Legal
Privacy Policy
Effective date: [to be confirmed]
Draft. This policy is being finalised and is not yet the binding version. Questions: hello@book80.com.
In short: we collect what we need to run your account, take payment and process the content you send to cloud features. Much of your work stays in your browser. We don’t sell data, don’t use advertising trackers, and don’t train our models on your manuscripts.
1. Who is responsible
[to be confirmed], [to be confirmed], operates BookFlow AI at book80.com and is responsible for your personal data. Contact us about privacy at hello@book80.com.
2. What we collect
- Account data: email address, name, sign-in records, organisation and role.
- Your content: manuscripts, briefs, outlines, sources, notes and generated output you save to the cloud or send to cloud features.
- Billing data: plan, purchase history and billing address. Card details go directly to Stripe; we never receive them.
- Usage and technical data: credit use, job status, token counts, cost, errors, IP address and browser information needed to run and secure the Service.
- Support messages you send us.
3. Data that stays in your browser
Much of BookFlow AI is local-first: imported manuscripts, drafts and many studio tools are stored in your browser’s own storage (IndexedDB) and are not uploaded unless you choose to save to the cloud or use a feature that needs our servers. We cannot see or recover data that exists only in your browser.
4. How we use it
- to provide the Service you ask for, including running AI and export jobs (performance of our contract with you);
- to take payments, keep accounts and meet tax and legal obligations (legal obligation);
- to secure the Service, prevent abuse and fix problems (legitimate interests);
- to send service messages such as receipts and security notices, and product news only if you opt in (consent, which you can withdraw).
Our AI-usage logs record a hash of each prompt with token counts, cost and timing — not the text of your content. We do not use your content to train our own models and we do not sell personal data.
5. AI providers
When you use an AI feature, the relevant part of your content is sent to the model provider to produce the result. We use the providers’ business API services, whose terms state that API inputs are not used to train their models by default; their own privacy policies also apply. If you bring your own API key, the request is made under your account with that provider.
6. Service providers we share data with
We share data only with providers that process it for us under contract, as needed for each purpose:
| Provider | Purpose | When |
|---|---|---|
| Vercel | Website and application hosting | Always |
| Supabase | Accounts, sign-in, cloud database and file storage (region: Tokyo, Japan) | Always |
| Stripe | Payments, invoices and tax | When you buy a plan or credits |
| Inngest | Running long background jobs such as book generation | When you run cloud jobs |
| OpenAI, Anthropic, Google, OpenRouter | AI text generation, editing, embeddings and speech | When you use AI features |
| Tavily, Exa | Web search for research and fact-checking | When you run research or fact-checks |
| DataForSEO | Market and keyword data (receives search terms, not your manuscript) | When you run market research |
| ElevenLabs, Google Cloud TTS, Microsoft Azure Speech | Audiobook narration | When you create audio |
| fal.ai | Cover and illustration images | When you generate images |
| Browserless / Cloudflare R2 | PDF rendering and file storage | When you export print PDFs or store large files |
| Gumroad, Etsy, Shopify, Telegram, Slack | Publishing and notifications you connect | Only if you connect them |
We may also disclose data when required by law, or to a buyer of our business under equivalent protections.
7. International transfers
Our providers operate in several countries, including Japan, the United States, the European Union and Australia. Where data leaves your country we rely on the safeguards the law requires, such as standard contractual clauses.
9. How long we keep data
- Account and cloud content: while your account is active. After you delete content, or ask us to close your account, we delete it from live systems within 30 days and from backups on their normal rotation.
- Billing and tax records: as long as tax law requires (typically 5–7 years).
- Security and usage logs: up to 12 months, unless needed to investigate abuse.
10. Your rights
Depending on where you live (for example under the GDPR, UK GDPR, the Australian Privacy Act or Vietnam’s personal data protection law), you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent. Email hello@book80.com; we answer within 30 days.
You can also complain to your local data protection authority.
11. Security
We use encryption in transit, row-level access control so one organisation cannot read another’s data, role-based permissions inside each workspace, and encryption of API keys you give us. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
12. Children
The Service is not intended for anyone under 18, and we do not knowingly collect their personal data.
13. Changes
We will post updates here and, for material changes, notify you by email or in the app. See also our Terms of Service.