Privacy Policy
Version effective 28 September 2026
This policy explains which personal data OnlineCreation collects when you use UglyWriting.com, for what purpose, how long it is kept and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Contents
Data controller
The data controller is OnlineCreation SARL, publisher of UglyWriting.com, 61 rue du Château d'Eau, 33000 Bordeaux, France (RCS Bordeaux 520 540 188). For any question about your personal data: contact form.
Data collected
| Category | Data | Source |
|---|---|---|
| Account | Email address, language, preferences, creation and last sign-in dates | You, when registering; or Google / Apple if you choose to sign in with them (only your verified email address is then retrieved) |
| Sign-ins | Date and IP address of each sign-in | Collected automatically |
| Documents | Uploaded files (images, PDFs), their name and fingerprint, transcribed text | You |
| Purchases and billing | Credit and purchase history, Stripe identifiers; billing name, address, country and, where applicable, phone number | You, via Stripe at checkout |
| Support | Email address, message subject and content, IP address and browser | You, via the contact form |
No password is created or stored: you sign in with a link sent by email or via Google / Apple. Your card details are entered directly with Stripe and are never passed on to us.
Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Create and manage your account, transcribe your documents, keep your history | Performance of the contract |
| Sell credits and subscriptions, issue invoices, keep the accounts | Performance of the contract and legal obligation |
| Send service emails (sign-in link, purchase confirmation, reminders before an inactive account is deleted) | Performance of the contract and legitimate interest |
| Answer your support requests | Legitimate interest |
| Secure the service: preventing abuse and bots, sign-in log | Legitimate interest and legal obligation to retain connection data |
Your documents and transcriptions are not sold, not used for advertising and not used by OnlineCreation to train artificial intelligence models. We do not send marketing messages.
Retention periods
| Data | Retention period |
|---|---|
| Uploaded files (images, PDFs, Word, EPUB) | 90 days after upload, then automatic deletion. Earlier if you delete them, or as soon as the transcription is complete if you enable this option in your account. |
| Documents awaiting page selection (working copy and thumbnails, on our servers) | Deleted as soon as the transcription is done or abandoned, and at the latest 2 hours after upload. |
| Transcriptions | Until you delete them or your account is deleted. |
| Account, preferences, credit history | As long as the account exists. An account with no sign-in for 2 years and no active subscription is automatically deleted with all its data. You are notified by email after 12, 18 and 23 months without signing in, and at least 30 days before deletion; simply sign in to keep your account. |
| Sign-in log (date, IP address) | 12 months. |
| Sign-in links sent by email | Valid for a few minutes, erased 7 days after they expire. |
| Support messages | 3 years after they are sent. |
| Server technical logs | 12 months. |
| Invoices and accounting records | 10 years (Article L123-22 of the French Commercial Code), including after the account is deleted. |
| Proof of the request for immediate performance and of the waiver of the right of withdrawal | 5 years after the purchase (limitation period), including after the account is deleted. |
These deletions are carried out by automatic daily jobs. You can delete a file, your transcriptions or your account at any time from your personal area.
Recipients and processors
Your data can only be accessed by authorised OnlineCreation staff and by the following providers, to the extent necessary for their tasks:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Website and database hosting | France |
| Scaleway SAS | Storage of uploaded files | France |
| Mistral AI SAS | Document transcription (OCR) | European Union |
| Stripe Payments Europe Ltd | Online payment | Ireland, with possible transfers to the United States |
| Cloudflare, Inc. | Website delivery and protection network (all traffic, including uploaded files, passes encrypted through its servers) | United States, processed in the data centre closest to the visitor |
| Google LLC | Sign-in with Google, if you choose it | United States |
| Apple Inc. | Sign-in with Apple, if you choose it | United States |
The website's fonts, icons and technical libraries are hosted on our own servers: displaying them sends no data to any third party. Invoices are issued by OnlineCreation's in-house billing tool, and your avatar is displayed by MyAvatar, an OnlineCreation service, from a hashed fingerprint of your email address. We do not sell or rent your data; it is only disclosed to authorities upon lawful request.
Transfers outside the European Union
Your documents and transcriptions are stored and processed in the European Union; they pass encrypted through the network of Cloudflare, which protects the website. Some providers (Stripe, Cloudflare, Google, Apple) may process payment or technical data in the United States. These transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for certified companies and, failing that, on the European Commission's standard contractual clauses.
Cookies
UglyWriting.com uses no advertising cookies, no audience measurement tools and no social media trackers. Only cookies strictly necessary for the service are set, which does not require your consent: the session cookie (sign-in and language, deleted when you close your browser) and the “stay signed in” cookie (7 days).
Security
Communications are encrypted (HTTPS). Sign-in is password-free, using a single-use, time-limited link. Uploaded files are made private as soon as transcription is complete, and access to data is restricted to authorised staff. In the event of a data breach likely to put you at risk, we will notify the CNIL and, where necessary, the people concerned, in accordance with Articles 33 and 34 GDPR. The sign-in and contact forms are protected against bots by an in-house check, with no cookie or third-party service: it counts interactions with the page (number of keystrokes, clicks, taps and movements, time spent filling in) without recording what you type or where you click. These counters are only kept in technical logs when a submission is refused.
Your rights
| Right | Description |
|---|---|
| Access | Obtain confirmation that your data is processed and receive a copy. |
| Rectification | Have inaccurate or incomplete data corrected. |
| Erasure | Have your data deleted, subject to legal retention obligations. |
| Objection | Object to processing based on our legitimate interest. |
| Portability | Receive your data in a structured, commonly used format. |
| Restriction | Ask for the use of your data to be temporarily suspended. |
| Post-mortem instructions | Decide what happens to your data after your death. |
| Complaint | Lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France – www.cnil.fr, or with your local supervisory authority. |
You can exercise many of these rights directly from your personal area: downloading your transcriptions, deleting your files or your account. For any other request, use the contact form; we reply within one month.
Automated decisions
Your documents are transcribed automatically by artificial intelligence. No decision producing legal effects concerning you or similarly significantly affecting you is taken solely on the basis of automated processing.
Minors
The service is not intended for children under 15 without the consent of their parents or legal guardians.
Updates to this policy
This policy may be updated, in particular to reflect changes to the service or to regulations. The date of the current version is shown at the top of this page; in the event of a significant change, you will be informed by email or on the website.