Privacy policy.

Introduction

Plagcheck.com (operated by System Technology Online Spain SL. and its US affiliate System Tech Online USA Inc., together “Plagcheck”, “we”, “our”, “us”) provides plagiarism and AI-content detection services. This policy describes how we handle personal data and document content when you use our products.

It applies to plagcheck.com, our APIs, integrations (Moodle, Google Workspace, Zapier, Telegram) and any other surface that links to this policy.

What we collect

We collect only what we need to run the service. Specifically:

Account data

• Name and email address you provide on signup (or via Google / Facebook OAuth).
• Organisation, role and country if you opt in for sales / institutional onboarding.
• Hashed password (we never see or store plain-text passwords).

Scan content

• The document or text you submit for a plagiarism or AI scan, for as long as the scan is processing.
• The resulting report (similarity score, AI-confidence, matched sources).
• Metadata: file name, file size, word count, scan duration.

Usage data

• IP address, browser, OS and approximate region (city-level) for security and abuse monitoring.
• Anonymised page-view events to improve product performance.

How we use data

We use the data above to:

1. Run the scan you asked for and return its report.
2. Maintain your account, your scan history (if you opt in to persistent storage) and your subscription.
3. Send transactional emails (receipts, password resets, scan completion). Marketing emails are sent only with opt-in consent and can be unsubscribed at any time.
4. Detect, prevent and respond to fraud, abuse, security incidents and breach of these terms.
5. Comply with our legal obligations under applicable laws (GDPR, CCPA, etc.).

We never use your submitted documents to train our models. Detection fingerprints are derived from public-domain corpora and known LLM outputs only.

Retention

Submitted documents are kept in volatile memory only for the duration of the scan and deleted within minutes of completion — unless you explicitly enable persistent storage on a Standard or Premium plan, in which case they remain in your workspace until you delete them.

Reports are stored for 30 days on the Light plan and indefinitely on Standard / Premium, until you delete them. Account data is kept until you close the account, plus a 30-day grace period for recovery, then permanently erased within 90 days.

Cookies & tracking

We use a small set of cookies and similar technologies:

• Essential — login session, CSRF protection, language preference. Cannot be disabled.
• Analytics — anonymised page-view counts to improve UX. You can opt out via the cookie banner.
• Marketing — only used if you consented via the banner. We do not run third-party ad networks on logged-in user pages.

See our separate cookie policy for the full list and durations.

Sharing with third parties

We share data with sub-processors only as needed to deliver the service. Each is bound by a data-processing agreement that mirrors the protections in this policy.

• Cloud hosting (AWS, eu-west-1 by default; us-east-1 if your account region is North America).
• Email transactional provider (Postmark).
• Payment processor (Stripe).
• Customer-support helpdesk (Zendesk), opt-in only.

We do not sell personal data. We disclose data to law enforcement only on a valid legal order and, where lawful, notify the affected user first.

Your rights

Under GDPR, CCPA and equivalent laws you have the right to:

• Access the personal data we hold about you.
• Rectify inaccuracies in your account information.
• Erase your account and all linked content (right to be forgotten).
• Restrict or object to certain processing.
• Port your data to another service in a machine-readable format.
• Lodge a complaint with your local supervisory authority.

Email [email protected] to exercise any of these. We respond within 30 days.

Security

Documents are encrypted in transit (TLS 1.3) and at rest (AES-256). Production access is restricted to a small on-call team via SSO with hardware-key 2FA. We run quarterly penetration tests by an independent firm and publish an annual transparency report at plagcheck.com/security.

Children’s privacy

Plagcheck is intended for users aged 13 and above. We do not knowingly collect personal data from anyone under 13. For users 13–18, a parent or guardian must consent to the terms before account creation. If you believe we have collected data from someone under 13, write to [email protected] and we will erase it.

International transfers

Your data is stored in the EU by default (Spain / Ireland AWS regions). If your account region is North America, it is stored in the US (Virginia). Cross-region transfers, when required, rely on Standard Contractual Clauses approved by the European Commission and the UK ICO.

Changes to this policy

We may update this policy as the service evolves. Material changes will be announced by email to registered users at least 30 days before they take effect, and the “Last updated” date at the top of this page will reflect the change.

Contact

For privacy questions, data-subject requests, or to reach our Data Protection Officer:

• Email: [email protected]
• Postal: System Technology Online Spain SL., Calle Pintor Pérez Gil 2, b.46, 03540 Alicante, Spain
• US affiliate: System Tech Online USA Inc., 5900 Balcones Dr. Ste 100, Austin, TX 78731, USA