Privacy Policy
This is a translation for convenience. The German version is legally binding.
This privacy policy applies to both the marketing website (plagiatgpt.com) and the application (app.plagiatgpt.com).
1. Data protection at a glance
General information
The following notes provide a simple overview of what happens to your personal data when you visit this website or use the app. Personal data is any data with which you can be personally identified.
Data collection on this website and in the app
Who is responsible for data collection?
Data processing is carried out by the website operator. You can find their contact details in the "Imprint" section.
How do we collect your data?
Your data is collected, on the one hand, by you providing it to us – for example when registering, uploading a text, contacting us by email, or booking a plan. Other data is collected automatically when you visit or use our services by our IT systems (e.g. browser, operating system, time of the page view, IP address).
What do we use your data for?
Part of the data is collected to ensure the website and app are provided without errors. Other data may be used for contract performance, security, or - with your consent - to analyse your user behaviour.
2. Controller and supervisory authority
Simon Schmidlin - PlagiatGPTBorkumstraße 8 · 13189 Berlin
Email: [email protected]
No data protection officer has been appointed: the thresholds under § 38(1) BDSG (at least 20 people permanently engaged in automated processing) are not met, nor does a case under Art. 37(1) GDPR apply. The controller at the address above is the contact point for data protection questions.
The competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Alt-Moabit 59-61, 10555 Berlin.
3. Hosting and infrastructure
The website and app are hosted exclusively on servers in Germany (EU): the application (app, AI analysis, database) runs on a self-managed server at Hetzner Online GmbH (Germany); the marketing website is hosted at ALL-INKL.COM. Our hosting infrastructure (app, AI analysis, database, and website) uses no US cloud services (no AWS, Azure, Google Cloud). Certain separately identified additional features may, however, involve a transfer to the USA — in particular Sign in with Google (section 6) and Cloudflare Turnstile bot protection (section 8); the applicable legal basis and supplementary safeguards (DPF/SCC) are stated there. We have data processing agreements under Art. 28 GDPR with our hosting providers. All connections are TLS/SSL-encrypted; stored content is additionally encrypted with AES-256.
4. Server log files and IP address
Every time the website or app is accessed, the web server or reverse proxy processes technically necessary data, in particular the IP address; this is deleted after approximately 7 days. In the app, the IP address is additionally used for abuse prevention and rate limiting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and stability).
5. Cookies and access to your device
Website: No cookies are set. The visit statistics (Umami, see section 13) likewise set no cookies and do not access device storage - § 25 TDDDG therefore does not apply. No external fonts, CDN, or third-party embeds are used; the only off-origin connection is our own Umami server.
App: Only a technically necessary session cookie is set (__Secure-better-auth.session_token, HTTPS only), which is strictly required for sign-in; consent under § 25(2) TDDDG is therefore not required. For voluntary usage statistics (PostHog, see section 13), a localStorage key is used to store your cookie consent - this constitutes access to device storage under § 25(1) TDDDG, for which your consent is required. Consent is obtained via a cookie banner on your first visit and can be withdrawn at any time.
The visit statistics (Umami, see section 13) are also used in the app. There, too, they set no cookies and do not access device storage - § 25 TDDDG therefore does not apply - and they are separate from the consent-based usage statistics (PostHog).
6. Registration, sign-in and two-factor authentication
During registration we collect an email address and password. The password is stored exclusively as a cryptographic hash (never in plaintext); the session duration is 7 days with sliding renewal. Two-factor authentication is optionally available via an email one-time code, including for users without a password (social login).
When you use "Sign in with Google", your email address and verified profile data are processed by Google (Google LLC, USA). This involves a transfer of data to the USA, safeguarded via the EU-U.S. Data Privacy Framework (DPF) and supplementary Standard Contractual Clauses (SCC).
Legal basis: performance of contract (Art. 6(1)(b) GDPR); for Google sign-in, additionally your consent (Art. 6(1)(a) GDPR).
7. Payment processing (Mollie)
Payments are processed via Mollie (Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands). Processing takes place exclusively within the EU/EEA; no transfer to a third country outside the EEA is involved. Data processed includes name, email address, and payment/transaction data; payment-instrument/card data is not stored by us.
Educational institutions are billed exclusively by invoice and bank transfer; no payment service provider is involved.
Billing and invoicing records are retained for eight years to comply with tax-law retention obligations (§ 147(3) sentence 1 AO). Legal bases: Art. 6(1)(b), (c) and (f) GDPR.
8. Bot protection (Cloudflare Turnstile)
To protect sign-in and registration forms, we use Cloudflare Turnstile (Cloudflare, Inc., USA). This transmits your IP address and technical signals to Cloudflare; Turnstile sets no advertising cookies. The third-country transfer is based on the EU-U.S. Data Privacy Framework (DPF), to which Cloudflare is certified, and additionally on Standard Contractual Clauses (SCC). Legal basis: Art. 6(1)(f) GDPR (network security and abuse prevention).
Turnstile additionally protects the free Quick Analysis on the marketing website and its form for notifications about new languages. Here too, your IP address and technical signals are transmitted to Cloudflare; the text you enter is not sent to Cloudflare. Legal basis: Art. 6(1)(f) GDPR (abuse prevention, protection against automated bulk requests).
9. Transactional and system emails
System emails (registration confirmation, email verification, password reset, two-factor one-time codes, and account notifications) are sent via SMTP through our hosting and email provider ALL-INKL.COM – Neue Medien Münnich (owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; sender [email protected]). Your email address is processed on our behalf (Art. 28 GDPR) exclusively within Germany (EU); no transfer to third countries takes place. Legal basis: Art. 6(1)(b) and (f) GDPR.
10. Processing of text input
Texts you submit for analysis are processed exclusively on our own services within a private, non-publicly-reachable EU network. They are not used to train our models and are not passed on to third parties. Stored texts and titles are encrypted with AES-256-GCM (a technical and organisational measure under Art. 32 GDPR). If history is disabled for your account, results are only returned live and not stored permanently; without an account, texts are generally not stored permanently.
Anonymous Quick Analysis (without an account): A text submitted via the marketing website is held for at most 60 minutes in volatile working memory (Redis) on our own servers in Germany, solely to run the analysis, and is deleted automatically when the analysis picks it up or at the latest when that period expires. There is no permanent storage, no linkage to a user account, and no logging of the text content; the result is shown only as a coarse rating (level 1–10). Legal basis: Art. 6(1)(b) GDPR (performing the analysis you requested) and, additionally, Art. 6(1)(f) GDPR (legitimate interest in providing a free trial offering).
11. What account data we process
As part of your user account we process: email address, name, language setting, booked plan, an education-discount flag (if applicable), your subscription identifier (Mollie customer/subscription ID), and quota counters. The legal basis depends on the specific field: predominantly performance of contract (Art. 6(1)(b) GDPR), and in part legitimate interest or consent.
12. Newsletter
If you opt into our newsletter during registration, we send a confirmation email (double opt-in): the newsletter is only delivered once you click the confirmation link in that email. This ensures no one can sign up someone else's email address for the newsletter.
The same double opt-in applies if you sign up on the marketing website (e.g. after a Quick Analysis in a not-yet-supported language) for notifications about new languages, product news, and offers. We process your email address and chosen language; the subscription only takes effect once you click the confirmation link. Signing up requires that you are at least 16 years old. Legal basis: Art. 6(1)(a) GDPR (consent); withdrawal at any time as described below.
If the subscription is confirmed in connection with a verified account, the account is credited once with five Deep Analysis pages. The service is fully usable without a newsletter subscription; consent is therefore voluntary within the meaning of Art. 7(4) GDPR. The time and content of the consent, and its confirmation, are stored as evidence under Art. 7(1) GDPR and deleted three years after the subscription ends.
We use the email marketing service Brevo (Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris, France; data processed in the EU) to send it. Brevo processes your email address, chosen language, and account tier on our behalf (Art. 28 GDPR) on the basis of your consent (Art. 6(1)(a) GDPR). For more information on how Brevo handles user data, see Brevo's privacy policy.
You can withdraw your consent at any time via the unsubscribe link at the bottom of every newsletter email, or by contacting [email protected]. After withdrawal, we delete your data from the newsletter list unless a statutory retention obligation applies.
13. Usage statistics and analytics
Website and app visit statistics (Umami, no consent required)
On the marketing website and in the app we collect anonymised visit statistics using Umami, a privacy-friendly open-source web analytics tool operated on our own servers in Germany (EU). Website and app are kept in separate datasets and are not combined into a cross-domain history.
What is collected: page views, referring pages, country, and browser/device category. The IP address is used solely to compute a daily salted hash for unique-visitor counting and is immediately discarded afterwards. No raw personal data is stored, no cookies are set, and no persistent device fingerprinting is used - consent under § 25 TDDDG is therefore not required.
Additional restrictions in the app: there, Umami collects page views only. No events (e.g. scan started, subscription completed) and no account or user identifier are transmitted to Umami; such events remain exclusively within the consent-based usage statistics (PostHog). The query string and fragment of an address are stripped before transmission, so that neither confirmation or invitation tokens nor texts submitted for checking can reach the statistics. Your browser's "Do Not Track" setting is respected.
No third party: Umami is open source and self-hosted; there is no data processing agreement with a third party.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in optimising our website and app). Opt-out: you can prevent data collection by enabling "Do Not Track" in your browser or by disabling JavaScript.
App usage statistics (PostHog, consent required)
To improve the AI detector and for error tracking, we use PostHog in the app (PostHog Inc.; processing exclusively on EU servers, eu.posthog.com). PostHog is only activated with your explicit consent.
What is collected: page views, click events, errors, and custom events (e.g. scan started/completed, sign-in/sign-out, subscription events). Scan texts, email addresses, and other direct personal identifiers are not collected. Identification is based exclusively on your internal user ID; IP addresses are not stored under our PostHog EU configuration. Session replay is disabled.
Independently of this, we record certain events server-side without a cookie or device access (e.g. a feedback rating or activation of a paid subscription) - using only your internal user ID and the relevant value, with no scan texts and no email address. The legal basis for this is our legitimate interest (Art. 6(1)(f) GDPR) in product improvement and operational security; you can object to this processing at any time under Settings → Privacy (Art. 21 GDPR).
Legal basis (consent-based part): Art. 6(1)(a) GDPR, § 25(1) TDDDG. You can withdraw your consent at any time under Settings → Cookie Settings; after withdrawal, no further data is collected and your PostHog profile is deleted. We have a data processing agreement with PostHog under Art. 28 GDPR.
14. Retention periods at a glance
| Data type | Period | Basis |
|---|---|---|
| Server/IP logs | approx. 7 days | Art. 6(1)(f) |
| Billing/invoicing data | 8 years (§ 147(3) sentence 1 AO) | Art. 6(1)(c) |
| Transactional email logs | short-term (max. 30 days) | Art. 6(1)(f) |
| Scan results | until account deletion; not stored if history is disabled | Art. 6(1)(b) |
| Account data | for the contract term, then deleted subject to retention obligations | Art. 6(1)(b) |
| Proof of newsletter consent | 3 years after the subscription ends | Art. 6(1)(a) with Art. 7(1) |
| PostHog events (app) | per PostHog project settings | Art. 6(1)(a) |
| Umami visit data (website and app) | 12 months | Art. 6(1)(f) |
15. Your rights
You have the right at any time to:
- Information about your personal data stored by us (Art. 15 GDPR)
- Rectification of incorrect data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
On request, your personal data will be permanently deleted; excluded are data subject to statutory retention obligations (in particular billing/invoicing data, § 147(3) sentence 1 AO), which are retained in a blocked state until the retention period expires. Upon receipt of a deletion request for your account, the following are irrevocably deleted: user profile, sign-in credentials (password hash, OAuth tokens), two-factor secrets, all uploaded document contents, all scan results, all projects, and the subscription authorisation stored at the payment provider (Mollie customer record) - with the exception of billing events, which are retained for up to eight years under § 147(3) sentence 1 AO.
To do so, please contact: [email protected]
16. No automated decision-making in individual cases
No automated decision-making in individual cases, including profiling within the meaning of Art. 22(1) GDPR, takes place.
The analysis result is a statistical assessment of a text. It is shown to and evaluated by the person who requested it; the provider makes no decision about data subjects. The service builds no profile of the authors of submitted texts: it evaluates only the individual submitted document, does not combine multiple documents from the same person, and keeps no author-related history.
Users of the service are contractually required not to use the result as the sole basis for adverse decisions and to always carry out an independent human review. If a user nevertheless deploys the service as a sole decision-making system, they act as their own controller and must satisfy the requirements of Art. 22 GDPR themselves.
17. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information.
18. Order processing
For educational institutions and other controllers, we provide a data processing agreement (DPA, German: AVV) pursuant to Art. 28 GDPR. You can download the DPA including its annexes (TOMs - technical and organisational measures, sub-processors) and the German federal-state guidance for schools on our DPA page; please return the countersigned copy to [email protected].