Writing, no kidding ("us", "we", or "our") operates the Writing, no kidding website (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. We are committed to protecting your data and your rights under the General Data Protection Regulation (GDPR).

1. Data Controller

Writing, no kidding is the data controller of your personal information.

2. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected

• Personal Data: While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This may include, but is not limited to: email address, first name and last name, cookies, and usage data.
• Student Data: If you are a teacher using our service, you may provide information about your students, such as names and email addresses, for the purpose of creating assignments. We process this data on your behalf as a data processor.
• Usage Data: We may also collect information on how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (for example, IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

3. Legal Basis for Processing Personal Data Under GDPR

We may process Personal Data under the following conditions:

• Consent: You have given your consent for processing Personal Data for one or more specific purposes.
• Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof.
• Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which we are subject.
• Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by us.

4. Your Data Protection Rights Under GDPR

We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data. If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please contact us.

In certain circumstances, you have the following data protection rights:

• The right to access, update, or delete the information we have on you.
• The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
• The right to object. You have the right to object to our processing of your Personal Data.
• The right of restriction. You have the right to request that we restrict the processing of your personal information.
• The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable, and commonly used format.
• The right to withdraw consent. You also have the right to withdraw your consent at any time where Writing, no kidding relied on your consent to process your personal information.

5. Data Retention

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

AI usage logs (token counts, model type, timestamp — no submission content) are retained for up to two years for billing and audit purposes, after which they are automatically deleted via a Firestore TTL policy (EU AI Act Art. 19 / GDPR data minimisation).

6. Security of Data

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

8. Artificial Intelligence Processing and EU AI Act

AI features and data flows

The Service uses Google Gemini 2.5 Flash, operated by Google LLC via Firebase Genkit, to power AI-assisted features including writing correction, rubric scoring, student evaluation generation, and originality checking. When a teacher activates an AI feature on a student submission, the following data is transmitted to the AI model:

• The student's written submission text.
• The assignment writing prompt and, where applicable, the teacher's rubric criteria.

Student names, email addresses, and account identifiers are not included in AI requests. AI features are triggered exclusively by teacher action — student data is never sent to the AI model without a deliberate teacher action.

Legal basis

AI processing is carried out on the basis of legitimate interests (GDPR Art. 6(1)(f)) — the legitimate interest of the teacher in receiving AI-assisted feedback tools — and, where applicable, on the basis of the contract with the teacher. Processing of student submission text is carried out by us as a data processor on behalf of the teacher (data controller).

No automated decision-making

No decision that produces legal or similarly significant effects for a student is made solely by automated means (GDPR Art. 22 / EU AI Act Art. 14). All AI outputs are presented to the teacher as draft suggestions. A teacher must explicitly review, approve or override any AI-generated content before it is shared with a student.

Your rights under the EU AI Act

Where an AI feature has produced output that has been shared with you, you have the right to request a meaningful explanation of that output (EU AI Act Art. 50(1)). You may exercise this right by contacting us at privacy@writingnokidding.com. Further information about our AI practices, the model used, and your rights is available at our AI Transparency page.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "last updated" date at the top of this Privacy Policy.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us by email: privacy@writingnokidding.com