Privacy & Trust
How we handle your manuscript
You're trusting us with a book that isn't published yet. This page shows every step your manuscript takes through our systems, every kind of service that touches it, how it's encrypted, how long anything is kept, and exactly how to make us delete it. Names, numbers and timelines, no vague promises.
Last reviewed · Questions: [email protected]
At a glance
The short version
Read by software, not people
No one at Manuscript AI reads your manuscript unless a run fails or you ask us to look.
Never used to train AI
Our own models are trained only on public data, and our AI providers' paid-API terms bar them from training on your text.
File deleted within 48 hours
Automatically, 48 hours after your report is delivered, or 48 hours after upload if you don't check out.
No copy of your text kept
We keep your report, which quotes short passages as evidence. We don't keep your manuscript.
Encrypted everywhere it goes
TLS on every connection and encryption at rest wherever it's stored. Stored in the United States, apart from text our AI providers process.
Your work stays yours
We claim no rights to your manuscript or report, and never publish or market with either.
Delete it all with one email
Write to [email protected]. Done within 2 business days, with a confirmation.
Publishers: we sign DPAs
And NDAs and security questionnaires, turned around within 5 business days.
The lifecycle
What happens to my manuscript after I upload it?
It's stored privately, analysed by software in a single run that usually takes under 10 minutes, turned into your report, and then deleted automatically within 48 hours of delivery.
Step 1
Upload
Your .docx is uploaded over an encrypted connection to private, encrypted file storage.
- Where
- Cloud file storage (US)
- Who can access it
- No one. It's in transit.
- How long
- Seconds
Step 2
Encrypted storage
The file waits in encrypted storage in the United States until your payment clears.
- Where
- Cloud file storage (US)
- Who can access it
- Our analysis systems. Staff under NDA only to fix a failed run.
- How long
- Until the deletion clock runs out
Step 3
Analysis
Your manuscript is analysed by our own models and by AI models from OpenAI, Anthropic and Google, each used for a different part of the work.
- Where
- Our systems on AWS (US) + AI providers
- Who can access it
- Software only. No person reads your text.
- How long
- One run, usually under 10 minutes
Step 4
Report
The results become your report, saved to our database and emailed to you. It quotes short passages from your manuscript as evidence.
- Where
- Our database (US) + your inbox
- Who can access it
- You, and anyone you share the link with
- How long
- Until you ask us to delete it
Step 5
Deleted at 48 hours
Within 48 hours of delivery the uploaded file is deleted from storage automatically, and we record when it happened.
- Where
- Nowhere. The file is gone.
- Who can access it
- No one
- How long
- Permanent
Off-ramp from step 2
Didn't check out?
You upload before you pay, so an abandoned upload has its own clock: the file is deleted within 48 hours of upload.
Off-ramp from step 3
Analysis failed?
We keep the file for up to 30 days so we can fix the problem and re-run your report, then delete it. We email you either way.
After step 5, what's left?
Your manuscript is gone. These remain, and each has its own clock.
Your report
Until you ask us to delete it.
Your contact and book details
Until you ask us to delete them.
Your payment record
As long as Indian tax law requires. Never your card details.
AI providers' abuse-monitoring copies
Up to 55 days, then the provider deletes them.
AI providers
Which AI reads my manuscript, and is it used for training?
We use our own models, hosted on Amazon Web Services in the United States, together with models from OpenAI, Anthropic and Google, each for different parts of the analysis. Our own models are trained only on publicly available data, and every provider is used through paid APIs whose terms bar it from training on your text, so your manuscript is never used to train AI.
Where your text goes
From your manuscript to your report, and nowhere else.
Your manuscript
Its text, and the questions you asked us to answer.
Our own models
Hosted on Amazon Web Services in the United States.
AI providers
OpenAI, Anthropic and Google, through paid business APIs.
Your report
Saved to our database in the United States and emailed to you.
Working copies are deleted as soon as the analysis ends. No model, ours or a provider's, is trained on your manuscript.
The models we use
Each one receives only the text the analysis needs, never your payment details.
Our own models
- Where it runs
- Hosted on Amazon Web Services in the United States
- Trained on your text?
- Trained only on publicly available data, never on customer manuscripts or any other private data
- Keeps a copy
- Working copies are deleted when the analysis ends
OpenAI
- Where it runs
- Paid business API
- Trained on your text?
- No. API data isn't used to train OpenAI's models
- Keeps a copy
- Up to 30 days, only to detect abuse
Anthropic
- Where it runs
- Paid business API
- Trained on your text?
- No. Anthropic's commercial terms bar training on API data
- Keeps a copy
- Up to 30 days, only to detect abuse
Google (Gemini)
- Where it runs
- Paid business API
- Trained on your text?
- No. Google's paid-tier terms bar using it to improve its products
- Keeps a copy
- Up to 55 days, only to detect abuse
Training on your manuscript
NeverWe train our own models only on publicly available data. No model, ours or a provider's, is ever trained or fine-tuned on a customer manuscript.
Consumer chatbots
NeverWe never paste a customer's manuscript into ChatGPT, the Gemini app, Claude.ai or any other consumer AI app, where it could be kept or used for training.
Our rules for any AI provider
Before a model ever sees a customer's manuscript, its provider has to meet all five.
- 1
Paid, business-grade API access only. Never a free tier, whose terms usually allow training.
- 2
A contractual commitment that customer content isn't used to train or improve the provider's models.
- 3
Provider-side retention that's limited, documented, and printed on this page.
- 4
Listed here before any customer manuscript is sent to it. Publishers with a DPA hear from us by email first.
- 5
Only the text the analysis needs. Never your payment details.
Encryption
How is my manuscript encrypted?
Every connection your manuscript travels over is encrypted with TLS, the technology behind HTTPS, and everywhere we store it is encrypted at rest. We don't claim end-to-end encryption, because our software has to read your text to analyse it.
In transit
Every connection your data crosses, and how it's protected.
- Your browserencrypted with HTTPS · TLSManuscript AI
Your file and the order form travel encrypted.
- Our systemsencrypted with TLSOur systems
Every connection between our own services is encrypted.
- Our systemsencrypted with HTTPS · TLSAI providers
Text out, results back, encrypted both ways.
- Manuscript AIencrypted with TLSYour inbox
Your report email leaves us encrypted.
- Your cardencrypted with HTTPS · PCI DSSPayment processor
Card details go straight to our payment processor and never reach our servers.
At rest
Where your data is stored, and how it's protected there.
File storage
Encrypted at rest, in the United States.
Database
Encrypted at rest, backups included, in the United States.
AI providers
OpenAI, Anthropic and Google encrypt stored data by default.
Payments
Card data is held by a payment processor certified to PCI DSS Level 1. We never store it.
What encryption can't do
Encryption protects data on the wire and on disk. It doesn't stop someone with a valid login, which is why we also limit who can log in and how long anything is kept. And because our software must read your text to analyse it, we don't claim end-to-end or zero-knowledge encryption. Be wary of any manuscript service that does.
Report links
Your report lives at a private link that we email only to you. Report pages are hidden from search engines, so they never show up in results. Anyone who has the link can open your report, so share it only with people you trust.
Subprocessors
Which companies handle my data?
15 kinds of outside service help us run Manuscript AI, and every one is listed below. Only 6 of them ever handle your manuscript or its text: our file storage, our own models on AWS, OpenAI, Anthropic, Google and our database.
Handle your manuscript
The only services that ever hold your file or its text.
| Provider | What they do for us | What they receive | Where | How long they keep it | Used to train AI? |
|---|---|---|---|---|---|
| Cloud file storage | Stores your uploaded file | Your .docx file | United States | Until our automatic deletion: 48 hours after delivery at most | No |
| Amazon Web Services | Hosts our own models and analysis systems | Your manuscript's text, for the length of the analysis | United States | Deleted when the analysis ends | No |
| OpenAI API | AI analysis | The text the analysis needs | OpenAI's infrastructure | Up to 30 days, only to detect abuse | No |
| Anthropic API | AI analysis | The text the analysis needs | Anthropic's infrastructure | Up to 30 days, only to detect abuse | No |
| Google Gemini API | AI analysis | The text the analysis needs | Google's global infrastructure | Up to 55 days, only to detect abuse | No |
| Database | Stores your report and order | Your report (with short quotations), the book details you typed, your order record | United States | Until you ask us to delete it. Backups expire on a rolling schedule. | No |
Handle your account, order and emails
These never receive your manuscript or its text.
| Provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Website hosting | Runs our website | The order form as you submit it, and standard request logs such as IP address | United States |
| Payment processor | Takes payments | Your name, email address and payment details | India |
| Email delivery | Sends our emails, including your report link | Your name, email address and report link | Global |
| Customer contact list | Keeps our list of customers | Your name, email address and whether you've ordered | United States |
| Internal team alerts | Tells our team about new orders | Your book's title and your first name | United States |
Measure our website and ads
These help us see how the site is used and whether our ads work. None of them receives your manuscript or the contents of your report.
| Provider | What they do for us | What they receive | Where |
|---|---|---|---|
| Website analytics | Website usage and sales measurement | Pages visited, device type, order value and order number | United States |
| Session analytics | Shows how visitors use our pages | Clicks and scrolling on our pages. Anything you type into a form is masked. | United States |
| Advertising measurement | Measures our ads | Your email address when you upload and when you order | United States |
| Affiliate tracking | Tracks sales referred by our affiliates | Your name, email address, order value and order number | United States |
Our blog and call-booking tools never receive customer data. Publishers with a DPA or NDA can request the named list of providers. We'll update this page before any new service that handles your manuscript goes live.
Retention
What do you keep, and for how long?
Your uploaded file is deleted within 48 hours of delivery, and we don't keep a copy of your manuscript text. Your report stays until you ask us to delete it. Payment records are kept as long as Indian tax law requires.
Every clock running on your data
From the moment your analysis starts, shortest first.
When the run ends
Usually under 10 minutes
Working copies
On our systems and at our AI providers. Deleted as soon as the analysis finishes.
48 hours
Automatic
Your uploaded file
Counted from delivery of your report
Abandoned uploads
Counted from upload, if you never check out
30 days
Automatic
Files from failed runs
Kept only so we can fix and re-run them
Service logs
Never contain manuscript text
Up to 55 days
Our AI providers' clock, not ours
Abuse-monitoring copies
Kept by AI providers only to detect misuse and meet legal duties. Never used for training.
Until you say so
One email deletes it
Your report
So you can come back to it
Your contact and book details
Name, email, title, chapter names, your questions
As the law requires
Indian tax and accounting law
Payment records
Amount, date and payment ID. Never your card details.
Everything we hold about you
The complete list. If it isn't here, we don't keep it.
| What | Why we have it | Where | How long | Who can see it |
|---|---|---|---|---|
| Your manuscript file (.docx) | To run your analysis | Cloud file storage (US) | 48 hours after delivery. 48 hours after upload if you don't check out. Up to 30 days if the analysis fails. | Our analysis systems. Staff under NDA, only to fix a failed run. |
| Your manuscript's text | To analyse it | Our systems on AWS (US) and our AI providers | Until the analysis ends, usually minutes. AI providers' abuse-monitoring copies: up to 55 days. | Software only |
| Your report | It's what you paid for | Our database (US) | Until you ask us to delete it | You, anyone you share the link with, and staff under NDA if you ask for help |
| Book details you typed | Title, description, chapter names and questions shape the analysis | Our database (US) | Same as your report | Staff under NDA |
| Name, email address, country | To deliver your report, send receipts and answer you | Our database, contact list and payment processor | Until you ask us to delete them, apart from payment records | Staff under NDA |
| Payment record | Accounting, tax and refunds | Payment processor. Amount and payment ID in our database. | As long as Indian tax and accounting law requires | Staff under NDA |
| Card details | — | Payment processor only | We never see or store them | No one at Manuscript AI |
| Service logs | To diagnose failed runs | Our database and website host | 30 days | Staff under NDA. Logs never contain manuscript text. |
Access
Who at Manuscript AI can see my manuscript?
No one reads it as a matter of course. Only team members bound by a written non-disclosure agreement can access customer data, and only to fix a failed analysis, answer a request you've made, or process a refund.
Who
Only Manuscript AI team members who have signed a written non-disclosure agreement. No contractor, freelancer or partner gets access without one.
When
Only for one of three reasons:
- to fix an analysis that failed,
- to answer a request you've made, or
- to process a refund.
How
Through our internal dashboard, which only approved accounts can sign in to, protected by two-factor authentication.
Never
We don't browse manuscripts, read them for interest, sell them, or hand them to advertisers. Our internal order alerts carry your book's title and your first name, not your manuscript.
Early deletion
How do I delete my manuscript or report early?
Email [email protected] from the address you ordered with. We'll delete your file, report and details within 2 business days and email you to confirm.
- 1
Email us
Write to [email protected] from the address you ordered with, or reply to your report email. Tell us whether you want everything deleted or just your report.
- 2
We check it's you
We only act on requests from the email address on the order, so no one else can delete your report or ask for your data.
- 3
We delete it within 2 business days
Your uploaded file if it's still there, your report, your book details, and your contact details in our database and our contact list.
- 4
We confirm by email
You get a short note listing what we deleted and when.
What we can't delete
- Payment records, which Indian tax and accounting law makes us keep.
- AI providers' abuse-monitoring copies, which they delete on their own within 55 days at most.
- Database backups, which expire on their own rolling schedule rather than being edited one record at a time.
Your privacy rights
Wherever you live, and whether GDPR, the UK GDPR, India's Digital Personal Data Protection Act or a US state privacy law applies to you, you can ask for a copy of your data, ask us to correct it, or ask us to delete it. Same address, and we reply within 2 business days.
Intellectual property
Who owns my manuscript and my report?
You do. We claim no rights to your manuscript or your report, we never publish either, and we'll never use them in marketing or sample analyses without your written permission.
- You own your manuscript and every right in it. We claim none.
- You own your report. Share it, quote it, or show it to your editor, agent or publisher.
- We use your manuscript for one thing. We store it, analyse it and pass it to the services listed on this page, only to produce your report. That permission ends when it's deleted.
- We never publish, sell or share it. Not your manuscript and not your report, and neither appears in our marketing, testimonials or case studies without your written permission.
- Our sample reports come from published books. The public sample analyses are made from books already in bookshops, never from a customer's manuscript.
- Uploading isn't publishing. Your manuscript stays unpublished, so sending it to us doesn't affect your first-publication rights or your submissions to agents and publishers.
Security
How do I report a security issue?
Email [email protected]. We'll acknowledge your report within 2 business days, and we won't take legal action against good-faith security research.
How we protect it
- TLS on every connection and encryption at rest everywhere your data is stored. See every hop.
- Card details go straight to our payment processor, certified to PCI DSS Level 1, and never reach our servers.
- Customer data is open only to team members under NDA, through approved accounts with two-factor authentication.
- Less data, less risk: your file is gone within 48 hours and we never keep your manuscript text.
- Report pages are hidden from search engines, so a report never turns up in search results.
- Working copies of your manuscript are deleted as soon as each analysis ends.
Found a vulnerability?
Email [email protected] with what you found and how to reproduce it. We'll acknowledge it within 2 business days and keep you updated until it's fixed.
- We won't take legal action against good-faith research that follows these rules.
- Don't access or change other people's data, and stop as soon as you've shown the problem.
- No denial-of-service testing, spam or social engineering.
- Give us reasonable time to fix it before you publish.
We're a small team and don't run a paid bug bounty, but we'll gladly credit you on this page. Our machine-readable contact details are at /.well-known/security.txt.
For publishers and agencies
Do you sign DPAs and NDAs for publishers?
Yes. Send your data processing agreement or NDA to [email protected] and we'll review and sign it within 5 business days.
Data processing agreements
When you upload an author's manuscript, you decide what's analysed and why, and we act only on your instructions. Under GDPR that makes you the controller and us the processor. Send us your DPA and we'll sign it, including the named list of every provider.
NDAs
Happy to sign yours before you send a single manuscript, for a whole list or a single title.
Security questionnaires
This page answers most of them. Send us the rest and we'll complete it.
Advance notice
If you have a DPA with us, you hear from us by email before any new service that handles manuscripts goes live.
Need a DPA, NDA or questionnaire?
We turn them around within 5 business days.
Plain limits
Is there anything you can't promise?
Yes, four things: our AI providers keep a short-term copy to detect abuse (up to 55 days), they may process it outside the United States, anyone with your report link can open it, and we don't hold certifications such as SOC 2 or ISO 27001.
AI providers keep a copy for up to 55 days
Our AI providers keep a short-term copy of what we send them, for up to 55 days, only to detect abuse and meet legal obligations, and never to train. Content they flag for misuse, or that the law requires them to keep, can be held longer. We can't shorten or delete their copy.
AI providers may process it outside the US
Our own storage and models are in the United States, but our AI providers may process your text in other countries where they operate.
Your report link is the key
Anyone who has your report link can open your report. Treat it like a password, and ask us to delete the report if it's been shared further than you meant.
No security certifications
We're a small company and haven't been audited for SOC 2 or ISO 27001. What we can offer is this page: a specific account of how our systems work, which you can hold us to.
Changes
Changes to this page
We update this page before any change to how we handle your manuscript takes effect, and record it below. The “last reviewed” date at the top moves each time we check this page against how our systems actually work.
Added our own models, hosted on AWS in the United States, and AI models from OpenAI and Anthropic alongside Google. Simplified the technical detail on this page.
Published this page.
Who is responsible for your data
Whixic Technologies Private Limited, trading as Manuscript AI164/41 Lake Gardens, Kolkata, West Bengal 700045, India
- Privacy and deletion:
- [email protected]
- Security reports:
- [email protected]
This page explains our practices in plain language. The legal terms are in our Privacy Policy and Terms & Conditions.
“Authors send us books they've spent years on, before anyone else has read them. Every promise on this page is one I'm personally accountable for. If you find anything that doesn't match how we actually work, tell me and I'll fix it.”
Ready when you are.
Private by design, deleted on schedule, and backed by the 14-day money-back guarantee.