and quota: your API plan, whether it is a 30-day or yearly plan, how many requests it includes and how many you have used, its start and end dates, your top-up balance, and whether we have sent you a usage warning or renewal reminder for it.
- Payment records: what you bought, the amount, currency, any coupon and discount, the country used to set the price, Razorpay’s order, payment, subscription and refund IDs, the status and dates. If you turn on auto-renewal, we also keep Razorpay’s subscription ID and its status (we never see your card or UPI details).
- Invoices: for each purchase, the invoice number and date, what was bought, the amounts and taxes, and the name, email address and billing details on your account at the time.
- Referrals: your referral code, which account referred you (if any), the accounts that signed up with your link, and the rewards given. People you refer can’t see your details, and you see only counts, not who they are.
- Security records: the email address and time of failed sign-in attempts, and password-reset codes with their expiry time and number of attempts.
- Admin actions: when our staff change an account in our admin panel (for example to grant requests or issue a refund), we record who did it, what they did and when.
Technical information
- IP address: used in memory to apply rate limits and to find your country for regional pricing, using a database stored on our own server. We do not save your IP address in our database; only the country code is saved, and only with a purchase.
- Server logs: our hosting provider records technical request data such as IP address, time, page requested and browser type, which we use for security and troubleshooting. Logs never include the text you submit or your password.
3. The text you rewrite
Text you send to the editor or the API is processed in our server’s memory to produce the result and is discarded as soon as the response is sent. It is never written to our database or logs, never used to train any model, and never shared with anyone. If something fails while processing, our error logs record only the type of error and where in our code it happened, not its message, because messages could quote your text.
To let you reopen recent work, the editor saves your six most recent results (the original and rewritten text) in your own browser’s local storage, separately for each account, so other people who sign in on the same browser don’t see them. This stays on your device, and you can delete it with “Clear history” in the editor or through your browser settings.
4. How we use information
We use personal data only for the purposes below. Under the GDPR each purpose relies on the legal basis shown; under India’s DPDP Act we rely on the consent you give by creating an account and using the service, and on the legitimate uses the Act permits.
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Create your account and sign you in | Account details, Google/GitHub sign-in data, session cookie | Contract |
| Provide the editor and the API | Your text (in memory only), API keys, plan and usage | Contract |
| Sell API plans and top-ups, renew plans you set to renew, apply coupons and keep payment records | Payment records, email, name | Contract; legal obligation (tax and accounting) |
| Issue invoices and receipts | Invoices, billing details, email, name | Contract; legal obligation (GST and accounting) |
| Run the referral program | Referral records | Contract |
| Confirm your email address and stop fake or automated sign-ups | Email address, Cloudflare Turnstile check result, IP address (in memory) | Legitimate interests (preventing abuse of free requests) |
| Show prices for your region | IP address (country lookup) | Legitimate interests (fair, affordable pricing) |
| Keep the service secure: rate limits, account lockout, fraud prevention | IP address (in memory), security records, server logs | Legitimate interests; legal obligation |
| Send service emails: email confirmation, password-reset codes, receipts, usage warnings at 80% of your requests and reminders before a plan ends | Email address, username, plan and usage, payment records | Contract |
| Answer your requests and provide support | Your messages and account details | Contract; legitimate interests |
| Comply with the law and protect our rights | Information required in each case | Legal obligation; legitimate interests |
We do not sell personal data, share it for targeted advertising, build advertising profiles, or make decisions about you that have legal or similarly significant effects based solely on automated processing.
7. International transfers
Our providers may store or process data in countries other than yours, including India, the United States and countries in the European Union. When data leaves your country, we rely on providers that commit to protecting it and, where the law requires, on recognised safeguards such as standard contractual clauses.
8. How long we keep information
| Information | How long |
|---|---|
| Text you rewrite | Not kept: discarded once the response is sent |
| Account details, API keys (including revoked keys), plan, top-up balance, usage, referral records and billing details | Until your account is deleted |
| Payment records and invoices | As long as tax and accounting laws require; in India, generally up to 8 years |
| Admin action records | Up to 8 years, as part of our accounting and security records |
| Unpaid checkout attempts | Deleted automatically after 30 days |
| Failed sign-in records | Deleted automatically shortly after 15 minutes |
| Password-reset codes | Valid for 10 minutes; deleted after use or shortly after expiring |
| Server logs | Kept by our hosting provider for a limited period |
| Editor history in your browser | Until you clear it |
When you ask us to delete your account, we delete your account details, API keys, usage records, plan, referral records and billing details within 30 days and turn off any auto-renewal, except payment records and invoices that the law requires us to keep.
9. Security
- All connections are encrypted with HTTPS.
- Passwords are stored as salted scrypt hashes and API keys as SHA-256 hashes; neither can be read back.
- Sign-in, sign-up, password reset and the API are rate limited, and accounts lock temporarily after repeated wrong passwords.
- Pages are protected with security headers that block framing and restrict which scripts may run.
- Access to production systems is limited to the people who run the service.
No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live, you have some or all of these rights over your personal data:
- Access: get a summary or copy of the personal data we hold about you.
- Correction: have inaccurate or incomplete data corrected or updated.
- Deletion: have your account and personal data erased, subject to records we must keep by law.
- Portability: receive your data in a structured, commonly used format.
- Withdraw consent: stop using the service and ask us to delete your account at any time.
- Objection and restriction (EU and UK): object to processing based on legitimate interests, or ask us to limit it.
- Nomination (India): nominate someone to exercise your rights if you die or become unable to.
- Grievance redressal: raise a complaint with our Grievance Officer, and escalate it to the Data Protection Board of India, or to your local data protection authority in the EU or UK.
- California residents: the rights to know, delete and correct, and not to be discriminated against for using them. We do not sell or share personal information as those terms are defined in California law.
To use any of these rights, contact us through the contact page from the email address on your account, so we can confirm it is you. It is free, and we reply within 30 days, or sooner where the law requires. You can also revoke API keys yourself from the dashboard, and clear your editor history in the editor.
11. Children
The service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
12. Google user data
If you sign in with Google, we use your name and email address only to create your account and sign you in. AI Humanizer’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
13. Changes to this policy
We will update this policy when our practices change and revise the date at the top. If a change significantly affects how we use your personal data, we will tell account holders by email or with a notice on the site before it takes effect.
14. Contact us
Questions, requests or complaints about privacy go to us or our Grievance Officer: