Privacy Policy

Descartes ("Descartes", "the service") is a cloud-based editorial platform that helps publishers research, commission, review and publish content with AI assistance while keeping human editors in control of what goes live. Descartes is owned and operated by Genesoft Ltd, a company registered in England and Wales (company number 05530522) ("we", "us", "our"). We are the data controller for the personal data described in this policy.

Contact for privacy matters: hello@genesoft.co.uk.

This policy explains how we handle personal data when you visit our website, create or use a Descartes account, subscribe, purchase article credits, or contact us. It applies to visitors, customers, and members of customer teams.

• Account and organisation information — your name, email address, and the name of your organisation or publication; your role and permissions within your organisation's workspace.
• Billing information — subscription and credit-purchase records handled by our payment provider. We do not store full card details; payments are processed by the payment provider, which passes us payment status and limited customer identifiers (for example your email address and a payment provider customer reference).
• Content you enter or publish — the material your team enters into Descartes, including commissions, drafts, reviews and approval records. This may contain personal data relating to your own team members, readers or sources; see section 10.
• Support and correspondence — messages you send us, including by email.
• Technical information — standard server and hosting logs (IP address, browser type, timestamps, pages and API requests) used to operate, secure and improve the service.
• Cookies — we only use cookies (and equivalent browser storage) that are necessary to operate the service, such as keeping you signed in. If we add analytics or marketing cookies in future we will ask for your consent first and update this policy.

• To create and administer your account, workspace and permissions (contract).
• To provide the service, process subscriptions and credit purchases, and send service and billing communications (contract).
• To send updates or newsletters you signed up for (consent — you can withdraw at any time).
• To keep the service secure, prevent abuse, investigate incidents, and maintain audit records (legitimate interests, and legal obligation where records are required).
• To understand aggregate usage and improve the service (legitimate interests).
• To meet legal or regulatory obligations, including tax and accounting requirements (legal obligation).

We do not sell your personal data, and we do not use your content or personal data to train third-party AI models.

Descartes uses automated and AI-based processes to discover stories, research them, prepare drafts and run editorial checks. When your team commissions work, the content you provide and materials generated during the workflow are processed by us and by third-party AI service providers acting on our instructions.

We do not use your content to train third-party AI models. AI-generated material can contain errors or resemble existing published works; responsibility for reviewing and approving everything you publish remains with you, as set out in our Terms and Conditions.

We use a small number of service providers to deliver the service. They process data only on our instructions and under appropriate safeguards:

• Hosting and infrastructure — to run the service and store data.
• Payment processing — to take subscription and credit payments.
• Email delivery — to send authentication, notification and transactional emails.
• AI service providers — to carry out research, drafting and editorial checks you commission.
• Publishing integrations — services you choose to connect, such as Ghost, where you direct us to publish content on your behalf.

Some providers may process data outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy regulations or standard contractual clauses.

We may also disclose data where required by law, or to protect the service, our customers or the public.

We keep personal data only as long as needed for the purposes above:

• Account and workspace data — for as long as your account is active.
• Billing and transaction records — for the period required by UK tax and accounting law.
• Editorial and audit records — for a reasonable period so that publishers can demonstrate how published content was produced and approved.
• Support correspondence — for a reasonable follow-up period.
• Server logs — for a limited period for security purposes.

When data is no longer needed we delete or anonymise it. If you close an account, we may retain limited records where required by law or for the establishment, exercise or defence of legal claims.

Under UK data protection law you have the right to access, correct, delete, restrict or object to our use of your personal data, the right to data portability, and the right to withdraw consent where we rely on it. To exercise any right, contact us at hello@genesoft.co.uk.

If you are a member of a customer team, some account details (such as your name, email address and permissions) may be managed by your organisation's owners or administrators; we may involve them where appropriate when handling your request.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, role-based permissions within workspaces, and audit logging of significant actions. No system is completely secure, but we design our safeguards to reduce risk and respond promptly to any incident.

Descartes is a business service intended for adults and organisations. It is not directed at children, and we do not knowingly collect personal data from children.

If you use Descartes to process personal data relating to your own team members, readers or sources (for example, names in an article or in commissioning notes), you are the controller of that data and we act as your service provider, processing it only to provide and secure the service for you. Your use of Descartes for that processing must comply with data protection law, and your obligations are set out in our Terms and Conditions.

We may update this policy from time to time. The "last updated" date above shows the current version; we will give notice of significant changes in the service or by email before they take effect.

Descartes is operated by Genesoft Ltd (company number 05530522). Questions about this policy or how we handle personal data: hello@genesoft.co.uk.