Privacy policy

Version of

1. Who is responsible for your data

The controller of your personal data is:

Sebastian Charewicz, Hobbyverksamhet (Sweden)
Floragatan 21, 531 37 Lidköping, Sweden
Contact for personal data matters: support@bookvaib.com

2. What data we process and why

  • Account — your e-mail address and sign-in data. Sign-in is handled by Clerk; passwords never reach our systems. Basis: performance of the contract.
  • Author profile and page — the photo, name, biography, links, welcome text and blog posts you provide. They are public next to your books in the Marketplace and on your author page (also under your own domain if you connect one). Basis: performance of the contract.
  • Book reviews — the rating and text you post in the Marketplace and your replies as an author. They are public next to the book with your profile name and photo; only administrators see review reports. Basis: performance of the contract.
  • What you create — texts, covers, images, recordings, listings. We store them so that the Studio and the Library work. Basis: performance of the contract.
  • Purchases and sales — what was bought and when, amounts, the buyer's e-mail address (also without an account), the author's payout details. Payments are handled by Stripe; we never see card details. Basis: performance of the contract and accounting obligations.
  • Tokens — the balance and the history of its changes. Basis: performance of the contract.
  • Security — IP address and time of administrators' actions and data needed to limit abuse. Basis: our legitimate interest.
  • Support — the messages you write to the team and our replies, with the address of the app page you wrote from. We delete them a month after the conversation is closed, or after a month with no reply from you to ours (at the latest with the account). Basis: performance of the contract.
  • Notifications — entries in the bell (for a year), e-mails and push notifications only of the kinds you keep switched on in your profile; team messages by e-mail only with your consent. For push we store your browser's subscription address. Basis: performance of the contract, and for team messages your consent, which you can withdraw in the profile.

3. AI tools

When you use an AI tool (e.g. a book description, cover artwork, narration), the text or image you provide is passed to the model provider only to carry out your request. The result is saved to your Library. Do not enter data there that you do not want passed on.

4. Who we share data with

  • Clerk (USA) — sign-in and accounts.
  • Stripe — payments.
  • Google (Gemini API) — generating text, images and speech at your request.
  • E-mail provider — sending e-mail notifications.
  • Your browser's push service (e.g. Google, Mozilla, Apple) — delivering push notifications, if you switch them on.
  • Hosting provider — storing the database and files.
  • Cloudflare (R2, a bucket in the EU jurisdiction) — storing the files you create and upload, under names that reveal neither the account nor the file name.
  • Meta Platforms Ireland — only on pages of authors who switched on Meta Pixel, and only after the visitor consents (section 7).

We give each of these companies only the data it needs for its task, only over encrypted connections (HTTPS/TLS) and under a data processing agreement or its data protection terms. We share data with no one else unless the law requires it (e.g. at the request of a court or authority).

Some of these companies process data outside the European Economic Area. This is done on the basis of standard contractual clauses or a European Commission adequacy decision. We do not sell data and do not use it for advertising.

5. How long we keep data

  • Account, profile and what you create — until the account is deleted.
  • Order and settlement records — for as long as accounting law requires (7 years in Sweden).
  • Unpaid orders — 30 days.
  • IP addresses in the administrators' activity log — 12 months.

AI chats connected to your account (MCP)

You can connect your account to another company's AI chat (e.g. Claude, ChatGPT, Gemini). You set up the connection yourself: the chat asks for access and you agree on our page. The chat can then read your Library, calculate KDP facts and — if you allow it — write in your books (never deleting) and use Bookvaib AI tools for your tokens, always after you confirm the price and at most 100 tokens a day. What the chat reads (e.g. the text of a book) goes to its provider and is subject to its terms; the basis is your instruction (Art. 6(1)(b) GDPR).

We record which chat is connected, when it was used and which tools it called (a log kept for one year). You can disconnect at any time in your profile (Account → AI chats) — the chat loses access at once.

ElevenLabs voices in audiobooks

You can record an audiobook with an ElevenLabs voice on your own ElevenLabs account. Your ElevenLabs API key stays in your browser — it is never sent to Bookvaib and we do not store it. Your browser sends the chapter text straight to ElevenLabs with your key, so it is subject to ElevenLabs' terms and your agreement with them; only the finished speech comes back to us, and we assemble it into the audiobook. The key is removed from the browser when you sign out or choose “Disconnect” in your profile (Account → ElevenLabs).

6. Your rights

You have the right to access your data, correct it, have it erased, restrict its processing, receive it in a portable form and object to processing. Most of this you can do yourself in the profile: change your details, download everything we hold about you (“Download my data”) and ask for your account to be deleted. We carry out deletion requests within 30 days. After deletion we keep only settlement records without the e-mail address and the books someone bought from you — a buyer has the right to come back for their purchase.

You can also write to us at the address above. You have the right to lodge a complaint with a supervisory authority — in Sweden this is Integritetsskyddsmyndigheten (IMY).

7. Cookies and browser storage

On the service itself we use only what is necessary for it to work: sign-in session cookies (Clerk), Stripe cookies at the moment of payment (fraud prevention) and browser storage for your settings — language, theme, currency and the last item you opened. Bookvaib uses no analytics or advertising tools, which is why we do not ask for cookie consent on these pages.

Visit statistics

We count visits without cookies and without third-party tools. When a page is shown, we read the browser type (e.g. Chrome), the system (e.g. Android) and the device type (computer, phone, tablet) from the browser header, and the country and network operator from the IP address, including whether the address belongs to a data centre (with DB-IP databases on our own server — the address goes to no one). We also count which part of the service is visited (e.g. Marketplace, Studio) and sign-in attempts from each country with their result, which also serves security. We store only daily totals — no IP addresses or full browser headers. To count a person once a day, for two days we keep a hash of the address and browser with a daily salt that cannot be linked to earlier days. Legal basis: our legitimate interest (developing, running and securing the service).

Meta Pixel on author pages

An author can switch on Meta Pixel — Meta Platforms Ireland Ltd's tool for measuring visits and ad results — on their author page (at the Bookvaib address or under their own domain). On such a page we first show a choice window. The pixel loads only after you click “Accept”; “Decline” is just as easy and blocks nothing.

With your consent the pixel sets Meta cookies (e.g. _fbp) and sends information about the visit to Meta: the page address, time, browser and device data, IP address and — if you are signed in to Meta services — a link to your account. The basis is your consent (Art. 6(1)(a) GDPR). The author of the page and Meta are jointly responsible for collecting and passing these data to Meta; Meta's further processing is described in Meta's privacy policy. Bookvaib provides the page and the consent window and does not use the pixel data.

Your browser remembers the choice separately for each author. You can withdraw consent at any time with the “Privacy settings” button in the author page footer — the page reloads without the pixel and its cookies are removed.

8. How we protect your data

  • All traffic to and from the service is encrypted (HTTPS/TLS; browsers remember that the site works over HTTPS only).
  • User passwords are handled by Clerk — they never reach our systems. Card details are handled by Stripe (PCI DSS certified) — we never see them.
  • Files are stored in Cloudflare R2, encrypted at rest, under names that reveal neither the account nor the file name. We serve them only through signed links valid for one hour, and only to someone entitled to them.
  • Authors' payout details are stored encrypted, and database backups are encrypted with a key that only the owner of the service can access.
  • Every uploaded file is checked by antivirus software, and PDFs, images and audio are opened in an isolated environment with no access to the internet or the database.
  • The server is protected by a firewall, administrative sign-in uses keys only, and the application runs in containers without administrator privileges. Only administrators with assigned roles can access the admin panel, and their actions are recorded in an activity log.
  • We limit request rates and detect abuse (e.g. moving content between accounts, spam from reader lists).

If a personal data breach occurs that may affect your rights, we will notify the supervisory authority within 72 hours and — where required — you as well.

9. Changes

When we change this policy in a material way, we will ask you to accept it again at your next sign-in.