Privacy policy

Who we are

Readable (readable.md) is run by Plant Powered IT, the Netherlands. We are the controller of the personal data described in this privacy policy. Questions, requests and complaints: contact@readable.md.

What we collect and why

• Account: your email address, name, password (stored only as a hash) or your Google sign-in, and your plan. We need these to run your account (contract).
• Your texts: what you paste, the web pages you link and the PDFs you upload, and the results. We process them to run the tool you picked (contract) and keep them in your history until you delete them.
• Saved passages: passages we already checked for you, per tool and setting, so running the same text again is instant and costs no model call. They are yours and go when you delete your account.
• Voice profile, if you build one: a short description of how you write. The samples you paste go to our AI model providers once to write it and are not stored.
• Usage: how many pages each run used, from the app, the API, the MCP server or the command line, to count your plan's pages (contract).
• API keys: a name, the first characters and a one-way hash. We never store the key itself.
• Billing: our payment processor handles your card; we keep your customer and subscription ids, plan and renewal date (contract and our legal duty to keep records).
• Email: a log of what we sent you (template, subject, delivery status), never the message body. Usage and product email only with a confirmed address, and you can turn it off (legitimate interest).
• Security: sessions (IP address, browser), sign-in and signup attempts per IP address to stop abuse, and server logs (legitimate interest).
• Analytics: which pages you view and which features you use, without the text you work on, query strings or document ids. Advertising features are off (legitimate interest; see Cookies).

Your texts

We use your texts only to give you the result. We do not sell them, use them for advertising or train models on them. They go to our AI model providers for that one run; those providers process them on our instructions, under terms that do not allow them to train on your content, and may keep them for a short time to detect abuse.

A result has a private link. Anyone you give that link to can open it, so share it with care. Do not paste secrets you would not want stored in your history.

Who processes data for us

We use processors under data processing agreements, each only for its task:

• Hosting and delivery (network, servers, logs).
• Database, where your account, history and saved passages are stored.
• AI model providers that judge and rewrite text.
• Payments.
• Email delivery.
• Web analytics.
• Google sign-in, if you choose it, and web fonts loaded from Google.

Some of these are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Ask us for the current list of processors.

How long we keep it

• Your account, history, saved passages, voice profile and API keys: until you delete them or your account.
• Sessions: until they expire or you sign out.
• Email log: while your account exists.
• Invoices and payment records: 7 years, as Dutch tax law requires, held by our payment processor.

Your rights

You can see, correct, download and delete your data, object to processing based on legitimate interest, restrict processing and take your data elsewhere.

• Download: Account → Your data → Download my data gives you everything we keep about you as one file.
• Delete: Account → Your data → Delete my account removes your account, history, saved passages, voice profile and API keys at once.
• Anything else: email contact@readable.md. We answer within one month.

You can also complain to the Dutch data protection authority (Autoriteit Persoonsgegevens) or the one where you live.

Cookies

We set a sign-in cookie so you stay signed in, and remember your light or dark theme in your browser. Analytics uses its own cookies to count visits; it keeps no advertising profile and your texts never reach it.

Changes

When this policy changes in a way that matters, we email account holders before it takes effect. The date at the top shows the latest version.