Privacy Policy

Summary

Who we are

Divrite (divrite.ai) is operated by Divrite, an individual operator (not a company). In this policy, “Divrite”, “we”, “us” and “our” refer to that operator.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, we are the controller of the personal data described in this policy. You can reach us about any privacy matter at [email protected].

Where the law requires us to appoint a representative in the European Union or the United Kingdom, we will list the representative’s contact details here.

This policy covers the Divrite website, the Divrite web application, shared work pages, and emails we send. It does not cover third-party websites that our research results link to.

Data we collect

Data you give us

• Account data. Your email address and the sign-in method you use (an emailed sign-in link, or Google). If you sign in with Google, we also receive your name and profile picture. We do not use passwords.
• Your content. The questions and instructions you type, the files you upload as source material (for example documents, spreadsheets and images), the edits you make, and everything we generate for you: research notes, reports, presentations, web pages, images, and the sources they cite.
• Topic subscriptions. The topics you follow, your schedule, and the briefings delivered to you.
• Support and feedback. Messages you send us and any information you include in them.

Data created when you use Divrite

• Usage and billing records. Your plan, credit balance, credit transactions, tasks started and completed, exports and share links.
• Technical and log data. IP address, browser and device type, operating system, language, pages and features used, timestamps, error reports, and security events such as sign-in attempts. We use these to keep the service running, prevent abuse and fix problems.
• Local storage on your device. A small amount of data stored in your browser to keep you signed in and remember your theme and language. See our Cookie Policy.

Data from third parties

• Payment provider. Our payment provider, Waffo, acts as the Merchant of Record: it is the seller of record for your purchase and processes your payment details under its own privacy policy. It shares limited information with us, such as your customer reference, plan, billing country, transaction amount, status, and the last four digits and brand of your card where provided. We do not receive or store full card numbers.
• Google, if you choose to sign in with Google (see Signing in with Google).

We do not intentionally collect special-category data (for example health, religion or biometric data). Please avoid including such data about yourself or others in your prompts or uploads unless it is necessary for your research.

How we use data and why

Under the GDPR and UK GDPR we must have a legal basis for each use of personal data. The table below sets out what we do and on which basis.

Where we rely on legitimate interests, we have weighed those interests against your rights. You can object at any time (see Your rights).

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated checks may flag suspected abuse, but a person reviews any decision to suspend an account.

AI processing and your content

• How it works. To answer a question, Divrite sends your prompt, relevant parts of your uploaded files, and intermediate research notes to AI model providers, and sends search queries derived from your question to web search providers. The results come back to us and are stored in your account.
• No training on your content. We do not use your prompts, uploads or outputs to train AI models. We choose AI providers and settings that do not use API data for model training, and where a provider offers such a commitment by contract we rely on it.
• Search queries are public-web queries. Search providers receive the query text, not your name or email address. Avoid putting confidential details in a question if you do not want them to appear in search queries.
• Human review. We do not routinely read your content. Authorised personnel may access it only when you ask us to (for example in a support request), to investigate abuse or a security issue, or when the law requires it.
• Sharing is your choice. Your work is private by default. It becomes visible to others only if you create a share link or choose to publish it. You can revoke a share link at any time. We will not feature your work in our public gallery without your permission.
• Accuracy. AI-generated content can be wrong or incomplete. If an output contains inaccurate personal data about someone, contact us and we will help correct or remove it.

Who we share data with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only with the following categories of recipients, and only as needed for the purposes above:

Service providers that process personal data on our behalf (processors) are bound by written data processing terms and may use the data only to provide their service to us. The payment provider acts as an independent controller for the payment data it collects. A current list of our sub-processors is available on request from [email protected].

We may also disclose data where required by law or a valid legal request, to protect the rights, safety or property of our users, ourselves or others, or as part of a transfer of the Divrite business. In the case of a business transfer we will tell you before your data becomes subject to a different privacy policy.

International transfers

Our service providers may process data in countries outside the European Economic Area (EEA), the United Kingdom and your own country, including the United States, Singapore and the People’s Republic of China. When we transfer personal data from the EEA or the UK to a country that has not been found to provide an adequate level of protection, we use safeguards recognised by law, such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, or rely on an adequacy decision or certification framework where one applies. You can ask for a copy of the relevant safeguards at [email protected].

How long we keep data

When data is no longer needed, we delete it or anonymise it so it can no longer identify you.

Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• Data portability: receive your data in a structured, machine-readable format and have it sent to another provider;
• Withdraw consent at any time, where we rely on consent, without affecting earlier processing;
• Lodge a complaint with your local data protection authority, or in the UK with the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.

How to exercise your rights

• In the product: you can download your works, delete individual works, and delete your account from your account settings.
• By email: write to [email protected] from the email address on your account. If you write from another address, we may need to verify your identity before acting.

We respond within one month. If a request is complex, we may extend this by up to two further months and will tell you why. Requests are free unless they are manifestly unfounded or excessive.

US state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access and delete it; to correct inaccurate information; and to opt out of the sale or sharing of personal information and of targeted advertising. You also have the right not to receive discriminatory treatment for exercising these rights.

• Categories collected in the last 12 months: identifiers (email address, IP address), commercial information (plans and purchases), internet or other electronic network activity (usage and log data), and the content you provide. Sources and purposes are described above.
• Sale and sharing: we do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the last 12 months.
• Sensitive personal information: we do not use or disclose it for purposes that would give rise to a right to limit its use.
• Authorised agents: you may use an authorised agent to submit a request on your behalf. We may ask the agent for proof of authorisation and verify your identity directly.

To make a request, email [email protected]. If we deny a request, you may appeal by replying to our decision; we will respond to appeals as required by applicable law.

Signing in with Google

If you sign in with Google, we request only your basic profile information: your email address, name and profile picture. We use this information solely to create and identify your Divrite account and to sign you in. We do not request access to your Gmail, Google Drive, Calendar or other Google data.

Divrite’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertisements, do not sell it, do not transfer it to others except as necessary to provide the service or comply with law, and do not use it to train AI models. You can remove Divrite’s access at any time from your Google Account permissions page.

Security

We protect data with measures appropriate to the risk, including encryption in transit (HTTPS), encryption at rest offered by our hosting provider, access controls and logging for administrative access, separation of each user’s data within our systems, and passwordless sign-in links that expire after a short time and can be used once. No system is perfectly secure. If we become aware of a personal data breach that is likely to put you at risk, we will notify you and the relevant authorities as the law requires.

Children

Divrite is not intended for children. You must be at least 16 years old to use it, and if you are under the age of majority where you live, you need the consent of a parent or guardian to subscribe. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact [email protected] and we will delete it.

Changes to this policy

We may update this policy as the service or the law changes. The “Last updated” date at the top shows when it was last revised. If we make material changes, we will tell you by email or with a notice in the product at least 14 days before they take effect, unless the change is required sooner by law. Earlier versions are available on request.

Contact

Privacy questions and requests: [email protected]
General support: [email protected]