Legal
Privacy Policy
Published 9/28/2026
Effective: 28 September 2026
Defacta Inc., 1007 N Orange St., 4th Floor, Suite 5722, Wilmington, DE 19801, New Castle, US
This Privacy Policy explains how Defacta Inc. ("Defacta", "we", "us", or "our") collects, uses, shares, and protects personal data when you use defacta.pro, the Defacta web platform, and the Defacta browser extension (together, the "service"). It also explains how we handle information about people who are mentioned in content analyzed with Defacta. Read it together with our Terms of Service and Cookie Policy.
Summary
- What we collect. Your account details, the content you submit for analysis, the reports we generate, payment status, and technical and security data. The browser extension sends page text to us only when you start an analysis.
- Why. To provide and secure the service, handle payments, answer you, and evaluate and improve the quality of our analysis.
- Who receives it. AI model, search, hosting, and other service providers that process data for us, listed in section 7. Anyone you give a share link to. We do not sell personal data, and we do not use it for advertising.
- AI training. We do not train AI models on your content. Sections 6 and 7 explain which AI and search providers process your content.
- Your choices. You can access, correct, delete, or export your data, object to some uses, and withdraw consent. Write to [email protected].
- People mentioned in content. If a report mentions you, section 5 explains what we process and how to ask for a correction or removal.
1. Who is responsible
Defacta Inc., a Delaware corporation, is the controller of the personal data described in this Policy.
- Contact: [email protected], or the postal address above.
We have not appointed a data protection officer. Contact [email protected] for all privacy matters.
2. Data we collect
Data you give us
- Account data. Your email address, name, and password (stored by our authentication provider in hashed form), or the basic profile that Google shares when you choose "Continue with Google" (name, email address, and profile ID).
- Sign-up information. Your answers to the sign-up questions, for example how you heard about us, your profession, and your intended use, and any message you add to a request for access. These answers are optional.
- Submitted content. Text you paste, links you submit, files you upload (PDF, DOCX, XLSX, and TXT), and text you send from the browser extension. The content can include personal data about you or about other people.
- Feedback and annotations. Ratings, comments, bias reports, and notes that you add to reports.
- Communications. Messages you send to us and our replies.
Data we create
- Reports. Analysis results, including extracted claims, verdicts, evidence snippets, source links, and scores. They are linked to your account.
- Account records. Your credit balance, credit transactions, product access, plan, and account status.
- Payment records. Purchase, subscription, invoice, and refund records that we receive from Stripe. Stripe collects your card details directly. We do not receive or store full card numbers.
Data we collect automatically
- Sign-in records. When you sign in or out, we record the time, your IP address, and your browser's user-agent string.
- Server and security logs. Our servers and security infrastructure receive your IP address, request details, and browser information. Our application logs replace submitted content, URLs, and email addresses with hashes. The web server's access logs contain your IP address, the requested page, and your user-agent string.
- Error and performance diagnostics. Error reports, a start-up message, and performance timing for a small sample of page loads. These go to our own error-monitoring service and can include the page address, browser and device information, the application version, error details, and in some cases part of the request that caused the error.
- Records of your cookie choices. See section 4 of our Cookie Policy.
- Browser extension records. See section 8.
What you must provide
You must give an email address to create an account, and you must submit content to get an analysis. Other information that you give us, such as sign-up answers and feedback, is optional. We also collect the data described under "Data we collect automatically" when you use the service, because we need it to run and secure the service. If you do not give the required data, we cannot provide the service.
Sensitive data
We do not ask for special categories of personal data, such as health data, political opinions, or religious beliefs, or for data about criminal convictions and offences. We also do not ask for financial account numbers or government ID numbers. Do not submit such data about yourself or others unless you have a lawful basis to do so. Content that you analyze, and the public sources we retrieve, can still contain such information about the people it mentions. Section 5 explains how we handle it.
3. How we use data and our legal bases
Where the GDPR, the UK GDPR, or similar laws apply, we rely on the legal bases in this table.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, sign you in, and provide the features you use | Account data, account records, sign-in records | Performance of our contract with you |
| Analyze the content you submit and generate, store, and display your reports | Submitted content, reports | Performance of our contract with you, for your own data. For data about other people, see the next row. |
| Process information about other people that appears in content you submit or in sources we retrieve (section 5) | Names, statements, and other information about people mentioned | Our legitimate interest, and yours, in checking the accuracy of information. For special categories and criminal-offence data, see section 5. |
| Share a report when you create a share link | Report content, your annotations | Performance of our contract with you |
| Take payments and manage credits and subscriptions | Payment records, account records | Performance of our contract with you; legal obligation (tax and accounting records) |
| Send service emails, such as access approval, sign-in links, and security notices | Email address, name | Performance of our contract with you |
| Review access requests and understand how people find us | Sign-up information | Our legitimate interest in managing access to the service during the beta and in understanding our audience |
| Keep the service secure, prevent abuse and fraud, and investigate incidents | Sign-in records, logs, security data | Our legitimate interest in protecting the service and its users |
| Find and fix errors | Diagnostics, logs, AI processing traces | Our legitimate interest in running a reliable service |
| Evaluate and improve the quality of website analyses (section 6) | Submitted content, reports, feedback | Our legitimate interest in providing accurate analysis |
| Produce aggregate usage statistics | Account records, extension run records | Our legitimate interest in understanding how the service is used |
| Optional extension product analytics | Product events (section 8) | Your consent |
| Record and honor your cookie choices | Cookie choice records | Our legitimate interest in complying with the law and demonstrating compliance |
| Comply with the law and respond to lawful requests, and establish or defend legal claims | Any relevant data | Legal obligation; our legitimate interest in protecting our rights |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this balance.
Your right to object. Where we process your data on the basis of legitimate interests, you can object at any time for reasons related to your situation. If you object to the use of your analyses for quality evaluation, we stop that use. Write to [email protected].
4. Automated decisions
Defacta does not make decisions about you that have legal effects or similarly significant effects on you based solely on automated processing.
Reports are probabilistic, AI-generated assessments of content. They can be wrong, including about named people. Do not use a Defacta report, and especially a score for "AI-written text", as the only basis for a decision about a person, such as a decision about a student, an employee, or an author. If you use reports to make decisions about people, you are responsible for human review and for complying with the laws that apply to you.
5. People mentioned in analyzed content
This section is for people who are named or described in content that our users analyze, or in sources we retrieve during an analysis.
- Sources. Content that our users submit, and publicly accessible sources that we retrieve to check claims: web search results, web pages, and public reference works such as Wikipedia.
- Categories of data. Names, roles, public statements, claims made by or about a person, and other information that appears in the content or the sources. This can include information about political opinions or alleged offences if it appears there.
- Purpose. To check the claims in the content and to show evidence for and against them. We do not build profiles of individuals, and we do not sell this information.
- Legal basis. Our legitimate interest, and our users' interest, in checking the accuracy of information that is published or circulated, which supports freedom of expression and information (Art. 6(1)(f) GDPR). Our contract with the user who submits content is not, by itself, a legal basis for processing data about you.
- Special categories and criminal-offence data. Content and sources can mention, for example, a person's political opinions, health, or alleged offences. We process such information only as part of analyzing that content, and only where applicable law allows it: in particular, where the person has manifestly made the information public, or where national law permits the processing for purposes of freedom of expression and information. If you tell us that we process such information about you without a valid basis, we restrict or delete it.
- Recipients. Our service providers (section 7) and, if a user shares a report, people who have the share link. We ask search engines not to index shared report pages.
- Retention. As long as the report exists (section 10).
- Your rights. You do not need a Defacta account to exercise your rights. You can ask us for access to information about you, or ask us to correct, delete, or restrict it, or object to its processing, for example if a report is inaccurate about you. Write to [email protected], with the report link if you have it. If your request is valid, we correct, restrict, or delete the information as the law requires, for example by correcting or removing the report or disabling its share link, and we inform recipients where the law requires it. While we check whether information is accurate, you can ask us to restrict its use. If we refuse a request, we explain why and tell you how you can complain.
Where giving this information to each person individually is impossible or would involve disproportionate effort, for example because we cannot identify the people mentioned in content before it is analyzed and usually have no contact details, we rely on the exception in Art. 14(5)(b) GDPR and publish this notice as one of our safeguards. Where we can reasonably give the information individually, for example when you contact us, we do so.
6. AI processing and quality evaluation
How analysis works. To generate a report, we send your content, and questions derived from it, to AI models and search services operated by our service providers (section 7). Search queries can contain names and other details from your content. We also fetch web pages from the links you submit and from search results.
Training. We do not train AI models on your content.
AI processing traces. To find errors, we record the inputs and outputs of AI processing steps for analyses on the website with our tracing provider, LangChain (LangSmith). These traces can contain your submitted content and report results. They are kept for 14 days, and only authorized team members can see them.
Quality evaluation. During the beta, website analyses by accounts that joined through open beta sign-up can be used for quality evaluation. Analyses made with the browser extension are not used. We can select a completed analysis, keep a copy of its AI processing steps, and run the same steps again with other AI models from the providers listed in section 7. AI models and our team then compare and score the results. We use this only to choose models and improve our analysis, including where the analyzed content contains information about other people. We do not publish these copies, and we delete them when the report is deleted. If you object (section 3), we stop selecting your analyses and delete the evaluation copies already made from them, unless we need them to establish or defend legal claims.
Who at Defacta can see your content. Our team members, including individual contractors, work for Defacta under written confidentiality and data protection obligations. Authorized team members can access submitted content, reports, uploaded files, and processing traces when this is necessary to provide support you ask for, to investigate errors, security incidents, or abuse, to perform quality evaluation as described above, or to comply with the law. Access is limited by role, and access to stored content through our administration tools is logged. Section 8 sets stricter rules for data from the browser extension.
AI-generated content. Reports are generated with AI.
7. Who we share data with
Service providers
Service providers process personal data for us under contracts that limit their use of it. Our main providers are:
| Provider | Purpose | Data they receive | Location |
|---|---|---|---|
| OpenRouter | Access to AI models | Submitted content, derived prompts, uploaded file text | United States |
| AI model providers reached through OpenRouter: models from OpenAI, Anthropic, Google, and Mistral AI, which OpenRouter routes to these companies or to the cloud companies that host their models | AI analysis, embeddings of uploaded files, and quality evaluation | Submitted content and derived prompts | United States; EU |
| Cerebras | AI analysis | Submitted content and derived prompts | United States |
| Perplexity, Brave, Wikimedia | Web search and reference lookups | Search queries derived from your content | United States |
| The True Story (Detectum Europe GmbH) | News search | Search queries and claims derived from your content | Germany |
| Tavily, Browserless | Reading web pages; rendering PDF exports | Source URLs and your submitted URLs; the report content of PDF exports | United States |
| LangChain (LangSmith) | AI processing traces | Submitted content, prompts, and results | United States |
| Supabase | Authentication, database, and file storage | Account data and all stored service data, including submitted content, reports, and uploaded files | Germany (Frankfurt) |
| Cloudflare | Content delivery, security, and bot protection (Turnstile) | IP address and request data | Global network |
| Amazon Web Services (AWS Lightsail) | Server hosting, including our own error monitoring and logs | All data processed by our servers | Germany (Frankfurt) |
| Stripe | Payments | Payment details that you enter on Stripe's checkout page; opaque account and purchase identifiers from us | United States, Ireland |
| "Continue with Google" sign-in | Sign-in request | United States | |
| Proton | Service emails | Email address, name, message content | Switzerland |
Stripe and Google also act as independent controllers on their own websites and under their own privacy policies.
Other recipients
- People with a share link. When you share a report, anyone with the link can see it. The original text that you submitted is shown only if you choose to include it. If you add annotations, your display name is shown with them; if you have not set a display name, your email address is shown. You can disable a link at any time. Disabling a link does not remove copies that people have already downloaded or saved.
- Legal and safety. Authorities, courts, or other parties where the law requires it, or where it is necessary to protect the rights, safety, or security of users, the public, or Defacta.
- Business transfers. A buyer, investor, or successor in a merger, financing, acquisition, or sale of assets, under obligations to protect the data as this Policy describes. We transfer data received through the browser extension in a merger, acquisition, or sale of assets only after asking for your explicit consent, and not in a financing.
We do not sell personal data, and we do not share it for cross-context behavioral advertising or targeted advertising.
8. Browser extension
The browser extension sends page text to us only when you start an analysis, for example with the "Defacta it" button, the toolbar button, the context menu, a keyboard shortcut, or "Analyze article". If you give the extension optional access to all websites, it detects text selections, readable articles, and supported social posts on the page so that it can show the analysis button. It does this on your device and does not send page content to us until you start an analysis.
When you start an analysis, the extension sends the selected text, article text, or post text (up to a fixed length limit), the page URL without its query string, the page title, the publication date and language detected on the page, and technical context such as the extension version, browser version, and platform. For a social post, the post link can identify its author.
- Server records. We keep a record of each extension analysis for 90 days: the website domain, a hash of the URL, the text length, technical context, status, and credit use. It does not contain the text. Temporary processing data, including the text, is deleted from our servers within one hour. If you choose "Open in defacta.pro", the text is kept for up to 10 minutes so that the website can open it.
- Diagnostic copies. Only if you explicitly agree for your account, for example to help us investigate a problem you reported, we can keep copies of the requests and responses exchanged with AI providers, including the text you analyzed, for a limited period. Each copy is deleted within 24 hours. Only team members with a separate diagnostic permission can open them.
- Cloud history. Where available, if you turn on cloud history, we store the full text, source, and results of your extension analyses until you delete them or your account. You can delete individual records and export your history in the extension.
- Local history and storage. See section 6 of our Cookie Policy.
- Optional product analytics. Off by default. If you turn on "Help improve Defacta", we record a fixed list of interface actions, linked to your account, and keep them for 90 days. They do not contain the text you analyze or your reports. Authorized team members can see individual events. See section 6 of our Cookie Policy for details and how to withdraw consent.
We use extension data only to provide, secure, and improve the extension's analysis features. We do not sell it, use it for advertising, or use it to determine creditworthiness. Our team does not read extension data unless you have explicitly agreed to it for that data, it is necessary for security purposes such as investigating abuse, it is necessary to comply with the law, or the data is aggregated and anonymized for internal operations.
Defacta's use of information received through the browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
9. International transfers
We store our main databases and files in Germany (section 7). Defacta Inc. is based in the United States. Our team, including contractors, works from Israel and the European Union and accesses personal data from there when this is necessary for the purposes in section 3. Some of our service providers process data in the United States and in the other countries listed in section 7. The laws in these countries can give a different level of protection than the laws where you live.
When our team accesses personal data from Israel, we rely on the European Commission's adequacy decision for Israel and on the corresponding recognitions of the United Kingdom and Switzerland. For other recipients, we use the safeguards described below.
When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we use safeguards that the law recognizes: the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, or the European Commission's Standard Contractual Clauses with the UK Addendum where required. You can ask us for a copy of the relevant safeguards at [email protected].
10. How long we keep data
| Data | How long we keep it |
|---|---|
| Account data and account records (except payment and credit records) | While your account exists. We delete them when we delete your account. |
| Reports, submitted content, and related processing records | Until you ask us to delete them, or we delete your account. Analyses that are not saved to your report library are deleted about 2 hours after they finish. |
| Uploaded files | Until you delete them, or we delete your account. |
| Share links | Until you disable them, or the report is deleted. |
| Quality-evaluation copies | Until the related report is deleted. |
| Cached public web pages | Up to 30 days. These copies of public pages are shared between analyses and are not linked to your account. |
| Sign-in records | While your account exists. |
| Sign-up information and access requests | While your account exists. If we do not approve a request, we are introducing a limit of 12 months after our decision; until it is in place, you can ask us to delete the request at any time. |
| Payment records | As long as tax and accounting law requires, also after we delete your account (legal obligation). |
| Credit and usage-limit records | After we delete your account, to prevent repeated use of free credits (our legitimate interest in preventing abuse). We are introducing a limit of 12 months after the account is deleted; until it is in place, older records are kept. |
| Cached claim-check results (claims and evidence snippets, used so that the same check does not run twice) | We are introducing a limit of 30 days and deletion with your account; until it is in place, these results are not deleted automatically. |
| Processing files on our servers (search results and intermediate outputs of an analysis) | Not yet deleted automatically. We are removing these files from our processing and will delete the existing ones. |
| Extension diagnostic copies | Up to 24 hours, and only if you agreed to them. |
| Service email records | While your account exists. |
| Extension run records | 90 days. |
| Extension cloud history | Until you delete it, or we delete your account. |
| Extension product analytics events | 90 days. |
| Cookie choice records | 90 days. |
| AI processing traces | 14 days. |
| Error reports | 90 days. |
| Server and security logs | 14 days in our central log system. Log files on the server are overwritten when they reach a size limit. |
When you ask us to delete your account, we delete your account, reports, uploaded files, and history from our database and file storage without undue delay. We keep only the records listed in the table above with a longer period, for the purposes stated there. Copies held by our service providers are deleted under their retention periods shown above.
11. Your rights
Depending on where you live, you can have the right to:
- access your personal data and get a copy of it;
- correct inaccurate data;
- delete your data;
- restrict our processing;
- object to processing based on legitimate interests (see the box in section 3);
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing before the withdrawal;
- not be subject to decisions based solely on automated processing with legal or similarly significant effects;
- complain to a data protection authority.
How to exercise your rights. You can change your name on your account page and download individual reports from the service. For all other requests, including account deletion and a copy of your data, write to [email protected]. If you have an account, write from its email address where you can. You can also make a request without an account, or if you no longer have access to that email address. We may ask you to confirm your identity in a way that is proportionate to the request. We answer within one month, or within the period the law sets for you. If a request is complex, we can extend this period as the law allows and tell you why. We do not charge a fee unless a request is clearly unfounded or excessive.
Complaints. You can complain to us at [email protected]. We acknowledge a complaint within 30 days, investigate it without undue delay, keep you informed, and tell you the outcome. Complaining to us does not limit your right to complain to the data protection authority where you live or work, at any time. In the UK, this is the Information Commissioner's Office.
United States. We handle requests from users in the United States in the way this section describes, whether or not a state privacy law applies to us. If you are a resident of a US state with a consumer privacy law, you can also appeal our answer to your request by writing to [email protected] with the subject "Appeal". An authorized agent can make a request for you if we can verify their authority and your identity. We will not discriminate against you for exercising your rights.
- Sale and sharing. We do not sell personal data or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly process the data of people under 16 for these purposes.
- Global Privacy Control and Do Not Track. We do not track you across other companies' websites or services, so there is nothing for these signals to turn off. We treat a Global Privacy Control signal as a valid request to opt out of any sale or sharing.
Israel. You have the right to access your data and to ask us to correct or delete data that is not correct, complete, clear, or up to date. When Israeli law applies to a transfer of personal data abroad, we transfer it in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001: for example, to countries that receive data from the European Union on the same terms, or to recipients that have given the written undertakings those regulations require.
12. Security
We protect personal data with technical and organizational measures, including encryption in transit, role-based access controls, logging of team access to stored content, and hashing of content in our application logs. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities where the law requires.
13. Cookies
We use browser storage and a small number of security cookies, as described in our Cookie Policy. We do not use advertising cookies.
14. Children
Defacta is not intended for anyone under 18, and you must be 18 or older to create an account. We do not knowingly collect personal data from children. If you think that a person under 18 has created an account, write to [email protected] and we will delete the account and its data.
Content that adult users analyze can mention children. We process that information only as part of the analysis, as described in section 5. A parent or guardian can exercise the rights in section 5 on a child's behalf.
15. Changes to this Policy
We may update this Policy when our service or the law changes. We will show the new effective date at the top. We will notify registered users of material changes by email or in the service, with at least 30 days' notice where reasonably practicable. An update is not, by itself, consent to a new optional purpose. Where new consent is required, we will ask for it first.
16. Contact
For privacy questions and requests: [email protected]
Defacta Inc., 1007 N Orange St., 4th Floor, Suite 5722, Wilmington, DE 19801, New Castle, US