Who is responsible
The controller of your personal data is Victor Billaud EI, trading as Rephrase, 206 avenue Daumesnil, 75012 Paris, France. Contact: support@rephrase.studio. See the Legal notice.
What we never store: your text
The text you rephrase and the rewrite you get back are held in memory while the request runs, sent to Google's Gemini API to generate the rewrite, and then discarded. They are not written to our database, request logs, error reports, or analytics.
Rephrase reads the text you select. If nothing is selected, it uses your clipboard contents instead, and the app tells you when it does. It does not read your clipboard history or other documents.
What we collect
- Account: your Google email address and name, shared by Google when you sign in, and an account ID.
- Rephrase metadata: for each rephrase, the time, status, input and output character counts, detected language, preset, model, token counts, latency, and any error code.
- Billing: your plan, Stripe customer and subscription IDs, and renewal date. Stripe collects your card, billing country, and any VAT number; we never see your card number.
- App analytics: events from the desktop app (for example panel opened, rephrase sent, result applied, errors, preset chosen) with length ranges, tied to your account ID. No text.
- Feedback:if you use “Send feedback…” in the app, the text you type is sent to PostHog with your account ID.
- Website: Vercel Web Analytics counts page views without cookies. Our hosts see IP addresses to serve pages and downloads.
- Email: what you send us when you write to support.
Why, and on what legal basis
- Contract: providing your account and rephrases, applying plan limits, and billing Pro.
- Legal obligation: keeping invoices and accounting records.
- Legitimate interest: security, abuse prevention, reliability monitoring, product analytics, and reading feedback you choose to send. You can object to these at any time.
How long we keep it
- Account data and rephrase metadata: while your account exists, then deleted within 30 days of your deletion request.
- Invoices and billing records: 10 years, as French accounting law requires.
- App analytics and feedback in PostHog: 12 months.
- API request logs (which never contain your text): up to 30 days.
- Support emails: as long as needed to answer you.
Who processes it
- Supabase: Google sign-in and the Postgres database (account, rephrase metadata, plan status). EU.
- Fly.io: Runs the Rephrase API; your text passes through it in memory only. EU (Frankfurt).
- Upstash: Redis for hourly rate limits (account ID and counters). EU (Frankfurt).
- Google, Gemini API (paid tier): Generates the rewrite from your text. US and other countries.
- Stripe: Payments, invoices, VAT, and the billing portal. EU and US.
- PostHog (EU Cloud): App analytics events, rephrase metadata events, and the feedback you send. EU (Frankfurt).
- Vercel: Hosts this website and its cookie-less web analytics. US and global edge.
- Cloudflare (R2): Serves app downloads and updates. Global edge.
We use Gemini on a paid tier. Under Google's Gemini API terms, paid-tier prompts and responses are not used to train or improve Google's products and are not reviewed by humans; Google logs them briefly for abuse, safety, and legal compliance. We do not sell your data or share it for advertising.
International transfers
Some of these providers are based in, or access data from, the United States. Where that happens, the transfer relies on the EU–US Data Privacy Framework when the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR you can ask to access, correct, delete, or export your data, to restrict or object to its processing, and, under French law, give instructions for what happens to it after your death. Email support@rephrase.studio; we answer within one month. There is no writing history to hand over, because none is kept.
You can also complain to the French data protection authority, the CNIL, or the authority in your country.
Cookies
This website sets no cookies. The desktop app keeps your sign-in session in the macOS Keychain.