Privacy Policy

This Privacy Policy explains what information Melcom Group Ltd. ("Wordhaven", "we") collects about you, how we use it, who we share it with, and the choices you have. It applies to your use of wordhaven.io and the related Service.

1. Information we collect

1.1 Information you give us

• Account info: your email address, password (stored as a salted hash by our auth provider, never as plain text), and, if you sign in with Google, the email and basic profile fields Google returns.
• Manuscript content: the books, chapters, blurbs, cover images, and any other text or files you upload or paste into the Service.
• Decisions: the editing findings you accept or dismiss, the workflow brief steps you complete, and similar interactions with the Service.
• Payment info: the private beta is free and no purchase is offered. If you made a purchase in the past, or if a paid offer is introduced later, our payment processor (Stripe) collects the payment details directly; we receive limited information such as the last four digits of the card, the card brand, the billing country, and the Stripe customer/charge identifiers. We do not store full card numbers.
• Support communications: the contents of emails and other messages you send us.

1.2 Information collected automatically

• Usage and device data: pages visited, features used, approximate session duration, errors encountered, browser type, operating system, and IP address. We use this to operate and improve the Service, to diagnose technical problems, and to detect abuse.
• Cookies and similar storage: we use a small number of essential cookies and browser-local storage entries to keep you signed in, remember your in-progress workflow brief, cache results so they load quickly, and (when you opt in) capture limited analytics. We do not use cross-site advertising cookies.

2. How we use information

• To provide the Service: store your manuscripts, run analyses, display results, manage your account, and process payments if a purchase is made.
• To send transactional messages (purchase receipts, security alerts, important service notices).
• To answer support requests and respond to feedback.
• To improve the Service: debug, measure performance, study aggregated usage patterns.
• To detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms.
• To comply with legal obligations.

We do not sell your personal information, and we do not use Your Content to train or fine-tune AI models — ours, our providers’, or anyone else’s — without your explicit opt-in. See Terms Section 4.2 for how opt-in works.

3. Who we share information with

We share information only with the service providers and parties needed to operate the Service, and only the information they need:

• Supabase — database, authentication, and storage. Hosts your account, manuscripts, results, and any remaining credit balance under row-level security policies that restrict access to your account. Credits are not currently offered for purchase.
• Vercel — hosting, edge functions, and logs.
• Stripe — payment processing. Stripe’s privacy policy governs the payment data they collect directly.
• OpenRouter and Anthropic — LLM providers that perform the scoring and editing analyses. We send only the portions of Your Content necessary to perform the requested operation. Our current providers contractually commit not to use content sent through their APIs to train their models.
• Crossref and OpenAlex — public scholarly-source search. When you use a feature that checks factual claims against published research, we send short claim phrases from your manuscript as search queries to these public research indexes. The queries include only the claim text (plus our service contact address on Crossref requests, per their API convention) and are not linked to your account.
• Google — only if you choose to sign in with Google; we receive only the identity information you authorize Google to share.
• Email and support tooling as needed to communicate with you.
• Professional advisors (lawyers, accountants, auditors) under duty of confidentiality.
• In a corporate transaction — if Wordhaven is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to commercially reasonable confidentiality safeguards.
• Law enforcement and to protect rights — when required by subpoena, court order, or law, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4. How long we keep your information

We keep your account information and Your Content for as long as your account is active. If you delete a manuscript, we delete it from active storage promptly; ordinary backups may retain it for up to 30 days before being overwritten in the normal course. Run results, purchase records, and audit logs may be retained longer where required for tax, accounting, fraud-prevention, or legal-defense purposes — typically up to seven years for financial records.

When you close your account, we delete or de-identify personal information that is no longer needed for the purposes above, except as required by law.

5. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including transport encryption (TLS), encryption at rest where supported by our providers, row-level security on per-user data, least-privilege access for our employees, and prompt patching of known vulnerabilities. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you in line with applicable law.

6. Your choices and rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete information we no longer need to retain;
• port your information to another service;
• object to or restrict certain processing;
• withdraw consent for processing that relies on consent.

You can exercise these rights by emailing support@wordhaven.io. We may need to verify your identity before responding. You can request account deletion in Settings; you can also contact us to delete individual manuscripts or run results.

6.1 California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and CPRA give you the rights described above. We do not sell or share personal information for cross-context behavioral advertising.

6.2 EEA / UK residents

If you are in the European Economic Area or the United Kingdom, our lawful bases for processing are: (a) performance of the contract with you (operating the Service); (b) our legitimate interests in operating, securing, and improving the Service in ways that are proportionate and not overridden by your rights; (c) compliance with legal obligations; and (d) your consent where we ask for it. You may lodge a complaint with your local supervisory authority if you believe our processing is unlawful.

7. International transfers

Wordhaven is based in the United States and uses providers that store and process data in the United States and other countries. By using the Service, you understand and consent to the transfer of your information to the United States and other countries that may have data protection rules that differ from those in your country.

8. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact support@wordhaven.io and we will delete it.

9. Changes to this Policy

We may update this Privacy Policy from time to time. If we make a material change, we will give you reasonable advance notice (typically by email or by a prominent notice in the Service). The "Last updated" date at the top tells you when the current version took effect.

10. Contact

Questions about this Policy or how we handle your information? Email support@wordhaven.io. You can also write to us by post at the address below.

Melcom Group Ltd.
3961 52 Ave NE
Calgary, Alberta T3J 0K7
Canada