Privacy Policy

Last updated: March 18, 2026

1. Introduction & Data Controller

This Privacy Policy explains how Cobey AI GmbH (“we”, “us”, or “our”), the operator of WriteMyThesis, collects, uses, and protects your personal data. We are the data controller for the purposes of the General Data Protection Regulation (GDPR) and applicable Liechtenstein data protection laws.

Data Controller:
Cobey AI GmbH
Sagenstrasse 43
9492 Eschen, Liechtenstein
Email: support@writemythesis.app

2. Data We Collect

We collect the following categories of personal data:

  • Account data: Name, email address, and profile information provided during account creation through our authentication provider (Clerk)
  • Paper content: Paper configurations, uploaded documents, generated text, research data, citations, and any feedback or edits you provide during the writing process
  • Usage data: Information about how you interact with the Service, including features used, pages visited, and agent pipeline interactions
  • Payment data: Payment information is processed by Stripe. We receive transaction confirmations but do not store your full payment card details

3. How We Use Your Data

We process your personal data for the following purposes:

  • Providing and operating the Service, including AI-powered paper generation
  • Processing payments and managing your purchases
  • Communicating with you about your account or the Service
  • Improving the quality, security, and performance of the Service
  • Complying with legal obligations

4. Legal Bases (GDPR Article 6)

We process your data based on the following legal grounds:

  • Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you have requested, including account management, paper generation, and payment processing
  • Legitimate interest (Art. 6(1)(f)): Improving our Service, ensuring security, and preventing fraud
  • Legal obligation (Art. 6(1)(c)): Compliance with applicable laws and regulations
  • Consent (Art. 6(1)(a)): Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing

5. Third-Party Processors

We share your data with the following categories of third-party service providers who process data on our behalf:

  • Clerk — Authentication and user management
  • Supabase — Database hosting and storage
  • Stripe — Payment processing
  • OpenRouter — AI model routing and processing (paper content is sent to AI providers for generation)
  • Academic API providers — OpenAlex, Semantic Scholar, CrossRef, arXiv, and Unpaywall for research data retrieval

Each processor is bound by data processing agreements and is only permitted to process your data for the specific purposes described above.

6. AI Processing Disclosure

When you use the Service, your paper content (including configurations, requirements, and uploaded documents) is sent to third-party AI providers via OpenRouter for the purpose of generating text. This processing is essential to the core functionality of the Service.

Your content is not used to train AI models. It is processed solely to generate your paper and is subject to the data processing terms of our AI providers.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Paper content and associated data are retained for as long as your account exists, unless you request deletion. After account deletion, we may retain certain data as required by law or for legitimate business purposes (such as resolving disputes) for up to 7 years.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access — Request a copy of the personal data we hold about you
  • Right to rectification — Request correction of inaccurate or incomplete data
  • Right to erasure — Request deletion of your personal data
  • Right to data portability — Receive your data in a structured, machine-readable format
  • Right to restriction — Request restriction of processing in certain circumstances
  • Right to object — Object to processing based on legitimate interest
  • Right to withdraw consent — Where processing is based on consent, withdraw at any time
  • Right to lodge a complaint — File a complaint with the Liechtenstein Data Protection Authority (Datenschutzstelle) or any other competent supervisory authority

To exercise any of these rights, contact us at support@writemythesis.app. We will respond within 30 days.

9. International Transfers

Some of our third-party processors operate outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure adequate protection through appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions.

10. Cookies

We use minimal cookies necessary for the operation of the Service. These include session cookies for authentication (managed by Clerk). We do not currently use analytics cookies or third-party tracking cookies. If this changes, we will update this policy and obtain your consent where required.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security reviews.

12. Children

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

14. Contact

For questions about this Privacy Policy or to exercise your data protection rights, contact us at support@writemythesis.app.