Privacy Policy

This Privacy Policy explains what information Melcom Group Ltd. ("Wordhaven", "we") collects about you, how we use it, who we share it with, and the choices you have. It applies to your use of wordhaven.io and the related Service.

1. Information we collect

1.1 Information you give us

• Account info: your email address, password (stored as a salted hash by our auth provider, never as plain text), and, if you sign in with Google, the email and basic profile fields Google returns.
• Manuscript content: the books, chapters, blurbs, cover images, and any other text or files you upload or paste into the Service.
• Decisions: the editing findings you accept or dismiss, the workflow brief steps you complete, and similar interactions with the Service.
• Payment info: when you buy a credit, our payment processor (Stripe) collects the payment details directly; we receive limited information such as the last four digits of the card, the card brand, the billing country, and the Stripe customer/charge identifiers. We do not store full card numbers.
• Support communications: the contents of emails and other messages you send us.

1.2 Information collected automatically

• Usage and device data: pages visited, features used, approximate session duration, errors encountered, browser type, operating system, and IP address. We use this to operate and improve the Service, to diagnose technical problems, and to detect abuse.
• Cookies and similar storage: we use a small number of essential cookies and browser-local storage entries to keep you signed in, remember your in-progress workflow brief, cache results so they load quickly, and (when you opt in) capture limited analytics. We do not use cross-site advertising cookies.

2. How we use information

• To provide the Service: store your manuscripts, run analyses, display results, manage your account, and process payments.
• To send transactional messages (purchase receipts, security alerts, important service notices).
• To answer support requests and respond to feedback.
• To improve the Service: debug, measure performance, study aggregated usage patterns.
• To detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms.
• To comply with legal obligations.

We do not sell your personal information, and we do not use Your Content to train or fine-tune AI models — ours, our providers’, or anyone else’s — without your explicit opt-in. See Terms Section 4.2 for how opt-in works.

3. Who we share information with

We share information only with the service providers and parties needed to operate the Service, and only the information they need:

• Supabase — database, authentication, and storage. Hosts your account, manuscripts, results, and credit balance under row-level security policies that restrict access to your account.
• Vercel — hosting, edge functions, and logs.
• Cloudflare — web traffic analytics used to understand aggregate site usage and performance.
• Stripe — payment processing. Stripe’s privacy policy governs the payment data they collect directly.
• OpenRouter and Anthropic — LLM providers that perform the scoring and editing analyses. We send only the portions of Your Content necessary to perform the requested operation. Our current providers contractually commit not to use content sent through their APIs to train their models.
• Google — only if you choose to sign in with Google; we receive only the identity information you authorize Google to share.
• Email and support tooling as needed to communicate with you.
• Professional advisors (lawyers, accountants, auditors) under duty of confidentiality.
• In a corporate transaction — if Wordhaven is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to commercially reasonable confidentiality safeguards.
• Law enforcement and to protect rights — when required by subpoena, court order, or law, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4. How long we keep your information

We keep your account information and Your Content for as long as your account is active. If you delete a manuscript, we delete it from active storage promptly; ordinary backups may retain it for up to 30 days before being overwritten in the normal course. Run results, purchase records, and audit logs may be retained longer where required for tax, accounting, fraud-prevention, or legal-defense purposes — typically up to seven years for financial records.

When you close your account, we delete or de-identify personal information that is no longer needed for the purposes above, except as required by law.

4.1 Optional beta research

Beta access does not require research participation. If you separately opt in, we may place non-content usage measurements, broad manuscript stage and word-count bands, and the structured survey choices you authorize in a research dataset under a random participant code. We do not place manuscript text, book titles, interview recordings or transcripts, payment data, names, or email addresses in that dataset.

Linked research measurements are retained for no more than 12 months after the beta research ends. You can withdraw in Settings at any time; we then stop future research collection and remove your linked measurements. Results already irreversibly combined into anonymous aggregate statistics cannot later be separated. Public reporting suppresses groups smaller than 10, and we will seek separate permission before using an attributable quote or individual story.

5. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including transport encryption (TLS), encryption at rest where supported by our providers, row-level security on per-user data, least-privilege access for our employees, and prompt patching of known vulnerabilities. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you in line with applicable law.

6. Your choices and rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete information we no longer need to retain;
• port your information to another service;
• object to or restrict certain processing;
• withdraw consent for processing that relies on consent.

You can exercise these rights by emailing support@wordhaven.io. We may need to verify your identity before responding. Until self-service deletion is available, contact us to delete individual manuscripts, run results, or close your account.

6.1 California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and CPRA give you the rights described above. We do not sell or share personal information for cross-context behavioral advertising.

6.2 EEA / UK residents

If you are in the European Economic Area or the United Kingdom, our lawful bases for processing are: (a) performance of the contract with you (operating the Service); (b) our legitimate interests in operating, securing, and improving the Service in ways that are proportionate and not overridden by your rights; (c) compliance with legal obligations; and (d) your consent where we ask for it. You may lodge a complaint with your local supervisory authority if you believe our processing is unlawful.

7. International transfers

Wordhaven is operated from Calgary, Alberta, Canada, and uses providers that may store and process data in Canada, the United States, and other countries. By using the Service, you understand that your information may be transferred to the United States and other countries that may have data protection rules that differ from those in your country.

8. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact support@wordhaven.io and we will delete it.

9. Changes to this Policy

We may update this Privacy Policy from time to time. If we make a material change, we will give you reasonable advance notice (typically by email or by a prominent notice in the Service). The "Last updated" date at the top tells you when the current version took effect.

10. Contact

Questions about this Policy or how we handle your information? Email support@wordhaven.io. You can also write to us by post at the address below.

Melcom Group Ltd.
3961 52 Ave NE
Calgary, Alberta T3J 0K7
Canada