ENTRUST AI

Privacy Policy

ENTRUST AI APEX

APEX is a certification service for writing, made by ENTRUST AI. You use it inside ChatGPT: you ask for a piece of writing, or send your own, and APEX has it written and examined against its release rules. It is released only if it passes, and the release carries a signed receipt. This page says, in plain words, what APEX keeps about you and what it does with your text.

Who we are

ENTRUST AI, Monsey, New York, United States. Questions about this policy go to contact@entrustai.co.

ENTRUST AI decides what APEX keeps about you and why. Under the data protection laws of the European Union, the European Economic Area, the United Kingdom and Switzerland, that makes us the controller of your personal data.

What we keep about you

• Your sign-in. The first time you use APEX you sign in once, with Google, with a code we send to your email, or with your email and a password. We keep your email address and, if you used Google, the name Google gives us. If you use a password, it is kept only in scrambled (hashed) form, and we never see it. Sign-in is handled by Supabase, our database and sign-in provider, and sign-in emails are sent through Resend. From then on APEX knows you by an internal account number; every request you make is filed under it.
• Your replies and payments. How many certified replies you have, each reply set aside and whether it was charged, and each payment: the pack bought, the amount and Stripe's reference for it. Payments are taken by Stripe; your card details go to Stripe and never reach us. These records are kept for as long as your account exists.
• Your requests and your text. The request you type, any text you paste, any file you attach together with the text read from it, the chat messages sent to APEX with a request, and the result APEX produces are stored in Supabase, encrypted. Each is kept for 30 days, extended while you are still using that request, and then deleted.
• Working records of each run. The service runs on Railway. While it works on a request, APEX keeps a working record of that run on the service's own disk. For a certified result, that record includes the certified text and its receipt, not encrypted. For a result that is not certified, or a run that broke down, the full working record is kept encrypted. Either record is kept for 30 days and deleted when the service next clears its old runs.
• The progress log. For each request, APEX keeps a log of what happened: its steps, outcome, timings, the names of attached files, any question APEX asked you, and, when a text was not certified, the findings that explain why. Findings describe your text and can include short phrases about it. This log is not encrypted. It is kept for as long as your account exists and is deleted with your account, or sooner if you ask us to delete your data.
• Receipts. Every certified result carries a signed receipt. A copy is published under its Run ID so that anyone holding the number can check it at entrustai.co/verify, and it is kept indefinitely. A receipt holds fingerprints (hashes) of your text and of your request, the signature, the model used, the outcome of each check, and technical details of the run, such as the name of its folder on our server. It never holds your text; but someone who already has the exact text can confirm that it matches the receipt. Receipts for results that were not certified are not published.

What happens to your text

To write and examine your text, APEX sends it to OpenAI's models through OpenAI's API, under OpenAI's API terms. OpenAI states that data sent through its API is not used to train its models; that is OpenAI's undertaking, and we rely on it. No one else is given your text. We do not sell it, share it with advertisers, or use it to train anything of our own.

ChatGPT itself, where you use APEX, is OpenAI's product and is covered by OpenAI's privacy policy, not by this one. What ChatGPT shows you, remembers, or shares with APEX is governed there.

Why we use your data

Where the law asks for a reason for each use of your data (as the European and UK laws do), these are ours:

• To provide APEX to you. Your sign-in, your requests and your text, the working records, the progress log and the receipts are what the service is made of; we use them because you asked for the service, under our agreement with you.
• To take payment and keep account records. Your replies and payments are kept under that same agreement, and for as long as tax and accounting law requires us to keep payment records.
• To keep APEX working and secure. Looking at a stored run to investigate a breakdown, and keeping the progress log so a failure can be traced, rest on our legitimate interest in running a reliable and secure service. You can object to this, as described below.

We do not use your data for advertising or marketing, and we do not ask for your consent to anything beyond what the service needs.

Who else handles your data

We use a small number of service providers, and each handles your data only to do its part of running APEX for us:

• Supabase: database and sign-in.
• Railway: the servers APEX runs on.
• OpenAI: the models that write and examine your text, through OpenAI's API.
• Stripe: payments.
• Resend: sign-in emails.
• Google: sign-in, only if you choose to sign in with Google.

We may also disclose data where the law requires it.

Where your data is processed

ENTRUST AI is in the United States, and your data is processed in the United States and wherever our providers operate. If you are in the European Economic Area, the United Kingdom or Switzerland, this means your data leaves your country. Where it does, we rely on the Standard Contractual Clauses approved by the European Commission, and on their UK and Swiss equivalents, as they are included in our providers' data processing terms, or on a provider's certification under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions.

What we do not do

• We do not sell or rent anything about you.
• We do not set advertising or tracking cookies. The sign-in page keeps only what it needs to remember that you signed in on that browser.
• We do not read your text ourselves in the ordinary course of running APEX. We would look at a stored run only to investigate a breakdown, or where the law requires it.
• We make no automated decision about you that has legal or similarly significant effects. APEX decides whether a text is released; it does not decide anything about you as a person.

Your choices

• Delete your data. Write to contact@entrustai.co from the address you signed in with and we will delete your account, your stored requests and results, their working records and their progress log. This is done by hand, within 30 days of your request. Receipts stay, because they hold no text and other people may be relying on them to check a letter; payment records stay where the law requires us to keep them.
• Disconnect. In ChatGPT you can disconnect APEX at any time under Settings; that ends its access to your chats.
• A copy of what we hold. Ask at the same address and we will send it, in a common machine-readable format if you want to take it elsewhere.
• Correct it. If something we hold about you is wrong, tell us at the same address and we will correct it.
• Limit or object. You can ask us to limit how we use your data, or object to a use that rests on our legitimate interest, at the same address.
• Complain. If you are in the European Economic Area, the United Kingdom or Switzerland, you can complain to the data protection authority where you live or work. We would ask you to write to us first, so we can put it right.

We answer every request within one month, and we will not charge you for it. We may ask you to write from the address you signed in with, so we know the request is yours.

Children

APEX is not directed at children under 13, and we do not knowingly keep anything about them.

Changes

If this policy changes, the effective date at the top changes with it. Material changes will be announced on this page before they take effect.

Governing law

This policy is governed by the laws of the State of New York, United States.