GDPR Policy

Version: 2.1
Effective Date: July 4, 2025
Last Updated: July 4, 2025
Data Protection Officer: [email protected]

FactCheck AI is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Legal Basis for Processing

We process your personal data under the following legal bases:

Contractual Necessity (Article 6(1)(b) GDPR):

• Creating and managing your user account
• Providing fact-checking services
• Processing subscription payments
• Delivering customer support

Legitimate Interests (Article 6(1)(f) GDPR):

• Preventing fraud and abuse
• Improving service quality and performance
• Security monitoring and threat detection
• Analytics for service optimization

Consent (Article 6(1)(a) GDPR):

• Marketing communications (where applicable)
• Optional analytics and usage tracking
• Cookie placement (non-essential cookies)

Legal Obligation (Article 6(1)(c) GDPR):

• Compliance with financial regulations
• Data breach notifications
• Law enforcement requests

2. Categories of Personal Data

We process the following categories of personal data:

Identity Data:

• Username
• Email address
• Encrypted password
• Account preferences

Technical Data:

• IP address
• Browser type and version
• Device information
• Operating system
• Session identifiers

Usage Data:

• Fact-check queries submitted
• Quiz performance and scores
• Feature usage patterns
• Login timestamps
• Subscription status

Security Data:

• Failed login attempts
• Security incident logs
• Device fingerprints for fraud prevention
• Two-factor authentication settings

Communication Data:

• Support ticket correspondence
• Feedback submissions
• Security notifications sent

3. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15)

Request a copy of all personal data we hold about you, including categories of data processed, purposes of processing, recipients of data, retention periods, and your other GDPR rights.

Right to Rectification (Article 16)

Request correction of inaccurate or incomplete personal data.

Right to Erasure (Article 17)

Request deletion of your personal data when no longer necessary for original purposes, you withdraw consent, data processed unlawfully, or required for legal compliance.

Right to Restrict Processing (Article 18)

Request limitation of processing when accuracy is contested, processing is unlawful but deletion not wanted, data no longer needed but required for legal claims, or objection is pending verification.

Right to Data Portability (Article 20)

Receive your personal data in structured, commonly used format and transmit to another controller.

Right to Object (Article 21)

Object to processing based on legitimate interests or for direct marketing.

Right to Withdraw Consent (Article 7(3))

Withdraw consent at any time where processing is based on consent.

Right to Lodge a Complaint (Article 77)

File complaints with supervisory authorities if you believe your rights have been violated.

4. Exercising Your Rights

To exercise any GDPR rights:

Contact Methods:

• Email: [email protected]
• Data Protection Officer: [email protected]

We will respond within one month of receipt. Complex requests may require up to three months. Exercising your rights is free of charge.

5. Data Retention

We retain personal data for specific periods:

• Account data: Duration of account plus 90 days
• Security logs: 2 years for fraud prevention
• Support tickets: 3 years
• Some data may be retained longer for legal compliance

6. Data Protection Measures

Technical Safeguards:

• End-to-end encryption for data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Multi-factor authentication for admin access

Organizational Measures:

• Staff data protection training
• Access controls and need-to-know basis
• Data processing agreements with third parties
• Regular policy reviews and incident response procedures

7. Data Breach Procedures

• Continuous monitoring for security incidents
• Supervisory authority notification within 72 hours (if high risk)
• Individual notification without delay (if high risk to rights)
• Immediate containment and forensic investigation

8. Children's Data

FactCheck AI is not intended for use by individuals under the age of 13. Users aged 13 to 17 may use the app only with the consent and supervision of a parent or legal guardian.

We do not knowingly collect personal data from users under 13 without such consent. If we become aware that a child under 13 has registered without verified consent, we will take steps to delete the account.

While parents or legal guardians who provide consent may request general information about their child's use, we do not guarantee access to a child's full account activity, responses, or history to preserve privacy and data security.

By using the app, you confirm that you meet the age requirements or have received appropriate consent.

9. Supervisory Authorities

Primary Authority:
Information Commissioner's Office (ICO) - United Kingdom
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
Website: ico.org.uk

10. Contact Information

General Inquiries: [email protected]
Data Protection Officer: [email protected]
Legal Department: [email protected]