Privacy Policy

1. Who we are

Essay Lab operates at essaylab.ai. We are the data controller for the personal data we collect from you. If you have questions about this policy, contact us at support@essaylab.ai.

2. What data we collect

We collect the following categories of data:

• Account data: your email address and name when you create an account
• Essay content: the personal statement text you submit for review
• Usage data: pages visited, features used, and timestamps — collected via standard server logs and analytics
• Payment data: none. Reviews are free, we take no payment through this site and we never ask for card details

3. How we use your data

We use your data to:

• Process your submitted essay and return AI-generated feedback
• Manage your account
• Send transactional emails (confirmation, report delivery)
• Improve our service through aggregated, anonymised analytics

We do not sell your data to third parties, and we do not train any model of our own on your essays. Generating your report does require sending the text to the AI providers listed below, and what they do with API traffic is governed by their own terms rather than ours — so we do not make promises on their behalf.

4. Essay content retention

Your submitted essay text is processed to generate your report and then stored only as part of your saved report in your dashboard. You can delete your report and associated essay content at any time from your account. If you delete your account, all associated essay data is permanently removed within 30 days.

5. Legal basis for processing (UK/EU users)

Where applicable under UK GDPR or EU GDPR, we process your data on the following bases:

• Contract performance: processing your essay and managing your account
• Legitimate interests: service analytics and fraud prevention
• Consent: any optional marketing communications (you can opt out at any time)

6. Third-party services

We use the following third-party services that may process your data:

• Supabase: account authentication and data storage
• DeepSeek and Anthropic: AI model inference. The text of your personal statement is sent to these providers’ APIs to generate your report. DeepSeek is operated by a company based in China, so this involves a transfer of that text outside the UK and EEA. We do not send your name, email or account details with it. Each provider handles that text under its own terms, which we cannot vary
• MailerLite: email marketing, newsletter management, and email automations
• Google AdSense: advertising on the writing guides, where enabled

Each provider operates under its own privacy policy and data processing agreements.

7. Email marketing and lead magnets

If you sign up to receive a free resource, checklist, guide, newsletter, or other downloadable material, we collect your email address and any other details you provide through the signup form.

We use this information to:

• send you the requested resource;
• send occasional emails about personal statements, university applications, Essay Lab updates, and related educational content;
• manage our email list and understand basic email engagement, such as opens, clicks, and unsubscribes.

We rely on your consent for optional marketing communications. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us at support@essaylab.ai.

We use MailerLite to manage email signups, landing pages, email automations, and marketing emails. MailerLite may process your email address and related engagement data on our behalf, subject to its own privacy policy and data processing terms.

We do not sell your email address or share it with third parties for their own marketing.

8. Google User Data

Essay Lab uses Google Sign-In (via Supabase) as an optional authentication method. When you sign in with Google, we receive and use the following data from your Google account:

• Email address — used as your account identifier
• Display name — used to pre-fill your onboarding profile; you can edit or delete it at any time

No other Google account data is accessed. We do not access your Google Drive, Gmail, Calendar, Contacts, or any other Google service.

Data usage: Your email and display name are used solely to create and operate your account. They are not used for advertising or sold to third parties.

Data sharing: Your email and name are stored in Supabase (our authentication and database provider) under a data processing agreement. They are not shared with any other third party for any purpose.

Data storage & protection: Data is stored in Supabase-managed infrastructure with encryption at rest and in transit. Access is restricted to authenticated application code only.

Data retention & deletion: Your Google-sourced data is retained for as long as your account exists. You can request deletion at any time by emailing support@essaylab.ai or by deleting your account in your profile settings. Upon account deletion, all associated data is permanently removed within 30 days.

Essay Lab's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

9. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability

To exercise any of these rights, email us at support@essaylab.ai. We will respond within 30 days.

10. Cookies and advertising

We use essential cookies to maintain your session and authentication state. You can disable cookies in your browser settings, though this may affect service functionality.

Our free writing guides may carry advertising served by Google. Where they do, Google and its partners set cookies to serve and measure those ads, and you will be asked for your choices through a consent banner before any non-essential cookie is set. We show non-personalised advertising, so those ads are based on the page being read rather than a profile of you. The review tool itself carries no advertising.

11. Data security

We take reasonable technical and organisational measures to protect your data, including HTTPS encryption in transit and access controls on our databases. No system is completely secure; you use the service at your own risk.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will note the date of the most recent update above. Continued use of the service after changes are posted constitutes acceptance.