1. Who is responsible
The controller of your personal data is SHREDER OÜ (registry code 16783381). For any privacy question or request, email info@talktothebook.org. We do not have a designated data protection officer; this address reaches the people responsible.
We do not sell your data, we do not show ads, and we do not use your books or conversations to train AI models.
2. What we collect
- Account: email address and password (stored only as a hash by our authentication provider). If you sign in with Google, we receive your name, email address, and profile picture from Google.
- Your content: files you upload (PDF, EPUB, TXT), text extracted from them and its search index (embeddings), AI-generated summaries, your conversations, highlights, bookmarks, glossary entries, reading progress, reading streak, and share links you create.
- Billing: your plan, subscription status, and billing period, plus a customer ID from Stripe. Card details are entered on Stripe's pages and never reach us.
- Usage counters: how many AI answers, character chats, audio minutes, and books you used this month, to apply plan limits.
- Technical logs: IP address, browser type, requested pages, timestamps, and error messages recorded by our hosting and database providers when you use the Service.
- Messages to us: whatever you send to our email address.
We do not use analytics or advertising trackers.
3. Why we use it and on what legal basis
- To provide the Service (account, storing and processing your books, AI answers, audio, sync, share links) — performance of our contract with you (GDPR Art. 6(1)(b)).
- To take payments and keep accounting records — contract and legal obligation (Art. 6(1)(b) and (c)).
- To keep the Service secure and working (logs, abuse prevention, fixing errors) — our legitimate interest in a safe, reliable service (Art. 6(1)(f)).
- To send service emails (sign-up confirmation, security notices, changes to terms or prices) — contract and legal obligation. We do not send marketing emails.
- To respond to legal requests and copyright notices — legal obligation and legitimate interest.
4. Who receives your data
We share data only with providers that help run the Service, and only what each one needs:
- Vercel (USA) — hosts the website and application; processes requests and technical logs.
- Supabase — database, sign-in, and file storage for your account and content.
- Stripe (Stripe Payments Europe, Ireland) — payments, invoices, and the billing portal.
- Resend (USA) — sends sign-up, confirmation, and password-reset emails.
- Cloudflare (USA) — CAPTCHA (Turnstile) on sign-up, log-in, and password reset. It receives a short-lived token and technical data (IP address, browser) to tell people from bots.
- Google (USA) — only if you choose "Continue with Google".
- OpenRouter (USA) and the AI model providers it routes to — Anthropic (USA) for book answers and character chats, and OpenAI (USA) for search embeddings and quick tasks. They receive your question, relevant passages of the book, and recent messages of the conversation — not your email or payment details.
- Microsoft (speech service) — receives the text you choose to listen to, to generate audio.
We may also disclose data when required by law or a binding order, or to a buyer if the business is transferred, under this same policy. We will tell you when the law allows.
5. Transfers outside the EEA
Some providers above process data outside the European Economic Area, including in the USA. Where the European Commission has not recognised a country as adequate, transfers rely on the European Commission's Standard Contractual Clauses or, for certified US companies, the EU–US Data Privacy Framework. You can ask us for more information about these safeguards.
6. Share links
If you create a share link, anyone with the link can see that conversation, its cited book passages, and the book title. Shared pages are hidden from search engines. The link stays active until you delete the book or your account.
7. How long we keep data
- Account and content: until you delete them. Deleting a book removes its file, text, index, and conversations. Deleting your account removes all of your data from our database and storage immediately; copies in encrypted backups are overwritten within 30 days.
- Billing records: kept for 7 years as required by Estonian accounting law, by us and by Stripe.
- Technical logs: kept by our providers for a limited period, normally no longer than 30 days.
- Emails to us: as long as needed to handle your request.
8. Your rights
- Access and portability: download all your data as a file in Account → Profile → Export my data, or ask us.
- Rectification: change your name in Account → Profile, or ask us to correct other data.
- Erasure: delete individual books, or your whole account in Account → Profile → Delete account.
- Restriction and objection: ask us to pause processing or object to processing based on our legitimate interests.
- Complaint: you can complain to your local data protection authority or to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
To use any right, email info@talktothebook.org. We reply within one month.
9. Security
Connections are encrypted (HTTPS), data is encrypted at rest by our providers, and each user can access only their own data. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
10. Children
The Service is not intended for children under 13. If you believe a child under 13 has created an account, email us and we will delete it.
11. Changes to this policy
We will email you at least 30 days before material changes take effect. The date at the top of this page shows the current version.