Privacy Policy — RevisePilot

1. Who We Are and What This Policy Covers

NexGen Language Editing, LLC operates RevisePilot. This Privacy Policy applies to revisepilot.com, our shared API and application infrastructure, and related support, billing, analytics, and email workflows.

Because the frontends share a common platform, we use one unified privacy policy family across them even when a feature or integration is enabled on only one storefront at a given time.

2. Information We Collect

Account data: name, email address, password credentials, affiliation details, plan status, and login/security metadata.
Order and content data: manuscripts, proposal drafts, reviewer comments, uploaded files, generated outputs, certificates, receipts, and order history.
Payment and billing data: transaction identifiers, billing status, subscription details, invoices, and limited payment metadata from processors such as Stripe.
Device and usage data: IP address, approximate location inferred from IP, browser type, page visits, referral data, interaction events, and real-time connection metadata (SignalR connection identifiers used to stream order progress to your browser).
AI usage metadata: per-order records of which AI provider and model was used, input/output/thinking token counts, estimated processing cost, and operation type. This data is linked to your order and used for internal cost tracking and service improvement; it is not shared with third parties except our infrastructure provider.
Preference data: theme choice, cookie-consent choice, language or region settings, email preferences, and support communications.
Connected-profile data: ORCID information if you choose to connect or sync an ORCID profile.

3. Cookies, Browser Storage, and Tracking

We use cookies, local storage, session storage, server logs, and email tracking technologies. These include strictly necessary authentication and session technologies, theme preferences, cookie-preference storage, email open/click tracking, and optional analytics where consent is required.

For more detail, including the specific technologies we use, please see our Cookie Policy.

4. How We Use Information

To create accounts, authenticate users, and secure the platform.
To process orders, subscriptions, credit balances, top-off purchases, refunds, and account requests.
To store, analyze, revise, translate, and return the files and outputs you request. Where you have connected an ORCID profile, your ORCID information (such as publication history and academic affiliation) may be included as contextual background in the prompts we send to AI providers in order to tailor editing and review outputs to your author profile.
To provide support, operational notices, password resets, and security alerts.
To allow authorized personnel, subject to confidentiality obligations, to review the uploaded files and generated outputs relevant to your request on a need-to-know basis when you ask for troubleshooting, quality review, file recovery, or other order-specific support.
To detect fraud, abuse, suspicious logins, chargeback risk, and misuse of our services.
To measure traffic and performance using analytics when you have permitted us to do so.
To send marketing communications when you opt in or when otherwise allowed by law.

5. Legal Bases for Processing

Depending on where you are located, we rely on one or more of the following legal bases:

Contract: to provide the services you request and manage your account.
Legitimate interests: to secure, improve, administer, defend, and troubleshoot the platform.
Consent: for optional analytics, some marketing communications, and any other processing where consent is required.
Legal obligation: for tax, accounting, sanctions, law-enforcement, and regulatory compliance.

6. How We Share Information

We share data only as needed to run the service, comply with law, or protect rights and safety. Categories of recipients include:

Infrastructure providers: cloud services for application hosting, U.S. object storage, U.S. database operations, and web application firewall filtering (which processes inbound request metadata including IP addresses and request headers for security filtering). All account data, uploaded files, generated outputs, and AI inference processing happen in the United States.
AI subprocessors: Anthropic, OpenAI, and Google (each via direct commercial APIs).
Payment providers: Stripe and related billing/fraud services.
Communications providers: our email delivery, SMTP, and transactional messaging vendors.
Analytics providers: Google Analytics where enabled and permitted by your consent choice.
Connected services: ORCID if you choose to connect your profile.
Professional advisers and authorities: auditors, insurers, legal counsel, regulators, and law enforcement where required or appropriate.

Our current named core subprocessors and service providers include our cloud infrastructure providers, Anthropic, PBC, OpenAI, LLC, Google LLC (Gemini API), Stripe, Inc., and ORCID, Inc. We may update our vendor roster from time to time and will update this policy or provide supplemental notice as appropriate. See our Subprocessors page for the current vendor list.

7. AI Provider Handling

We route text and prompts through commercial AI APIs (Anthropic, OpenAI, and Google) to deliver our services. None of these providers use API inputs or outputs to train their models, and we do not use customer-submitted content to train any models of our own.

Each provider may temporarily retain API content for limited operational purposes such as abuse monitoring, security, and system stability under its own terms. We do not attempt to restate those provider terms here because they can change at any time. Each subprocessor handles content under its own current terms of service and privacy policy, which you can review directly via the links on our Subprocessors page.

You should not submit content unless you are authorized to have it processed by us and our necessary subprocessors.

8. International Transfers

Our shared API, database, file storage, and AI processing all operate in the United States. AI provider calls (Anthropic, OpenAI, and Google) use commercial APIs and originate from our U.S. backend. Data may also be processed in other jurisdictions where our providers operate. We rely on each provider's published data-handling commitments, encryption in transit, and role-based access controls to protect transferred data.

9. Retention

Uploaded files and generated result files are generally retained for 90 days after order completion, then deleted from active storage.
Order metadata, credit history, billing records, and compliance logs are retained for up to 7 years for tax, accounting, and legal purposes.
Security logs, login events, and fraud-detection records are retained for up to 3 years.
Email suppression lists, security records, and limited identifiers may be retained indefinitely to honor opt-outs, detect fraud, and prevent repeat abuse.

10. Security

We use administrative, technical, and organizational safeguards such as TLS encryption, access controls, hosted infrastructure controls, security monitoring, rate limiting, and file-retention automation. No system can be guaranteed perfectly secure, and you use the service with that understanding.

If we confirm a reportable breach affecting your personal data, we will provide notice as required by applicable law. For users whose data is subject to GDPR or UK GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach where feasible, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

11. Your Rights and Choices

You may have rights to access, correct, delete, port, restrict, object to, or appeal certain processing decisions, depending on your jurisdiction.

EEA/UK: rights under GDPR/UK GDPR, including complaint rights with your supervisory authority.
U.S. state privacy laws: rights that may include access, deletion, correction, portability, and opt-out rights where applicable.
Marketing controls: you can unsubscribe from marketing emails and reject optional analytics where offered.
Account choices: you can ask us to delete your account, subject to records we must retain for legal or security reasons.

Where our processing of your personal data is based on consent (such as optional analytics), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. On RevisePilot you can withdraw cookie/analytics consent via the "Cookie Preferences" link in the footer. You may always contact us directly with questions.

If you submit materials on behalf of a university, lab, hospital, company, or other institution that contain personal data relating to authors, reviewers, research participants, or other third parties, you are responsible for ensuring you have an appropriate lawful basis and authorization to do so. Depending on the context, we may act as an independent controller for account, billing, security, and compliance data, and as a processor or service provider for customer-submitted content that we handle solely to deliver the requested services. We can provide a data processing addendum (DPA) on request.

To exercise rights, contact privacy@revisepilot.com. We may verify your identity before fulfilling a request. You may use an authorized agent to submit a request on your behalf; the agent must provide written, signed permission, and we may still contact you directly to confirm the request.

Appeals process: If we deny your request, you may appeal within 30 days of our response by emailing privacy@revisepilot.com with the subject line "Privacy Appeal". We will respond in writing within 60 days with the outcome and reasons. Where applicable law permits, you may also lodge a complaint with the supervisory authority in your jurisdiction.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

Right to know: You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
Right to delete: You may request deletion of your personal information, subject to legal exceptions.
Right to correct: You may request correction of inaccurate personal information.
Right to opt out of sale/sharing: See Section 13 below.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of personal information collected: Identifiers (name, email, IP address); commercial information (order history, subscription status); internet/electronic activity (page visits, interactions); professional information (affiliation); and inferences drawn from the above.

Business purposes for collection: Providing services, processing payments, account security, fraud prevention, analytics (with consent), and legal compliance.

Retention: Uploaded files are deleted 90 days after order completion. Billing records and order metadata are retained for up to 7 years for tax and accounting purposes. Security logs are retained for up to 3 years.

To submit a request, email privacy@revisepilot.com. We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice).

13. Do Not Sell or Share

We do not sell your personal information, and we do not make your personal information available to third parties for them to resell or for their own independent marketing.

We may use advertising-platform cookies, pixels, and conversion tags (for example, from Google, Meta, or similar platforms) to measure the performance of our own advertising and to show our own product ads to people who have visited our site (first-party retargeting). Depending on applicable law, this activity may be treated as “sharing” or cross-context behavioral advertising. We do not sell personal information and we do not run third-party ads on this platform.

You can opt out of optional advertising/analytics cookies at any time via the “Cookie Preferences” link in the footer, or by emailing privacy@revisepilot.com. We also honor Global Privacy Control (GPC) signals as a valid opt-out of the sale or sharing of personal information under applicable law.

We may create, use, and retain aggregated, de-identified, or anonymized data (for example, usage counts, service-performance metrics, and quality indicators) for operational, security, quality-assurance, product-improvement, and reporting purposes. This data is not used to re-identify individuals and is not treated as personal information under applicable law.

14. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. There is no uniform standard for how websites should respond to DNT signals. We do not currently alter our data-collection practices based on DNT signals. Where we use optional analytics (Google Analytics on our Global and Proposals frontends), those are governed by your cookie-consent choice rather than DNT headers.

We honor Global Privacy Control (GPC) signals as a valid opt-out of the sale or sharing of personal information under applicable law, including the California CCPA/CPRA.

15. China Users — PIPL Note

If you access RevisePilot from mainland China or are otherwise subject to China's Personal Information Protection Law (PIPL, 中华人民共和国个人信息保护法): NexGen Language Editing, LLC operates from the United States with no establishment in China. Account data and manuscript content are processed and stored in the United States. By creating an account or uploading content you consent to that cross-border transfer. PIPL access, correction, deletion, restriction, and consent-withdrawal requests: privacy@revisepilot.com.

16. Data Controller

The data controller for all personal information processed through our platform is:

NexGen Language Editing, LLC
PO Box 25
Norman, OK 73069
United States
privacy@revisepilot.com

Where GDPR, UK GDPR, or other applicable law requires us to appoint an EEA or UK representative, we will do so and publish the relevant contact details in this policy.

17. Automated Processing

Our services use automated AI-based processing to edit, translate, and review manuscripts. These automated processes produce editorial suggestions and revisions — they do not make legal decisions about you or produce effects with legal significance. You are always responsible for reviewing and accepting or rejecting any automated output before use. If you have concerns about automated processing of your content, contact us at privacy@revisepilot.com.

18. Sensitive and Special-Category Data

We do not intentionally collect sensitive personal information or special-category data (such as health data, political opinions, religious beliefs, or biometric data). Manuscripts you upload may incidentally contain such information. We process uploaded content solely to deliver the requested editing services and do not extract, categorize, or separately store any sensitive data that may appear within your documents.

19. Marketing and Email Tracking

If you opt in to marketing communications, we may send promotional messages and measure delivery, opens, clicks, and unsubscribe events. Transactional and service emails may still be sent when necessary to operate your account, complete purchases, or protect security.

20. Children's Privacy

The service is intended for academic, research, and professional authors and is not directed to children under 16 (or under 13 for U.S. users covered by COPPA). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact privacy@revisepilot.com and we will delete it from our records.

21. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will appear on this page with a revised effective date. If changes are material, we may provide additional notice through the website, dashboard, or email.

22. Contact

Privacy requests: privacy@revisepilot.com

General support: hello@revisepilot.com

NexGen Language Editing, LLC
PO Box 25
Norman, OK 73069