Privacy notice

This notice explains what personal data BookFlow keeps, why, who else handles it, and your rights. The controller is the operator below; write to support@bookflow.center about anything in it.

Operator

BookFlow

Address

Slovakia

Email

support@bookflow.center

What we keep and why

• Your account: username, email address, a hash of your password (never the password itself), and the author name, bio and preferences you choose to add. We need them to run your account (the contract between us).
• Your writing: premises, outlines, characters, drafts, notes and voice samples. We store them so you can write, and send the parts a step needs to our AI provider when you ask BookFlow to draft or check something (contract).
• AI usage: for each piece of AI work, which model ran, how many tokens it used, what it cost and the credits it took. We need it to charge credits and to keep daily limits (contract), and to stop abuse (our legitimate interest).
• Published books: what you publish, with your author name and bio, is public. We also record who has which book and how far they’ve read.
• Payments, once they open: Stripe handles card details; we never see them. We keep Stripe’s reference numbers and a record of each purchase and payout, as accounting law requires.
• Feedback you send us: your message, the page you sent it from and your username. It goes to our team’s mailbox, with your email address so we can answer you (legitimate interest), and is deleted with your account.
• Technical records: our servers log requests (time, address requested, result) to keep BookFlow running and secure (legitimate interest). The proxy uses your IP address to limit repeated sign-in attempts.

Who else handles it

• Anthropic, our AI provider, receives the parts of your writing each AI step needs and returns the text. It processes data in the United States.
• Stripe processes payments, once they open.
• Our hosting and storage providers keep the servers, the database and backups in the European Union.
• Our email provider delivers password resets and account notices.

They act on our instructions under data-processing agreements. Where data leaves the European Economic Area, it is protected as the GDPR requires, for example by the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. We don’t sell your data or use it for advertising.

How long we keep it

Your account and writing stay until you delete them. Deleting your account deletes your books and drafts; copies in our backups expire within 30 days. Records of AI usage and of sales stay, without your name, for as long as limits, accounting and tax law need them.

Cookies

BookFlow sets only the cookies it needs to work: two that keep you signed in, and one that remembers whether you chose the light or the dark theme. There are no analytics or advertising cookies.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Most of this you can do yourself in your profile and by exporting your manuscripts; for the rest, write to support@bookflow.center. You can also complain to a data protection authority; in Slovakia that is the Úrad na ochranu osobných údajov Slovenskej republiky.

Children

BookFlow is for people aged 16 or older.