Legal & privacy

Legal documents

Transparent by design. Read our policies to understand how AnyFact handles your data and what we ask of you.

Privacy Policy

How AnyFact collects, uses and protects your personal data: what we store, how long we keep uploaded files, who processes them and your rights.

Last updated: 8 October 2026

This text is being reviewed by a lawyer.

It may change before its final version.

This Privacy Policy explains how AnyFact SAS ("AnyFact", "we", "us") collects, uses, and protects your personal data when you use anyfactai.com and its AI-content detection services. Effective date: 8 October 2026.

1. Who we are

AnyFact SAS is the data controller for personal data processed through anyfactai.com. You can contact us at: privacy@anyfactai.com.

2. Data we collect

2.1 Data you provide

Account data: your email address and the authentication data needed to sign you in (your password is stored as a hash by our authentication provider, never in plain text).
Content you submit for analysis: images, audio files, videos, documents, texts, source code, and links or website addresses.
Feedback: when you report that a result is wrong, the report and any comment you add.
Contact messages: name, email and message submitted through the contact form or by email.
Payment data: payments are processed by Stripe. AnyFact does not store card numbers.

2.2 Data we produce

Analysis results: the verdict, the explanation, the signals found, the credits used and the date of each analysis.
PDF reports generated from an analysis.

2.3 Data collected automatically

Technical logs: IP address, browser type, pages requested and timestamps, kept for a limited period for security purposes.
Session data: stored in your browser's local storage by our authentication provider and removed when you sign out.
Analytics: we do not currently run third-party analytics. If we add one, we will update this policy first.

2.4 People who appear in submitted content

Content you submit may show or mention other people (for example a face in a photo or a voice in a recording). This content is processed only to run the analysis you requested and is deleted on the schedule described in section 7. We do not use it to identify people and we do not build profiles of them.

3. How we use your data

Type	Details
Running analyses	Analysing the content you submit and returning a verdict with an explanation.
PDF reports	Generating the downloadable report of an analysis.
Account and credits	Providing access to your account, your history and your credit balance.
Quality of the detectors	Reviewing results reported as wrong to evaluate and improve our detectors.
Security	Preventing abuse and protecting the service.
Customer support	Answering your messages.
Legal compliance	Keeping the records the law requires us to keep.

4. Legal basis for processing

Type	Details
Contract performance	Running the analyses you request, managing your account, credits and history.
Legitimate interests	Security, abuse prevention and improving the quality of the detectors.
Consent	Marketing emails (opt-in only). You can withdraw consent at any time.
Legal obligation	Keeping billing and accounting records.

5. Service providers (processors)

We share data only with the providers we need to run the service:

Type	Details
Supabase	Website back end: database, authentication and storage of uploaded files and reports.
Modal	Running the detection models on the content you submit. Modal is a company based in the United States.
Anthropic	Claude, the language model that gives a second opinion in unclear cases and writes the plain-language explanation. The content analysed may be sent to it for that purpose.
Stripe	Payment processing.
Vercel	Hosting of the website.
Brevo	Sending emails (account emails and, if you opted in, newsletters).

We do not sell personal data. We do not share data with advertisers.

6. International transfers

Some of these providers, such as Modal and Anthropic, are based in the United States. Where personal data is transferred outside the European Economic Area, the transfer must rely on a safeguard provided for by the GDPR, such as the European Commission's Standard Contractual Clauses.

7. Data retention

Type	Details
Uploaded files	Deleted 30 days after the analysis.
PDF reports	Deleted 30 days after they are generated.
Verdicts and analysis results	Kept in your history (without the uploaded file) until you delete them or close your account.
Account data	Kept while your account exists, then deleted.
Billing records	Kept for the period required by accounting law.
Contact messages	Kept as long as needed to handle your request.

8. Your content, your responsibility

Only submit content you have the right to submit — for example content you created, received, or are allowed to share. Do not submit content that is illegal or that reveals more personal data about other people than the analysis needs.

9. Results are indicative

An analysis is produced automatically and is an indication, not proof. Detectors can be wrong, especially on compressed, edited or very short content. Do not use a result as the only basis for a decision that affects a person. If you think a result is wrong, you can report it from the result page.

10. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or port your data. See our GDPR Notice for the full list and how to exercise them.

11. Security

Connections to the website use HTTPS. Access to the database is restricted with row-level security, and uploaded files are kept in private storage that only your account can access.

12. Changes to this policy

We will notify you of material changes by email (if you have an account) and by updating the effective date above.

13. Contact

Data protection enquiries: privacy@anyfactai.com
Postal address: AnyFact SAS, Paris, France
You also have the right to lodge a complaint with a supervisory authority such as the CNIL (France).