Sign in

Privacy Policy

Last updated 2 November 2026.

1. Who is responsible

The controller of your personal data is Herman Foundry Oy (business ID 3636930-1), Äijinpolku 1, 99140 Kittilä, Finland, which runs Overwride. For any question about your data, or to use your rights, email hello@hermanfoundry.com. We have not appointed a data protection officer, because the law doesn't require one for a service of our size and kind.

2. What we collect

  • Account data: your email address, your plan and its status, your credit balance and its history, and when you signed up.
  • Sign-in data: if you sign in with Google or GitHub, we receive your email address and basic profile details (name and picture, where the provider sends them) to create or find your account. We don't request access to anything else in those accounts. If you sign in by email, we send a one-time link to your address.
  • Drafts, rewrites and records: the draft you submit, the rewrite, the model that made it and the time. If you add the final text you published, we store that too, with how much of it you edited.
  • API keys: a one-way hash of each key (never the key itself), its name, and when it was last used.
  • Payment data: Stripe collects your card details, billing address and any VAT number at checkout. We never see or store your full card number. We keep the Stripe customer and subscription ids that link your account to Stripe, and your invoices.
  • Waitlist: if you joined the waitlist, your email address.
  • Technical data: to prevent abuse, we count requests per IP address over a short window, using a salted hash of the address rather than the address itself. Our hosting provider also keeps standard server logs, including IP addresses, for a short time.

Text you paste into the checker is hashed and compared, then discarded. We don't store it.

3. Records are public by link

Anyone with a record's link, or with the exact text of the rewrite or the final text, can see the whole record, including your draft. That is the purpose of a record. Records are not listed or indexed by search engines, and your email address is never shown on them. Don't put personal data, about yourself or anyone else, in a draft unless you are happy for it to be seen next to your post.

4. Why we use it, and our legal basis

  • To provide the service (sign-in, rewrites, records, API keys, billing and support): necessary to perform our contract with you (GDPR Art. 6(1)(b)).
  • To keep accounting and tax records: necessary to meet our legal obligations (Art. 6(1)(c)).
  • To keep the service secure and prevent abuse (rate limits, server logs): our legitimate interest in running a safe service (Art. 6(1)(f)).
  • To email you about the waitlist: your consent, which you can withdraw at any time with the unsubscribe link or by emailing us (Art. 6(1)(a)).
  • To tell you about changes to your plan, prices, these policies or the terms: necessary to perform our contract with you.

We don't send marketing email to account holders without asking first, we don't make decisions about you by automated means that have legal or similarly significant effects, and we don't use your content to train AI models.

5. Who processes it for us

We use these providers, each under a data processing agreement, to run Overwride:

  • Supabase: database and sign-in. Data is stored in the EU (Stockholm, Sweden).
  • Vercel: hosting of the website and API.
  • xAI: the Grok model that makes rewrites. Each draft you rewrite is sent to it.
  • Stripe: payments, invoices and tax.
  • Resend: sign-in emails and the waitlist.
  • Upstash: short-lived rate-limit counters.
  • Google and GitHub: sign-in, if you choose them.

We don't sell your personal data or share it with advertisers. We may disclose it where the law requires, for example to answer a lawful request from an authority.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

6. Transfers outside the EU

Some of these providers, such as xAI, Vercel, Stripe and Resend, are based in the United States or may process data there. Where data leaves the EU or EEA, we rely on the EU-US Data Privacy Framework for providers certified under it, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

  • Account data, records and API keys: while your account is open. When you delete your account, we delete them within 30 days, except where we must keep something by law. Deleted data may stay in encrypted backups for up to 30 more days before those backups are overwritten.
  • Invoices and payment records: as long as Finnish accounting law requires, currently six years after the end of the financial year in which they were made.
  • Rate-limit counters: minutes. Server logs: as long as our hosting provider keeps them, which is usually days.
  • Waitlist: until Overwride opens to you or you unsubscribe.

8. Cookies

We only use cookies that are strictly necessary to keep you signed in. We don't use analytics, advertising or tracking cookies, so there is nothing to consent to.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and get a copy;
  • have inaccurate data corrected;
  • have your data deleted, including individual records;
  • restrict or object to how we use it, including use based on legitimate interest;
  • receive your data in a portable format;
  • withdraw consent at any time, where we rely on consent.

Email hello@hermanfoundry.com from the address on your account. We answer within one month. If we need to confirm it is you, we will ask. You also have the right to complain to a data protection authority. In Finland that is the Office of the Data Protection Ombudsman (tietosuoja.fi), and you can also contact the authority where you live.

10. Security

Data is encrypted in transit and at rest with our providers. Access to the database is restricted, API keys are stored only as hashes, and each user can read only their own account data. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

11. Children

Overwride is for adults. You must be 18 or older to create an account, and we don't knowingly collect data from children.

12. Changes

When this policy changes, the date at the top changes too. We will email account holders before a material change takes effect. See also the Terms of Service.