Privacy Policy

01 Introduction

Smart Academic Writing (“we”, “us”, or “our”) operates the website at smartacademicwriting.com and all associated subdomains and services. This Privacy Policy describes the categories of personal data we collect, the purposes for which that data is used, the security measures applied to protect it, and the rights available to you under applicable data protection law.

By accessing or using our services, you confirm that you have read and understood this policy. If you disagree with any part of it, you should not use our services and should contact us to request account deletion.

This policy applies to all users globally. Specific rights under the General Data Protection Regulation (GDPR) apply to users in the European Economic Area. Specific rights under the California Consumer Privacy Act (CCPA) apply to California residents. We apply both frameworks as general standards across our entire user base rather than restricting enhanced protections to users in specific jurisdictions.

Smart Academic Writing is registered at 651 North Broad Street, Middletown, DE 19709, United States. For privacy inquiries, contact support@smartacademicwriting.com. We aim to respond to all privacy-related communications within five business days.

This policy was last substantively updated on October 24, 2024. A summary of changes from the previous version is available on request. The current version supersedes all prior versions of this document.

02 Information We Collect

We collect only the data necessary to operate our services. We do not collect data speculatively or build behavioral profiles beyond what is required for service delivery and legal compliance. The following categories describe what is collected, how, and why.

Account and Registration Data

When you create an account or place an order, you provide: your name, email address, and in some cases a phone number. Your email address is the primary identifier for your account. We do not require your institution name, student ID, or academic affiliation — this information is not part of our standard registration and providing it is not recommended.

Order and Assignment Data

When placing an order, you provide the content of your assignment brief: academic level, subject area, required word count, deadline, referencing style, and any uploaded documents including rubrics, prompt sheets, or reading materials. This content is transmitted to your assigned writer through our internal platform. It is not shared externally.

Technical and Usage Data

Our servers and analytics tools automatically collect technical data when you visit the site: your IP address, browser type and version, operating system, referring URL, pages visited, time on page, and device type. This data is used for security monitoring, fraud detection, and aggregate traffic analytics. It is not linked to your personal account unless a security incident requires cross-referencing.

Communication Data

Messages sent through our platform — including chat with support agents and messages within the order chat with your assigned writer — are logged and retained for quality assurance review. Support chat logs are retained for six months. Order communication logs are retained for 12 months alongside the order file.

• Account Data: Name, email, phone (optional). Used for account management and order communication.
• Order Data: Assignment brief, uploaded files, instructions. Used solely for order fulfillment.
• Technical Data: IP address, browser, device. Used for security monitoring and aggregate analytics.
• Communication Data: Chat logs within the platform. Retained for quality assurance and dispute resolution.
• Cookie Data: Session identifiers and analytics cookies. See Section 9 for full cookie details.
• Payment Data: Transaction reference numbers and payment status only. Card data is processed by third-party PCI-DSS processors and never stored on our servers.

03 How We Use Your Data

Each category of data we collect has a specific, defined purpose. We do not use data collected for one purpose to serve a different one. The legal basis for each processing activity is identified below in compliance with GDPR Article 6.

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on any individual user. Our order matching system uses order parameters (subject, level, deadline) to match assignments to writers — this is a filtering function, not a decision with legal consequence, and is not governed by GDPR Article 22.

Marketing emails are sent only to users who have opted in during registration or who have previously used our services, under the “soft opt-in” provision applicable in relevant jurisdictions. An unsubscribe link is included in every marketing email. Transactional emails — order confirmations, delivery notifications, revision updates — are sent regardless of marketing preference as they are required for service delivery.

04 Data Protection & Security

We apply technical and organizational security measures proportionate to the sensitivity of the data processed and the risks associated with our operations. The following describes the primary safeguards in place.

05 Third-Party Sharing

We do not sell, trade, rent, or share your personal identifying information with third parties for any commercial purpose. This includes academic institutions, universities, educators, advertising networks, and data brokers. This restriction has no exception for financial consideration — we do not sell data.

Limited data sharing occurs only in the following circumstances, all of which are necessary for service operation:

• Payment Processors: Transaction data is shared with Stripe and PayPal for payment processing. These processors are PCI-DSS Level 1 certified. They receive only the payment data required to process the transaction. They do not receive order content, assignment briefs, or any information about the nature of our service beyond the transaction amount.
• Hosting and Infrastructure Providers: Our servers are operated by a managed hosting provider. This provider has access to server infrastructure but not to unencrypted personal data. Data processing agreements are in place with all infrastructure providers.
• Analytics Tools: Anonymized and aggregated traffic data is processed by website analytics tools. These tools are configured to not store personally identifiable information. We do not use analytics configurations that enable user-level tracking or cross-site behavioral profiling.
• Legal Obligations: We may disclose specific data if required by a valid legal order from a court or regulatory authority with jurisdiction over our operations. We are not aware of any legal mechanism that would require us to disclose client data to an educational institution. If we receive such a request, we will seek legal advice before complying and will notify the affected user where legally permitted to do so.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, client data may be transferred to the acquiring entity. You will be notified by email at the address associated with your account before any such transfer occurs and will be given the option to request deletion of your data prior to the transfer.

We do not use client data to train machine learning models, including large language models or AI systems, whether operated by us or by third parties.

Writers on our platform are independent contractors. They are bound by confidentiality agreements that prohibit them from disclosing order content, retaining copies of completed work, or contacting clients outside the platform. Violations of these terms result in immediate suspension and are addressed through contractual enforcement.

06 Payment Security

Smart Academic Writing does not store credit card numbers, bank account details, or CVV codes on our servers at any point during or after a transaction. All payment data is entered directly into the payment processor’s secure form using an iframe hosted on the processor’s infrastructure — card data does not pass through our web server.

Payment processing is handled by Stripe and PayPal, both of which hold PCI-DSS Level 1 certification — the highest level of compliance under the Payment Card Industry Data Security Standard. The PCI DSS is the framework governing secure handling of cardholder data. Our processors undergo annual audits by a Qualified Security Assessor (QSA) to maintain this certification. More information about PCI-DSS is available at the PCI Security Standards Council Document Library^[1].

We receive from our payment processors only: a transaction reference number, payment status (succeeded / failed / pending), the last four digits of the card used (for support reference), and the billing country code. This is the minimum information required to manage your order and support payment disputes. We cannot initiate charges from this information alone.

Refunds processed through our refund policy are returned to the original payment method. We do not issue refunds to a different card or account than the one used for payment, as this would conflict with anti-money-laundering compliance requirements. Refund processing times are determined by your card issuer or PayPal, typically 5–10 business days.

Disputes raised through your bank or payment provider (chargebacks) are responded to through the processor’s dispute resolution process. We provide transaction records and delivery evidence to support the resolution of disputes. Initiating an unjustified chargeback for a delivered order may result in account suspension pending resolution.

07 Data Retention Policy

We retain personal data only as long as necessary for the purpose for which it was collected, subject to legal obligations that may require longer retention. The following schedule applies to all categories of data we collect.

If you request account deletion, your account data is flagged for deletion and removed within 90 days. During this grace period, your data remains accessible to you if you change your mind. After 90 days, personal account data is permanently deleted. Transaction records are retained for 7 years even after account deletion due to legal accounting requirements — these records are anonymized where possible once the account no longer exists.

We do not indefinitely accumulate data on inactive accounts. Accounts that have been inactive for more than three years with no open orders and no login activity receive an automated notification and are scheduled for deletion 30 days after notification unless the account owner logs in or responds.

08 International Data Transfers

Smart Academic Writing operates as a global service. Our servers are located in the United States. If you access our services from outside the United States — including from the European Economic Area, United Kingdom, Canada, or Australia — your data will be transferred to and processed in the United States.

The United States does not benefit from an EU adequacy decision under GDPR, meaning it is not deemed to provide an automatically equivalent level of data protection to the EEA. To ensure your data remains protected during transfer, we use the following safeguards:

• Standard Contractual Clauses (SCCs): Where we transfer personal data from the EEA or UK to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (SCCs) incorporated into our data processing agreements with infrastructure and service providers. SCCs create legally binding obligations on the data importer to protect the data to EEA standards.
• Data Processing Agreements (DPAs): All third-party processors who handle personal data — including our hosting provider and payment processors — are bound by data processing agreements that specify the technical and organizational security measures they must maintain and the purposes for which they may use the data.
• UK GDPR Compliance: For data transfers from the United Kingdom, we apply the UK International Data Transfer Agreement (IDTA) as the transfer mechanism where required, following the UK’s post-Brexit data transfer framework.
• Encryption as a Supplementary Measure: All data in transit is encrypted before transfer, meaning the data is not in a form accessible to any intermediary or the recipient infrastructure provider without the encryption keys, which we retain.

Writers on our platform are distributed globally. When order content is transmitted to a writer outside your jurisdiction, that transmission constitutes an international transfer subject to the same safeguards described above. Writer confidentiality agreements include data protection obligations consistent with our privacy policy requirements.

09 Cookies and Tracking Technologies

We use cookies and similar technologies for three distinct purposes: functional operation of the platform, security, and analytics. A cookie consent banner is displayed to all users on first visit, allowing you to accept or decline non-essential cookies before they are set.

We do not use third-party advertising cookies or allow advertising networks to set cookies on our platform. We do not participate in cross-site tracking or retargeting programs. Analytics data is processed using tools configured to respect Do Not Track (DNT) browser signals.

You can manage or delete cookies at any time through your browser settings. Deleting session cookies will log you out of the platform. Blocking strictly necessary cookies will prevent the platform from functioning correctly. The full cookie policy, including a complete list of cookies set and their specific retention periods, is available at smartacademicwriting.com/cookie-policy/.

10 Your Data Rights

Under GDPR and equivalent legislation, you have the following rights regarding your personal data. California residents have additional rights under CCPA, described at the end of this section. We process all rights requests within 30 days of receipt.

CCPA Rights (California Residents)

Under the California Consumer Privacy Act, California residents have the right to know what personal information is collected and how it is used; the right to delete personal information held by us; the right to opt out of the sale of personal information (we do not sell personal information); and the right to non-discrimination for exercising CCPA rights.

California residents may submit a verifiable consumer request by emailing support@smartacademicwriting.com with the subject line “CCPA Request.” We will respond within 45 days, with a possible 45-day extension where required. We process no more than two verifiable consumer requests from any individual in a 12-month period.

11 Children’s Privacy

Our services are intended for use by individuals aged 18 and above who are enrolled in or applying to academic programs. We do not knowingly collect personal information from anyone under the age of 13, or under the age of 16 where that higher age threshold applies under local law (including in the European Union under GDPR).

If you become aware that a minor has created an account or provided personal data to us, contact support@smartacademicwriting.com immediately. We will verify the account and, if confirmed to belong to a minor, delete all associated data within 72 hours of confirmed identification.

Our registration process does not include age verification beyond a checkbox declaration. We rely on users to provide accurate information about their age. If we have reason to believe that a user is under the minimum age, the account is suspended pending age verification.

12 Data Breach Notification Protocol

A personal data breach is any security incident that results in unauthorized access to, disclosure of, alteration of, or destruction of personal data we process. Our protocol for responding to a confirmed breach is as follows.

• Detection and Containment (0–6 hours): Upon becoming aware of a potential breach, our security team isolates the affected system to prevent further unauthorized access, preserves evidence, and begins forensic investigation to determine the scope and nature of the incident.
• Assessment (6–24 hours): We determine whether the incident constitutes a personal data breach under applicable law — specifically, whether personal data of identifiable individuals has been compromised. We assess the categories of data affected, the likely number of individuals affected, and the probable consequences.
• Regulatory Notification (within 72 hours of confirmation): If the breach is likely to result in a risk to the rights and freedoms of individuals, we notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required under GDPR Article 33. The notification includes the nature of the breach, categories and approximate number of individuals and records affected, the name and contact details of our Data Protection Officer, the likely consequences, and the measures taken or proposed to address the breach.
• Individual Notification: Where a breach is likely to result in a high risk to your rights and freedoms, we notify you directly without undue delay. The notification is sent to the email address associated with your account and will describe the nature of the breach, the data affected, the steps we recommend you take to protect yourself, and the contact information for our privacy team.
• Remediation: Following containment and notification, we implement technical and organizational measures to prevent recurrence. These measures are documented and reviewed by independent security assessment within 90 days of the incident.

13 Writer Privacy and the Team Behind Your Orders

Our writers are independent contractors based in multiple countries. Their personal data — including payment information, identity documents submitted during onboarding, and communication records — is processed separately from client data and subject to the same technical security standards described in this policy.

Writer profiles are published publicly on our authors page with their consent. Public profiles include: the writer’s chosen display name, their academic background and qualifications, their subject specializations, and their completed order count. Contact details, identity documents, and payment information are never published. Writers may request removal from the public authors page at any time.

The following writers have public profiles published at smartacademicwriting.com/authors/:

14 Policy Changes and Version History

We reserve the right to update this Privacy Policy at any time. Updates are made in response to changes in applicable law, changes in our data processing practices, changes in the services we offer, or recommendations from legal counsel or data protection authorities.

When we make material changes — changes that affect how we use your personal data in a way that could affect your rights — we will notify you by email to the address associated with your account at least 14 days before the changes take effect. For non-material changes (such as formatting updates, clarifications that do not change the substance of the policy, or corrections to typographical errors), we update the “Last Updated” date at the top of this page without individual notification.

The version of this policy in effect at the time you placed an order governs the handling of the data collected in connection with that order. If you continue to use our services after a material change takes effect and the notification period has passed, you are deemed to have accepted the updated policy. If you disagree with a material change, you may request account deletion before the change takes effect.

Previous versions of this policy are available on request by emailing support@smartacademicwriting.com with the subject line “Privacy Policy Version History.” We retain previous versions for a minimum of three years after supersession.

15 Privacy FAQs

16 Contact Us

For all privacy-related inquiries — rights requests, data deletion, complaints about how your data has been handled, or questions about this policy — contact our privacy team directly. We respond to all privacy communications within five business days. Rights requests under GDPR or CCPA are processed within 30 days of receipt.