Privacy notice

• What you type is not used to train any model — ours or anybody else’s.
• The grading itself runs on your own device against a local table. A reading can be produced with no connection at all.
• Nothing is sold, and nothing is shared for advertising. There are no advertising or analytics trackers on this site.
• Only what is needed to run the service is kept, and only for as long as it is needed.
• You can ask for a copy of your data, or for it to be deleted, at any time — and it will be done within one month.

The data controller is AMALTE LTD, trading as Wrongstep. Registered details and contact information are on the legal information page. For anything about your data, write to support@amalte.shop — it goes to a person.

What you write into the tool

The sentence describing what you are putting together. On the free plan and without an account it is held on your own device and is not sent to a server at all. With an account, and only if you have asked for your place to be kept, it is stored so a job spread over several evenings survives closing the tab.

Lawful basis: performance of a contract — running the service you asked for. Kept for: until you delete the item, or twelve months after your last use of it, whichever comes first.

Account details

Email address and a hashed password, if you create an account. Plain passwords are never stored.

Lawful basis: performance of a contract. Kept for: as long as the account is open, then 30 days.

Subscription and payment records

Which plan, when it started, what was charged and when. Card details never reach Wrongstep: they are handled by the payment processor configured by whoever deploys the service, and are not stored here.

Lawful basis: performance of a contract, and legal obligation for the records tax law requires. Kept for: six years from the end of the accounting period, as UK tax law requires.

Correspondence

Emails you send, and the replies. Lawful basis: legitimate interests — answering you and keeping a record of what was said. Kept for: two years.

Technical records

Server logs recording requests, with IP addresses truncated. Used to keep the service running and to spot abuse. Lawful basis: legitimate interests — security and reliability. Kept for: 30 days.

There is no analytics product on this site, no advertising pixel, no session recorder and no profiling. Nothing here builds a picture of you.

What you write is not used to train, fine-tune, evaluate or improve any machine learning model, ours or a third party’s. It is not pooled into a dataset. It is not licensed to anyone. If that ever changed it would require your active, separate, opt-in consent, and it would not be done by quietly amending this page.

Only the processors needed to run the service, each under a contract that limits them to acting on instructions:

• The hosting provider that serves this site.
• The payment processor configured by whoever deploys the service, which handles card details directly and is the only party that sees them.
• The email provider that delivers confirmations, receipts and replies.

Beyond that, data is disclosed only where the law requires it. It is never sold, never rented, and never shared for advertising.

Some processors operate outside the United Kingdom. Where personal data is transferred out of the UK it is protected either by UK adequacy regulations, or by the International Data Transfer Agreement (IDTA), or by the European Commission’s standard contractual clauses together with the UK International Data Transfer Addendum, along with a transfer risk assessment. A copy of the safeguards used can be requested at the address above.

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• be told what is held about you, and get a copy of it;
• have anything inaccurate corrected;
• have your data erased;
• restrict how it is used while a question about it is resolved;
• receive it in a portable form, or have it sent directly to someone else;
• object to processing carried out on the basis of legitimate interests;
• withdraw consent at any time, where consent is what the processing rests on.

Ask at support@amalte.shop. Requests are answered within one month, free of charge, and no reason has to be given.

If you think your data has been handled wrongly, please tell us first — but you have the right to complain directly to the Information Commissioner’s Office, the UK supervisory authority for data protection, at any time, and you do not need to have contacted us first.

Wrongstep does not sell or share personal information as the California Consumer Privacy Act uses those words, and it does not use personal information for cross-context behavioural advertising. You have the right to know what is collected, to have it deleted, to have it corrected, and not to be treated differently for exercising any of those rights. Ask at the address above.

Wrongstep is for adults and accounts are not knowingly opened for anyone under 18. If you believe a child has created an account, write to support@amalte.shop and it will be closed and the data deleted.

Which cookies exist, what each one does and how to change your mind are on the cookies page.