Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

As a data controller established in Greece, Write Well is subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) as applied in Greece, and to Greek Law 4624/2019 on the protection of personal data, which implements and supplements the GDPR in Greek national law. The competent supervisory authority is the Hellenic Data Protection Authority (HDPA — Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), reachable at www.dpa.gr.

2. Information We Collect

3. Legal Basis for Processing (GDPR)

Under the GDPR and Greek Law 4624/2019, we process your personal data on the following legal bases (Article 6 GDPR):

• Contract performance (Art. 6(1)(b)): Processing necessary to create and manage your account, process payments, and deliver the services you have subscribed to.
• Legal obligation (Art. 6(1)(c)): Retaining financial records as required by Greek tax and accounting law (e.g. Law 4308/2014 on Greek Accounting Standards).
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, debugging, and aggregate analytics — where these do not override your fundamental rights.
• Consent (Art. 6(1)(a)): Non-essential cookies and marketing analytics, where you have given explicit consent via our cookie banner.

4. How We Use Your Information

• To create and manage your account
• To process subscription payments and unlock gated content
• To send account-related emails (verification, password reset, receipts)
• To send notification emails you have opted into (new articles, replies, etc.)
• To display your public profile and published content to other users
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations under Greek and EU law

We do not sell your personal data to third parties. We do not use your data to train AI models.

5. Cookies and Tracking

We use cookies to enhance your experience. For detailed information about the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

We use the following categories of cookies:

• Necessary: Essential for authentication, security, and core functionality
• Analytics: Help us understand how you use the platform (Google Analytics, Sentry)
• Marketing: Allow us to show you relevant content and offers
• Preferences: Remember your settings and preferences

6. Do Not Sell My Personal Information

California Privacy Rights (CCPA): If you are a California resident, you have the right to know what personal information we collect, use, and share. You also have the right to request that we do not sell your personal information.

Our Commitment: Write Well does not sell your personal information to third parties for monetary or other valuable consideration. We do not share your data with advertisers or data brokers.

To exercise your rights under the CCPA or to request more information, please contact us at hello@write-well.com.

7. Your Rights

As a data controller subject to the GDPR and Greek Law 4624/2019, we respect the following rights:

GDPR Rights (EU Residents, including Greek residents):

• Access (Art. 15 GDPR) — request a copy of the data we hold about you
• Rectification (Art. 16 GDPR) — correct inaccurate data via your profile settings
• Erasure (Art. 17 GDPR) — delete your account and associated data via Settings → Delete Account
• Portability (Art. 20 GDPR) — request an export of your content and data in a structured, machine-readable format
• Objection (Art. 21 GDPR) — opt out of processing based on legitimate interests, including direct marketing
• Restriction (Art. 18 GDPR) — limit how we process your data in certain circumstances
• Withdraw Consent (Art. 7(3) GDPR) — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr or by post at Kifisias 1–3, 115 23 Athens, Greece.

CCPA Rights (California Residents):

• Right to Know — request what personal information we collect and how we use it
• Right to Delete — request deletion of your personal information
• Right to Opt-Out — opt out of the sale or sharing of your personal information
• Right to Correct — request correction of inaccurate personal information

To exercise any right not available through the platform UI, contact us at the address below. We will respond within 30 days as required by the GDPR.

8. Data Retention

We retain your account data for as long as your account is active. Unverified accounts (where email confirmation was never completed) are automatically deleted after 24 hours. If you delete your account, your personal data is removed within 30 days, except where retention is required by law — for example, financial records related to Stripe transactions are retained for 10 years in accordance with Greek Law 4308/2014 on Greek Accounting Standards and applicable Greek tax law.

Consent Data: Your cookie consent preferences are stored in your browser's localStorage under the key writewell_consent_v1. This data is retained until you clear your browser cache or manually delete it.

9. Data Storage and Security

Your data is stored in a Supabase-hosted PostgreSQL database with row-level security (RLS) policies enforced at the database layer. All data is encrypted in transit (TLS) and at rest. Access to production data is restricted to authorised personnel only.

Despite these measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at the address below.

10. International Data Transfers

Some of our third-party service providers (including Stripe, Resend, Supabase, and Google) may process your data outside the European Economic Area (EEA). Where such transfers occur, we ensure they are subject to appropriate safeguards as required by Chapter V of the GDPR, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or adequacy decisions. You may request information about the specific safeguards in place by contacting us at hello@write-well.com.

11. Third-Party Services

The following third-party services act as data processors on our behalf under Article 28 GDPR:

12. Children's Privacy

Write Well is not directed at children. Under Greek Law 4624/2019 (implementing Article 8 GDPR), the minimum age for consent to information society services in Greece is 15 years. We do not knowingly collect personal data from children under 15. If you believe a child has registered, contact us and we will delete the account promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, where changes are material, notify you by email. Continued use of the platform after changes constitutes acceptance of the revised policy.

14. Contact

For privacy-related questions, requests to exercise your rights, or complaints, contact our data controller at:

If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.