PerfectEssayWriter.ai

GDPR overview

The privacy notice is dated 18 January 2023, the same day the domain was registered, and has not been revised since. It contains a dedicated EU/UK section setting out the four GDPR and UK GDPR legal bases and listing the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, plus the right to complain to a local supervisory authority. Separate California (CCPA) and Virginia (CDPA) sections give a 45-day response deadline, extendable once. The notice stops at section 14: there is no contact section, no GDPR email address and no data protection officer. No Article 27 EU representative is designated although the publisher is established in the United States. The only explicit claim of GDPR compliance sits on the human writing service page. The terms treat continued browsing as acceptance of the data transfer to the US.

Who owns the data?

The publisher names itself the data controller under European data protection law for the personal information described in its privacy notice, while stating that it also acts as a data processor on behalf of clients in other situations, without saying which. Declared collection covers name, phone number, email, postal address, log-in identifiers, passwords, billing address and card number, alongside automatically captured IP address, device, browser, operating system, precise or approximate location and usage logs. Further data arrives from third parties: public databases, marketing partners and social platforms. The terms of service state that user Contributions remain the user's property, with all intellectual property rights retained. Nothing in the documents settles the legal status of the essays the tool generates.

Reuse rights

The privacy notice lists the purposes it relies on: creating and managing accounts, delivering the service, providing support, sending administrative information, handling orders, enabling communication between users and protecting vital interests. For EU and UK users it invokes four legal bases: consent, performance of the contract, legal obligations and vital interests. Sharing is described by category only, with no third party ever named: business transfers, affiliates and business partners. Data obtained from third parties is used for targeted advertising and event promotion. Cookies and tracking technologies are in use, with a reference to a Cookie Notice that is linked nowhere on the site. In the homepage FAQ the vendor states that user essays are not used to train models and are not shared with third parties, but the privacy notice itself never mentions AI, essays or model training, so that commitment lives outside the binding document. In the same notice, the name of the payment provider was left as an unfilled template blank. On reuse, the terms confirm that Contributions remain the user's property; no clause grants or restricts what the user may do with the generated text, which is left undefined.

Data retention & training

Hosting summary

The only hosting statement in the documents is a single line in the terms of service: the Site is hosted in the US. No hosting provider is named, no region and no data centre, and no subprocessor list is published; in the privacy policy the name of the payment provider was left as an unfilled template blank. The public IP resolves to an Imperva/Incapsula anycast node, which is a CDN and WAF front end and therefore says nothing about where the data actually sits. No certification such as SOC 2 or ISO 27001 is claimed anywhere on the site, and the security measures are described in generic terms, as appropriate and reasonable technical and organizational security measures, with no technical detail. In practice, a European user should read this as personal data transferred to and stored in the United States under documents that name neither the infrastructure provider nor any transfer mechanism beyond the consent implied by continued browsing.