Privacy Policy

The controller of your personal data is ToSpeca Ltd («we»). For anything about your data, write to support@tospeca.com with the subject «Data request».

The legal bases are those of the EU General Data Protection Regulation (GDPR, Art. 6(1)): contract — we need the data to provide the service you signed up for; legitimate interest — we need it for a purpose of ours that we weighed against your interests, and you may object; consent — you chose it and may withdraw it at any time.

• Account. Your e-mail address, your password (we never see it in plain text), the interface language, and which version of the Terms of Service you accepted and when. Accounts made before 20 October 2026 may also hold a name entered then; we do not use it. Basis: contract; the record of acceptance — our legitimate interest in showing what you agreed to.
• Projects. Your material (text and code), the project's title and target, your answers and decisions, the structure you chose, blocks of your own, accepted statements, frozen versions, the history of changes and your share links. Basis: contract.
• Records of AI work. For each AI step: the project, the step, the model, its usage and cost, the result and the model's answer, which may quote your material. A separate record of usage and cost per account keeps the daily limits. Basis: contract; the usage record — our legitimate interest in keeping limits and costs under control.
• Shared versions. The words a share link makes public and the result of their check (see Share links and moderation). Basis: our legitimate interest in not publishing unlawful or abusive content through the service.
• Feedback. If you answer one of our short questions (whether an explanation helped, a rating of the result, the «Feedback» link): your answer, the reasons you ticked, an optional text, the page, the project's beta group, the language and the time, linked to your account and project. Basis: our legitimate interest in improving the service; giving feedback is always optional.
• Waitlist. If you join the waitlist for a future feature: your e-mail address, the features you are interested in and, if you are signed in, your account. Basis: your consent.
• Security and technical data. Records of sign-ins and sessions (time, IP address, browser), request records kept by our hosting and network providers (IP address, time, page, browser), short-lived request counters that enforce limits, and reports of security errors on our pages (never your text). Basis: our legitimate interest in a secure and available service.
• Messages to us. Your e-mail address and what you write. Basis: our legitimate interest in answering you, and our legal obligations when you use your rights.

We do not ask for and do not want special categories of data (health, beliefs and the like) or financial account details. Please keep them out of your material.

To read your material and draft text, the service sends the parts of your project that a step needs to an AI provider: the project's title, your material or a part of it, your answers, quotes and the points already settled. The operator chooses the model for each step among OpenAI, Anthropic and OpenRouter (all in the USA); OpenRouter forwards a request to a model of another provider and is set to use only providers that do not collect data for their own purposes.

A provider does not receive your e-mail address. With each request it receives a pseudonymous identifier of your account, so that it can act on abuse by one person. We use the providers' business API services and ask them not to keep results where their service allows it; each provider still processes requests under its own terms, which may allow it to keep them for a limited time, for example to detect abuse. Basis: contract.

A share link lets anyone who has it read one frozen version, including the words of your material and answers it contains. Shared pages ask search engines not to index them. You can revoke a link at any time.

The words a share link makes public may be checked automatically by an external moderation service (OpenAI), without your e-mail address. Authorised staff may look at a shared version, its check result and the account it belongs to when the check or a report calls for it, and may revoke the link under the Terms of Service. The check result is deleted with the project.

We use some data to make the service better. You can object to the uses based on legitimate interest by writing to us.

• Term statistics. To improve the service, we use statistics of terms, which may keep a link to the project. Your source material as a whole is not included in these statistics. Across all accounts that accepted the Terms of Service, they count the short words and phrases of your answers about terms, the words the packet check calls unclear and the titles of blocks you add, with the number of projects that used each. You can object to this use; we then stop counting your projects. Basis: legitimate interest.
• Shared explanations. Some projects show short explanations of what each answer to a question would change. To make one, a model receives the point and its answer options, which may repeat words of your material. We review each explanation and remove anything personal before approving it; an approved one may be shown to other users with the same question, without any link to you or your project. Basis: contract (to show it to you) and legitimate interest (to reuse a checked explanation).
• Quality of the service. We read feedback, the results of AI steps and the version of the workspace a project uses to find and fix what does not work. Basis: legitimate interest.

Service providers process data for us under data-processing terms, each only for its task:

• Cloud hosting, database and sign-in — store and run the service, your account and projects; in the EU.
• Network and security — deliver the site and protect it from attacks; they handle every request, including your IP address; worldwide.
• E-mail delivery — sends account e-mails (address confirmation, invitation, password recovery); your e-mail address and the message.
• AI providers and moderation — OpenAI, Anthropic and OpenRouter, as described above; in the USA.

Others who may receive data: the people you share a link with; authorities, when the law requires us to disclose data; and a successor, if another company takes over the service, which we will tell you about first. We do not sell your personal data and do not share it for advertising.

Some providers are US companies, and the AI providers process data in the USA. Where personal data leaves the European Economic Area for a country without an adequacy decision, the transfer relies on the EU–US Data Privacy Framework where the recipient is certified under it, or on the European Commission's standard contractual clauses in the provider's data-processing terms. You can ask us for details of these safeguards.

• Account, usage records and sign-in records: until your account is deleted.
• Projects — with their AI records, share links, check results, feedback, beta group and unapproved explanations: until you delete the project or your account.
• Waitlist: until you ask to be removed or we tell you the feature is available; we also remove it when we delete your account.
• Term statistics: without a time limit; when we delete your account, we remove the entries of its projects. Approved explanations: without a time limit; they hold no link to you or your project.
• Request counters: kept only while they count requests; expired counters are deleted the next time the service checks a request limit.
• Request records of our hosting providers: up to 7 days. E-mail delivery records: up to 30 days. Our network and security provider keeps its own request records for a limited time under its terms.
• Messages to us: as long as we need to deal with the matter, and at most two years after it is closed.
• Backups: deleted data disappears from our encrypted backups within 28 days.

We keep data longer only where the law requires it or for a legal claim.

Under the GDPR you have the right to access your data and get a copy, to correct it, to have it deleted, to restrict its use, to receive the data you gave us in a machine-readable form (portability), to object to uses based on our legitimate interest, and to withdraw consent at any time without affecting what was done before.

How: you can delete a project yourself on the History page and download any frozen version as Markdown. For everything else — a copy of all your data, correction, deleting your account, an objection — write to support@tospeca.com with the subject «Data request» from your account's e-mail address (otherwise we may need to confirm that the account is yours). During the beta these requests are handled by hand, free of charge, within one month; if a request is complex we may extend this by two more months and tell you why.

You also have the right to lodge a complaint with a data-protection authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl; or the authority of the country where you live or work.

ToSpeca uses only cookies and browser storage that the service needs to work, so the site does not ask for cookie consent. If we ever add something that is not necessary, we will ask for your consent first.

• Sign-in — keeps you signed in, until you log out or the session ends.
• Language — the language you chose; 1 year.
• Workspace choices — for example, to be asked a project's technical points one by one; 30 days.
• Security — our network provider may set a strictly necessary cookie when it needs to check a request.
• Drafts on your device — the material you type before saving and an answer you are typing stay in your browser and reach us only when you save or send them.

You can delete cookies and site data in your browser; without the sign-in cookie you cannot stay signed in.

Other users cannot see your projects unless you share a version by link. Our staff and providers can reach data only as far as their task needs: for example, to run the service, answer your request, fix a fault or review a shared version. Connections to the site are encrypted, administration requires an extra sign-in step, and backups are encrypted. No system is completely secure; if a breach puts your data at risk, we will tell you without undue delay and, where the law requires it, notify the authority within 72 hours.

The service is for people aged 18 and over; we do not knowingly collect data of anyone younger. If you believe a child has given us data, write to us and we will delete it.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Limits apply automatically to everyone in the same way; what a model drafts is a proposal you accept or reject.

When we change this policy we publish the new version with its date, and we tell you about a material change by e-mail and in the service before it takes effect.