Privacy Policy
Last updated: October 2026
Governing Idea ("we," "our," or "us") provides an AI‑powered business writing course and writing workspace that teach users to structure their thinking and communicate with clarity, and check the structure of what they write. We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use it, and the rights you have under applicable laws, including the EU General Data Protection Regulation (GDPR).
1. Information We Collect
We collect information you provide directly to us, such as your name, email address, or any text you enter into Governing Idea. We also collect basic device and usage data to maintain performance, prevent abuse, and ensure security.
If you contact us or join the beta waitlist without an account, we collect what you give us. Through the contact form, that is your name, email address and message. Through the waitlist, it is your full name and email address. If you use the contact form to ask about a pilot for your team, we also keep your name, email address and message in our database so we can follow up.
We do not collect or store sensitive personal information unless you intentionally provide it. We do not use your content to train AI models, and we do not sell personal data.
2. How We Use Your Information
We use your information to provide and improve Governing Idea, maintain security, communicate with you about updates or support, and analyze usage trends to improve product performance. If you contact us, we use your details to reply. If you join the beta waitlist, we use them to manage access: to confirm your place, and we may invite you when access is available. If you ask about a pilot, we use your details to discuss and arrange it, and we may invite you or your team when access is available.
3. Lawful Basis for Processing (GDPR)
If you are located in the European Union, we process your personal data under the following lawful bases:
- Contract: To provide Governing Idea and related services.
- Legitimate Interest: To maintain security, prevent misuse, and improve the product.
- Consent: Only when you explicitly opt in to optional features.
- Legitimate Interest, or steps at your request before a contract: To reply to an inquiry you send us, and to handle a request to join the beta.
4. How Your Content Is Handled
Your writing is processed to check its structure and, for a file you upload, to read it into the Write workspace. We do not use your content to train AI models, and our AI provider's commercial terms prohibit it from training models on your content. It is not shared with anyone other than the subprocessors listed on our Subprocessors page and, if your organization provides your access, your manager as described below.
Your manager. If your organization provides your access, your manager can see your lesson and checkpoint scores, your progress status (including whether you have accepted the terms), when you were last active, and, once you have a band, the Write Your Own document that earned it. Managers cannot see your drafts in progress or anything you write in the Write workspace.
Governing Idea staff. Our staff can see your work and use it only to run, support and improve the service.
Your content is stored in your account, not only for the current session. Drafts you save are kept so that you can resume them. On each graded attempt in the Write Your Own module, a copy of the document as it was graded is frozen and kept with that grade, which is what lets you see your history of attempts.
Until October 2026 the Write workspace included a writing coach you could ask questions. It has been removed. A Write session saved while it was available may still hold that conversation until the session is next saved, which happens when you edit it. If you request a copy of your data before then, it is included. Deleting the session, or your account, removes it.
You may request a copy of your data, or erasure of your account and your content, by contacting us through our contact form. Section 8 sets out your rights and section 9 what deletion reaches.
To check your writing, and to read the structure of a file you upload to Write, your document text and the text of that file are sent to Anthropic, the model provider. No identifier travels with them. Each request carries your text and the model's instructions and settings, and nothing else: no user id, no email address, and no metadata field.
5. Cookies and Analytics
We do not use analytics, and we do not use advertising or tracking cookies. With neither in use, the site does not need a cookie banner. You may disable cookies in your browser settings.
6. Data Sharing and Subprocessors
We share limited information with the service providers who support hosting, data storage, authentication, email delivery, and AI processing.
A current list of our subprocessors, and what each one processes, is on our Subprocessors page.
We do not sell or rent personal information.
7. International Data Transfers
If you are located in the EU or UK, your data may be transferred to the United States. Each of our subprocessors relies on one of two transfer mechanisms.
Vercel and Resend are certified under the Data Privacy Framework. Vercel is certified under the EU-U.S. and Swiss-U.S. frameworks and the UK Extension, covering HR and non-HR data. Resend is certified under the EU-U.S. framework and the UK Extension, for non-HR data only; its re-certification is under review.
Anthropic and Supabase are not on the Data Privacy Framework register. Transfers to them rely on Standard Contractual Clauses incorporated in each vendor's data processing addendum: for Anthropic, Modules 2 and 3, incorporated on acceptance of its commercial terms; for Supabase, the clauses approved by the European Commission together with the UK ICO addendum.
Data Privacy Framework certifications are renewed annually. The register maintained by the U.S. Department of Commerce is authoritative for each vendor's current status; the statements above reflect it as of September 2026.
8. Your Rights (EU/EEA Users)
If you are located in the EU or EEA, you have the right to access, correct, delete, or export your personal data, object to processing, or withdraw consent where applicable. You may exercise these rights by contacting us through the link below. Where your access to Governing Idea is provided by your employer, your employer is the data controller and requests are fulfilled on its instruction; we will tell you if that applies to you. You can correct your name yourself on your profile page. To change your organization, contact us or your organization's administrator.
9. Data Retention
We keep your personal data and your content for as long as your account exists. You may request deletion at any time; your rights, including erasure, are set out in section 8. Deletion removes your account and everything stored against it from our database. It does not reach copies our service providers hold under their own retention terms — server and request logs, database backups for their retention window, the model provider's retention of request content, and email delivery records — or data on your own devices. Those copies are deleted on the providers' own schedules: server and request logs (Vercel) within 30 days; database backups and logs (Supabase) within 7 days; content sent to our AI model provider (Anthropic) within 30 days, except that content flagged for a possible breach of Anthropic's usage policy may be kept for up to two years; and email content and delivery records (Resend) within 30 days. We keep a record that a deletion happened and how many records it removed, with no name, address or identifier in it.
If you join the beta waitlist without an account, we keep your details until you are invited or ask to be removed. If you ask about a pilot for your team, we keep your inquiry until the pilot is arranged or declined, or for 12 months, whichever is sooner, unless you ask us to delete it earlier. If you send us any other inquiry through the contact form, we keep it for as long as we need to handle that inquiry. When we invite you, we keep your email address and a one-way code for your invitation link until you accept it or we withdraw it. Any of these can be deleted at any time on request, through the contact form or by replying to any email from us. If you go on to create an account, your data is then kept as described above.
10. Data Security
We use reasonable administrative, technical, and physical safeguards to protect your information. No system is perfectly secure, but we work to minimize risk and follow responsible practices. In the event of a data breach involving personal data, we will notify affected users without undue delay.
11. Children's Privacy
Governing Idea is designed for working professionals and is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy as the product evolves. We will update the "Last updated" date when changes are made.
13. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us.
14. Data Processing Addendum (DPA)
For contractual data protection terms, including our obligations as a data processor under GDPR Article 28, please review our Data Processing Addendum.