Privacy Policy

Last updated 13 August 2026

This policy explains what data Substratiq collects, why, and your rights over it.Substratiq is operated by Jasper Winkelmans ("we", "us"). If you have any questions, email supportdistill@gmail.com.

The short version: we collect the minimum needed to run the service — your email to sign you in, a daily count to enforce limits, and your subscription status. We do not store the text you paste on our servers, we don't sell your data, and we don't run advertising trackers.

What we collect

• Account data: your email address, handled by our authentication provider, Clerk.
• Usage data: how many distills you've used today and your plan (free or Pro), stored against your account so we can enforce fair limits.
• Payment data: processed entirely by Stripe. We never see or store your full card details.
• The text you paste: sent to the selected AI route—Anthropic, Google Gemini, or xAI—to generate your result and returned to you. Distill's current standard flows do not intentionally persist source text on our application servers; personal result history is stored in your browser unless a future project-storage feature is explicitly enabled.
• First-party product analytics: bounded event names, page paths, a random browser/session identifier, and your internal account ID when signed in. We use these to measure activation, reliability, retention, and cost. We do not include document text, prompts, outputs, email content, or payment credentials in analytics events.
• Marketing attribution: campaign parameters may be remembered for first-touch measurement. Advertising click IDs and browser pixels remain disabled unless marketing tracking is explicitly enabled and the required consent has been granted.
• Fair-use signals: a signed, essential cookie on your device holding only today's usage counts, so free limits can't be bypassed by creating new accounts. It contains no browsing history and expires within two days.

Why we use it (legal bases under the GDPR)

• To provide the service — performance of our contract with you (signing in, generating results, enforcing limits, processing your subscription).
• To keep it secure and improve it — our legitimate interests in preventing abuse and making the product better.
• Where required — your consent, which you can withdraw at any time.

Abuse detection and fair use

We run automated abuse-detection signals to enforce our Terms of Service and keep the service available for everyone. In practice this means: daily usage counters, a signed device-level cookie that limits automated or bulk use (such as scraping, bot traffic, or cycling through accounts to bypass free limits), and automated safety checks on chat messages. When a message is blocked, our logs store only an anonymised digest — never the text itself. These signals exist solely to protect the service and enforce fair limits. They are never used for advertising, profiling, or sold to anyone.

Who processes your data (sub-processors)

• Clerk — authentication and account storage.
• Stripe — subscription billing and payments.
• Anthropic — the AI that generates your results from the text you submit.
• Google Gemini — efficient document processing for selected routes.
• xAI — selected response and social-language routes.
• Vercel — hosting and delivery of the app.

These providers publish their own privacy, retention and sub-processor terms. Distill must maintain the applicable processor agreements and international-transfer safeguards; contact us for the current register before submitting sensitive professional material.

How long we keep it

We keep account and operational records while your account is active. Daily counters reset, while billing, Energy, withdrawal and security records may need longer retention for legal or dispute purposes. Account deletion does not override mandatory record-keeping; contact us to request deletion across Distill-controlled systems and processors.

Your rights

Under the GDPR you have the right to access, correct, delete, export, or restrict the use of your personal data, and to object to certain processing. To exercise any of these, email supportdistill@gmail.com. You also have the right to lodge a complaint with your local data protection authority.

Cookies

We use essential sign-in cookies from Clerk and a signed fair-use cookie holding daily usage counts for up to two days. First-party analytics identifiers are stored in browser storage. If consent-based marketing tracking is introduced, a separate consent state and this policy will identify it; advertising pixels are disabled by default.

Children

Substratiq is not directed at children under the age of digital consent in their country. If you believe a child has provided us personal data, contact us and we will remove it.

Changes

We may update this policy as the product evolves. We'll update the date at the top, and significant changes will be made clear.

Contact

Questions or requests: supportdistill@gmail.com.