Explain a Paper home

Privacy policy

Last updated 7 November 2026.

Who we are

Explain a Paper is provided by Digital Tactics Ltd. When this policy says "we" or "us", it means Digital Tactics Ltd.

Company
Digital Tactics Ltd., a private limited company registered in England and Wales
Company number
07666910
Registered office
Ground Floor, 19 New Road, Brighton, East Sussex BN1 1UF, United Kingdom
ICO registration
Z2807798

What we collect

  • When you email us or use a form: your name, email address, anything you write, and, for an institution enquiry, your institution and the number of videos you expect.
  • When you sign in: your email address and name, a record of your sign-ins and sessions, and your IP address, which we use briefly to limit repeated sign-in requests.
  • If you turn on two-factor sign-in: the secret key your authenticator app shares with us, stored encrypted; your recovery codes, stored only in a scrambled (hashed) form that cannot be turned back into the codes, with a note of which ones you have used; and a random identifier for each browser that has completed two-factor sign-in, so we can email you when your account is signed in to from a new one. We keep these only while two-factor sign-in is on.
  • If you belong to a team: the team's name, its members and their roles, invitations you send or receive, and any brand assets an owner uploads.
  • If you save a brand: its name, colours and fonts; the logos, font files and brand guidelines you upload; the website address you ask us to read it from, and what we found there (its public colours, fonts and logo images); and when and by whom you confirmed you may use the brand in your videos.
  • When you order a video: the paper you upload, what you tell us about it (audience, length, emphasis, voice, whether it is confidential or embargoed, whether the video may show the paper and, if so, why it may be adapted), your change requests, and the scripts, video, captions and transcript we produce.
  • Your videos' footprint: when each script is drafted or your edits are saved, when each video is rendered (with its length and how long the rendering took) and when each file is downloaded (with its size), so that we can show you the estimated electricity and CO2e on each video's page and your account page. We keep these with your account's records, and deleting a video does not delete them, so your account's total stays complete. They hold nothing from your paper or script.
  • If you buy a lesson pack: the lesson we make from your video, the records of the reviews that checked it, any changes you ask for and the notes you write with them, who in your account approved the lesson and when, and whether its share link is on.
  • When you pay: what you bought, the amount, the date, the acknowledgements you gave at checkout, and the reference Stripe gives your payment. Card details are entered on Stripe's own checkout page and never reach this site or our servers.
  • If you sign up for our newsletter: your email address; when you signed up and when you confirmed; the page you signed up on; which version of the sign-up wording you saw; and the country your connection came from, which Cloudflare works out from your IP address (we do not keep the IP address itself).
  • About our emails: whether an email to you bounced or was reported as spam, so we can stop sending to that address.

Why we hold it, and on what basis

We use your information to provide the service you asked for: to run your account, to make, revise and deliver your videos, to take payment, and to answer your messages. The lawful basis is the contract with you, or the steps you asked us to take before one. We keep a record of each sale because UK accounting and tax law requires it. We have a legitimate interest in keeping the site secure and free of abuse. We send our newsletter only with your consent (see "Our newsletter").

We do not sell your information, share it for anyone else's marketing, or use your papers, feedback or videos to train any AI model, ours or anybody else's. We make no decisions about you by automated means alone.

If you send us a notice about material on our service, or answer one about your own videos, we use what you send to deal with it and to keep a record of how we did. The lawful basis is our legitimate interest in handling complaints about content fairly and in establishing or defending legal claims. We share what a notice says with the customer concerned, but share the sender's name only where the customer needs it to respond, and we tell the sender before we do.

Our newsletter

The "Keep in touch" form at the foot of each page signs you up to hear from us about new features, offers and special events. We send these emails only with your consent, which is the lawful basis (UK GDPR Article 6(1)(a), and the Privacy and Electronic Communications Regulations for marketing email).

We ask twice. When you enter your address we send a confirmation email, and you are subscribed only when you click the link in it. The link works once and lasts 72 hours; if you do not click it, we delete the sign-up. We record when you confirmed, the page you signed up on, the wording you agreed to and your country (see "What we collect"), so that we can show you gave consent.

We use no third-party mailing-list provider. The list is kept in our own database, hosted by Cloudflare, and our emails are sent through Resend, which already sends our other emails (see "Who processes your information"). We never share the list or sell it.

You can withdraw your consent at any time, as easily as you gave it: use the unsubscribe link in any newsletter email, which works in one click, or email [email protected]. When you unsubscribe we delete your subscription and keep only a scrambled (hashed) copy of your email address, which cannot be read back as your address, so that we can make sure we do not email you again. If you later sign up again, we ask you to confirm afresh. Unsubscribing does not affect emails about your account or your orders.

Our role: controller and processor

For your account, your orders and payments, our emails with you and our own business records, we decide how your information is used, which makes us the controller under UK GDPR and the Data Protection Act 2018.

For the papers and other personal data that an organisation's team uploads to its team account, such as author names and affiliations in a paper, we act as the organisation's processor: we use that information only on its instructions, to make its videos. The organisation is the controller, and questions about that information are best raised with it first.

Data processing agreement

We offer every organisation account a data processing agreement under Article 28 of UK GDPR, setting out how we process personal data on its behalf. You can read the template data processing agreement, and we will sign it with your organisation on request: email [email protected].

Papers and files you upload

A paper you upload is used to make your video and for nothing else. It is stored privately, is never shown back on the site, and is opened only by our team and our own video-making tools. Please remove anything that could identify research participants before you upload.

If a paper is unpublished, under embargo or confidential, mark it when you order. Nothing from a flagged paper is published or used as a sample, and everyone on our team who handles it sees the flag. A paper marked confidential or under embargo is sent to a language model only under a zero-data-retention arrangement, or to a private model on infrastructure we control (see "Who processes your information").

Brand files (logos, font files and brand guidelines) are stored privately with your account and used only to make your videos. Logos and fonts are shown back only to members of your account, in the brand preview; brand guidelines are seen only by our team. When you import a brand from a website, our servers fetch that public page and its stylesheets and logo images, and keep what they found for a day, so that importing it again does not fetch it again.

Ordering before you sign in. If you fill in the order form without signing in, we keep what you enter, your email address and any paper you upload for up to 7 days, so that you can confirm the order from the link we email you. If you do not confirm it within that time, we delete them. When you confirm it, they become part of your account and order, as for any other order. We use a cookie, __Host-ep_guest, to link your browser to the form while you fill it in; it holds a random identifier and nothing else, cannot be read by scripts, and lasts no longer than 7 days.

A web address as the source. If you ask for a video of a web page or website, our render box reads those public pages, identifying itself as ExplainAPaperBot and following the site's robots.txt, and keeps the text it read, with each page's address and when it was read, as the record of what your video was made from. That text is handled like a paper you upload.

Free videos at the Festival of Entrepreneurs. If you ask for a free video at our stand (see our terms), we keep your email address and website address as a guest order, for up to 7 days until you confirm it, then as part of your account and video like any other order. To apply the limits of one free video per website, per person and per organisation, we keep a one-way hash of your email address, its domain and your website's address with the entry for 12 months, then delete them. The page on your phone shows your place in the queue using a random code kept only in that page's address; we keep only a one-way hash of it. Whether you ticked "You may show my video as an example of your work" is recorded with the time, and kept for as long as we may show the video; we rely on that permission to show it, and you can withdraw it at any time. The marketing box is separate and unticked: if you tick it, we email you to confirm first, as for our newsletter, and you can unsubscribe at any time.

Referrals. If you share your referral link, or buy with a friend's, we record the code, which accounts it linked and the purchase it was used on, to apply the discounts and the scheme's limits (see our terms). We keep these records with the order records they belong to. The person who referred you sees how many friends have paid with their link, never who.

How your video is made, and who is involved

Our specialised AI agents draft the script from your paper and send it to you, and you review and approve it before anything is rendered; if you choose human review, one of our editors also checks it against the paper. The pictures are drawn by our own software, and the narration is produced by an openly licensed voice model running on our own machines. Your paper is therefore seen by our staff, by our own rendering systems, and by the language-model provider named below.

Lesson packs and the people who use them

Our specialised AI agents draft a lesson from the script you approved and from the claims our review checked against your paper, and a second, separate AI review checks the lesson against the paper. Your paper and approved script are processed for this in the same way, and by the same language-model provider, as for drafting the script. You review and approve the lesson before it can be shared or downloaded.

A lesson page is private until you choose otherwise: only members of your account can open it. If you turn on its share link, anyone with the link can open the lesson page. Turning the link off stops it working at once.

Lesson pages are made to be used by pupils, so they collect nothing about the people who use them. Pupils need no account and never sign in. A lesson page sets no cookies, uses no analytics, stores nothing on the device (no local storage), and has no forms or boxes to type into. Answers to its questions stay on the page and are gone when it is closed: they are not saved or sent to us. The page loads nothing from other websites: its video, captions and pictures are served from this site. As for every page on this site, Cloudflare processes the IP address of whoever opens a lesson page in order to deliver it. We do not use it for analytics or to track anyone.

Who processes your information

These organisations process information for us, only for the purposes above:

  • Cloudflare hosts this site and stores accounts, uploaded papers, orders and finished videos and our newsletter list, and protects our forms from automated abuse (see "Cloudflare Turnstile").
  • Stripe processes payments and issues receipts and VAT invoices. Stripe also uses payment information for its own fraud prevention and legal obligations, as a controller, under its own privacy policy.
  • Resend sends our sign-in, team, order and delivery emails, and our newsletter emails, including the confirmation email. Emails are sent through Resend (mail sent from the EU; Resend Inc. is US-based).
  • Anthropic PBC runs Claude, the language model that helps draft scripts, through its commercial API. Anthropic does not use material sent through its commercial API to train its models. For a paper that is not marked confidential or under embargo, Anthropic may keep what we send it for a limited period for safety and abuse monitoring: currently up to 30 days, or up to 2 years if its automated systems flag the material as breaching its usage policy. We ask you to accept this when you submit such a paper, and record that you did. Papers you mark confidential or under embargo are processed only under a zero-data-retention arrangement, so Anthropic keeps no copy after processing, or with a private model running on infrastructure we control. Until one of these is in place we cannot yet process confidential or embargoed papers: you can prepare and save such an order, but not submit it. A zero-data-retention option is coming for confidential and embargoed papers. If your organisation prefers, we can use your own Anthropic API key instead, in which case your organisation's agreement with Anthropic governs that processing.
  • Google (YouTube), only if you connect a channel, as described below.

Some of them are based in, or use infrastructure in, the United States and other countries outside the UK. Where your information is transferred outside the UK, it is protected by the safeguards UK law provides: the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under it, or the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

What your team can see

If you belong to a team, every member can see all of the team's videos, including their scripts, change requests and finished files, the team's credit balance, and the names and email addresses of the other members. Owners can also see billing, invitations and the team's subscription. Your personal account, and videos ordered for it, are not visible to your team.

YouTube

Connecting a YouTube channel is optional and not yet available. If you connect one, you sign in with Google and grant Explain a Paper permission to upload videos to that channel. We use that permission only to upload the videos you ask us to publish, with the title, description, captions and privacy setting you have reviewed. We store the access token Google gives us, encrypted, so we can publish when you ask; we do not read, change or delete anything else on your channel.

Explain a Paper's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use it for advertising, do not sell it, and do not use it to train AI models.

Publishing uses YouTube API Services. By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of your information is governed by the Google Privacy Policy. You can disconnect your channel at any time from your account, which deletes the stored token, or revoke our access in your Google account security settings.

Embedded videos

If you put one of your videos on your own website with our embed code, the player is served from this site. It sets no cookies, stores nothing on the viewer's device and loads nothing from other websites. We count plays, how far each play got, seconds watched and clicks on your button, added up per day for each video; we do not store the viewer's IP address, device or any identifier. To stop abuse we count requests per viewer for an hour using a one-way keyed code made from the IP address, which we never store. As for every page on this site, Cloudflare processes the IP address to deliver the video.

Reviews

If you leave a review, we keep your rating, your words, the first name and organisation you give us and whether you chose to show them, your consent and when you gave it, and the video it is about. We publish it only with your consent and after checking it for abuse. You can withdraw it at any time; we then take it off our website and keep the record that it was published and withdrawn, with the review, for as long as we keep your order records.

How long we keep it

  • Sign-in links: deleted 24 hours after they are issued. A link works for 15 minutes and only once.
  • Sessions: 30 days at most, and ended sooner after 14 days without use or when you sign out.
  • Two-factor sign-in: the encrypted secret key, the hashed recovery codes and the browser identifiers are kept while two-factor sign-in is on, and deleted when you turn it off, when our team removes it at your request after checking your identity, or when your account is closed. The code step after a sign-in link lasts 5 minutes.
  • Team invitations: they expire after 7 days.
  • A paper uploaded to a video that is never submitted: 7 days.
  • A paper on a draft marked confidential or under embargo that you tried to submit before we could process such papers: kept until secure processing opens, so that you do not have to upload it again. We then email you, and the normal draft rule applies: the paper is deleted if the video is not submitted within 7 days of that email. If you remove the confidential flag or the embargo passes, the normal draft rule applies straight away.
  • Papers and working files for a submitted video: until 90 days after you accept the video, then deleted.
  • For a video made with an enterprise subscription credit, any paper still held is also deleted when the video is archived, one month after the team's subscription ends (for a subscription that ends on or after 1 November 2026).
  • What we send our language-model provider for a paper that is not marked confidential or under embargo: kept by Anthropic for up to 30 days (longer only if its systems flag a breach of its usage policy), as described under "Who processes your information".
  • Your account: until you close it.
  • Finished videos ordered before 1 November 2026, or ordered later with credits bought before that date, with their stills, slides, captions and transcript: until you delete them or close your account. The same applies to the videos of a team whose subscription ended before that date.
  • Other finished videos bought on their own or in a pack, with their stills, slides, captions and transcript: 3 months from delivery, then deleted, unless a storage plan or your team's subscription keeps them. When that ends, 3 months from the end of the last period paid for. We email you before we delete a video.
  • Videos made with an enterprise subscription credit: while the team's subscription continues. If it ends on or after 1 November 2026, the team keeps full access for one month; the videos are then archived, so that nobody can view them, and deleted 12 months after the subscription ended. An owner can ask us to delete them sooner. We keep a record of when and why each video was deleted with the records of the sale.
  • Lesson pages and lesson packs, with your change notes and the approval records: kept and deleted with their video, under the rules above. While a video is in the recycle bin or archived, its lesson page and share link stop working.
  • Videos you delete: kept in the recycle bin for 30 days so that you can restore them, then permanently deleted with their files and the paper, or sooner, without a further email, if the period above ends first. We keep only the billing records, the video's footprint figures and a note of who deleted the video and when.
  • Saved brands and their files: with your account until you delete the brand or close your account. A video keeps a copy of the brand it was made in for as long as the video is kept. What we read from a website when you import a brand: one day.
  • Newsletter: a sign-up you have not confirmed, 72 hours; your subscription, until you unsubscribe or ask us to delete it; after that, only the hashed copy of your address, kept for as long as we send a newsletter, so that we honour your unsubscribe.
  • Emails, messages and enquiries: twelve months after our last exchange with you.
  • Notices about material on our service, and replies to them: six years after the matter is closed, the period in which a legal claim about it could normally be brought.
  • YouTube access tokens: until you disconnect the channel or close your account.
  • Records of each sale (name, email, organisation, what you bought, the amount and the date): six years, as UK accounting and tax law requires, even if you close your account.

Cookies

When you sign in, we set one cookie, __Host-ep_session, which keeps you signed in. It holds a random identifier and nothing else, cannot be read by scripts, and lasts no longer than your session. It is strictly necessary. If you have two-factor sign-in on, we set two more, both for the security of your account: __Host-ep_2fa, for up to 5 minutes between opening your sign-in link and entering your code, and __Host-ep_device, which lets us recognise this browser for up to 400 days so that we can tell you about sign-ins from a browser we have not seen before. Each holds a random identifier and nothing else, and cannot be read by scripts. We set no cookies for analytics, advertising or tracking. When you pay, you do so on Stripe's checkout page, which uses cookies for fraud prevention under Stripe's cookie policy. Strictly necessary cookies do not need your consent, which is why this site does not ask for it.

Opening a lesson page sets no cookie. If a member of your account is signed in, their existing sign-in cookie is only read, so that they can see a lesson that is not yet shared.

Some example videos on our videos pages are hosted on YouTube. They play in YouTube's privacy-enhanced mode (youtube-nocookie.com), and nothing is loaded from YouTube until you press play. Once you do, Google receives information such as your IP address and browser details and may store data on your device, under Google's privacy policy. Our own videos are served from this site and share nothing with third parties.

Cloudflare Turnstile

Our sign-in, order, contact and enquiry forms use Cloudflare Turnstile to tell people from automated abuse. When one of these forms loads, Turnstile checks signals from your browser and device and passes us only a pass or fail result. It does not show advertising or track you across sites. Cloudflare handles that information under its privacy policy. We rely on our legitimate interest in keeping the site secure.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. Email [email protected] or write to the address below, and we will respond within one month. Deleting material we hold for an open order may mean we cannot finish it; we will tell you before acting. Where we hold information as an organisation's processor, we pass your request to that organisation and help it respond.

You can withdraw your consent to our newsletter at any time, with the unsubscribe link in any newsletter email or by emailing us.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you raised it with us first so we can put it right.

Changes to this policy

We will show the date of the latest change at the top of this page, and email account holders about any significant change.

Contact

Email [email protected], or write to us at our trading address:
Digital Tactics
5 Boundary Road
Hove
East Sussex BN3 4EH
United Kingdom