Legal

Privacy policy

How ProofreadLab collects, uses, stores and deletes personal data, and what you can ask us to do about it.

Last updated: 2026-09-23

1. Who we are

ProofreadLab (“we”, “us”) provides editing, proofreading and translation services through proofreadlab.com. We are based in New York, United States. For any question about this policy or your data, write to contact@proofreadlab.com.

2. What we collect

Information you give us

• Account details — if you create an account: your name, email address, a hashed password (never the password itself), and optionally your institution, country and phone number.
• Contact details — name, email address, and optionally your institution, country, phone number and purchase-order reference.
• Order details — service, word count, language, style preferences, deadline and the notes you write for your editor.
• Your document — the file you upload, and any personal data it happens to contain.
• Correspondence — messages you send us and our replies.

If you sign in with Google

We receive only your Google account's email address, name and a numeric identifier, and only after you approve it. We do not receive your Google password, your contacts, your Drive files or anything else, and we ask Google for no other permission. Google will have its own record that you signed in to our site; that is covered by Google's privacy policy. You can disconnect us at any time from your Google account's security settings, and set a password with us instead.

Information collected automatically

• Server logs — IP address, user agent, requested page and timestamp, kept for security and abuse prevention.
• A session cookie — set when you use a form or sign in. It carries the anti-forgery token that stops other sites submitting forms in your name, and identifies your signed-in session. It contains no personal data and expires when you close the browser.
• A “keep me signed in” cookie — only if you tick that box. It lasts 30 days, is replaced each time it is used, and is cancelled when you sign out or change your password.
• Failed sign-in records — the address tried and a one-way hash of the IP address, kept for up to 7 days so that we can lock out password guessing.
• Download records — which files were downloaded and when, so that both of us have a record of what was delivered.

We do not use advertising cookies, cross-site trackers or third-party analytics that profile you. If we add website analytics in future, this policy will be updated first and the tool will be configured without cross-site tracking.

3. Why we use it, and on what basis

4. How long we keep it

• Your document and the edited versions: 30 days after delivery, then deleted. Immediately on request once you confirm receipt, or on a shorter schedule you set in the order notes.
• Order records (reference, dates, service, price, contact details) without document content: as long as tax and accounting law requires.
• Your account: until you ask us to close it. Ask at any time and we erase your personal details, keeping only the order and invoice records that tax law requires.
• Correspondence: up to 24 months, then deleted.
• Server logs: up to 90 days.
• Newsletter subscription: until you unsubscribe.

5. Who else sees it

We do not sell personal data and we do not share it for advertising. Data reaches other parties only in these cases:

• The editor or translator assigned to your order, under a signed confidentiality agreement, for the duration of that order only.
• Our hosting provider, which stores the website and uploaded files on servers under contract to us.
• Our email provider, which carries order notifications and our replies to you.
• Our payment provider, which processes your payment. Card details are entered on the provider's own systems and never reach this website.
• Google, if — and only if — you choose to sign in with Google.
• Authorities, where we are legally required to disclose.

Some of these providers operate servers outside your country. Where that involves a transfer of personal data, it is made under the safeguards available in the relevant law, such as standard contractual clauses.

We never submit your document to public AI or machine-translation services, and our editors are contractually prohibited from doing so.

6. Personal data inside your document

If the document you send contains personal data about other people — research participants, interviewees, patients — we process it only to carry out the edit or translation, under your instructions. Please send a pseudonymised copy where you can. Where you cannot, tell us before uploading and we will agree handling terms in writing, including a named editor, a shortened deletion window and, if you need one, a data-processing agreement.

7. Your rights

Depending on where you live, you may have the right to ask us to:

• confirm what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete data we no longer need — including your document, at any time;
• restrict or object to a particular use;
• provide your data in a portable format;
• withdraw consent, where consent was the basis.

Write to contact@proofreadlab.com. We reply within 30 days and do not charge for a reasonable request. If you are not satisfied with our answer, you may complain to the data protection authority in your country.

8. Security

The site is served over HTTPS. Uploaded files are stored outside the public web root with randomised filenames, directory listing and script execution disabled. A stored document can only be reached through a page that first confirms you are signed in and that the order is yours.

Passwords are stored as one-way hashes (Argon2id where the server supports it, bcrypt otherwise) and can never be read back, by us or by anyone who obtained a copy of the database. Repeated failed sign-ins lock an account temporarily. Access to a document is granted per order, not per person. The operational detail is on our confidentiality page.

No system is perfect. If we ever discover a breach affecting your data, we will tell you and the relevant authority as the law requires, and tell you what we are doing about it.

9. Children

Our services are intended for adults and for students at university level. We do not knowingly collect data from children under 16. If you believe we have, write to us and we will delete it.

10. Changes

If this policy changes materially we will update the date at the top and, where the change affects work we are doing for you, tell you directly. Previous versions are available on request.