Privacy Policy

Welcome to BookSpace.ai ("BookSpace", "we", "our", or "us"). BookSpace is an AI-assisted book creation and publishing platform designed to help authors, researchers, publishers, and professionals turn concepts, briefs, and source materials into comprehensive, coherently structured manuscripts and multi-format publication files.

We believe that serious book writing requires transparent, dependable data stewardship. Whether you are preparing an academic monograph, a narrative non-fiction title, an instructional manual, or a multi-chapter fiction book, your creative ideas, research files, and manuscripts represent valuable intellectual work. This Privacy Policy explains clearly and directly:

• What personal and project information we collect when you browse our website or use our workspace.
• How prompts, uploaded source documents, and book blueprints are processed by our automated systems and AI infrastructure.
• The operational role of our human review checkpoint in the production lifecycle.
• Our explicit commitment regarding author ownership of uploaded source materials and generated books.
• The verified third-party cloud infrastructure providers we partner with to deliver the service.
• Your rights and controls regarding the retention, access, and deletion of your data.

This policy applies to all visitors, registered account holders, and subscribers interacting with BookSpace.ai through our web application, APIs, and associated online services.

We collect only information that is necessary to provide, secure, and improve the BookSpace book creation platform. We distinguish strictly between administrative account data, project manuscript data, financial records, and technical system telemetry.

A. Account & Authentication Information

When you register an account or update your author profile, we collect:

• Contact Details: Your email address and preferred author display name.
• Authentication Credentials: Secure, cryptographically hashed passwords managed via our authentication provider (Supabase Auth). We never store or have access to raw, plaintext passwords.
• Biometric & Hardware Passkeys: When you choose to enable fingerprint, face recognition, or hardware passkey authentication, we store public key identifiers per the W3C WebAuthn standard. Biometric measurements remain on your local hardware device and are never transmitted to or held by BookSpace servers.
• Single Sign-On (OAuth): If you authenticate using Google or Microsoft OAuth, we receive the public profile email and verified identity identifier provided by that identity service.

B. Book Requests, Source Materials & Project Data

When you create and manage a book project in your workspace, we collect:

• Book Briefs & Directives: Book title, subtitle, target genre, category, target page count, pacing, tone, chapter descriptions, and thematic requirements.
• Uploaded Source Materials: Reference documents, research papers, outline notes, raw drafts, and reference images uploaded during intake to ground the book planner and writing engines.
• Project Metadata: Project creation timestamps, stage progress indicators, revision logs, and generation configuration settings.

C. Generated Manuscripts & Output Deliverables

During the book creation lifecycle, our systems create and store:

• Detailed conceptual blueprints, table of contents, and chapter architectures.
• Generated chapter manuscripts, section prose, character descriptions, and narrative text.
• Editorial feedback notes, revision histories, and quality evaluation scores.
• Compiled deliverable publication files in requested formats: Microsoft Word (DOCX), Adobe PDF, EPUB, LaTeX, and PowerPoint (PPTX).

D. Subscription, Billing & Credit Records

BookSpace partners with Paddle.com, which operates as our authorized Merchant of Record. Paddle directly handles all checkout sessions, payment processing, tax calculation, and currency conversions.

• Data Handled by Paddle: Credit card numbers, PayPal accounts, billing addresses, and VAT/tax registration numbers are collected and processed directly by Paddle under their secure PCI-DSS Level 1 infrastructure. BookSpace never receives, stores, or accesses full credit card details.
• Data Retained by BookSpace: We retain only non-sensitive financial metadata needed to operate your subscription: your Paddle Customer ID, subscription status, billing cycle (monthly/annual), account plan tier (Creator, Pro, Publisher), transaction identifiers, and internal AI Credit ledger entries (balances, allocations, rollovers, debits, and reservations).

E. Technical Data & Telemetry

When you navigate our website and workspace, our servers automatically record standard operational logs:

• Internet Protocol (IP) address, used strictly for session security, rate limiting, and DDoS mitigation.
• Browser type, user-agent string, device type, and operating system.
• Referral headers, page response times, and application error logs.

F. Communications & Customer Support

If you contact our support team via our Contact Page or by email, we retain your message content, email address, and any project identifiers you provide in order to investigate and resolve your inquiry.

We use the data we collect solely for the following legitimate business and operational purposes:

• Delivering Book Creation Services: Provisioning your account, executing AI research synthesis, planning chapter architectures, drafting full-length chapters, and formatting downloadable files.
• Operating the Human Review Checkpoint: Enabling our platform editorial team (Stage 5 in the production engine) to inspect manuscript formatting, structural integrity, and generation completeness before delivering finished files.
• Managing Credits & Subscriptions: Tracking available AI Credits, processing credit reservations, managing rollover allowances on eligible Pro and Publisher plans, and synchronizing plan tiers with Paddle webhooks.
• Customer Support & Problem Resolution: Diagnosing generation errors, investigating failed exports, and providing responsive assistance when requested by the author.
• Platform Security & Abuse Prevention: Detecting fraudulent account creation, mitigating automated bot attacks, enforcing rate limits, and ensuring that users do not violate our Acceptable Use policy.
• Legal & Regulatory Compliance: Satisfying statutory bookkeeping, tax reconciliation, and lawful legal process requirements.

BookSpace is designed to produce cohesive, book-length manuscripts rather than disconnected short fragments. To achieve this, submitted book prompts, planning directives, and portions of uploaded source material are processed through automated intelligence pipelines.

A. Upstream AI Model Providers

BookSpace operates an intelligent gateway routed through Cloudflare AI Gateway to interface with leading enterprise large language model providers, including Anthropic, Google Cloud (Gemini), and OpenAI, as well as Cloudflare Workers AI edge models.

When you initiate book generation, necessary prompts and context slices are transmitted to these model providers over encrypted TLS connections solely to compute structural outlines, synthesize chapters, and perform editorial line refinement.

B. Model Training Safeguards

A central concern for serious authors is whether their private concepts or unpublished source texts will be used to train public AI models.

• Zero Platform Model Training: BookSpace does not use your private book briefs, manuscripts, or uploaded source materials to train publicly available AI models.
• Enterprise Provider API Terms: We access third-party AI models strictly through commercial enterprise API endpoints. Under the standard enterprise terms of our providers (Anthropic, Google Cloud, and OpenAI), data submitted via commercial APIs is not used to train or improve their foundational models.
• Zero Data Selling: We never sell, license, or monetize your creative writing, research papers, or project outlines to third-party data brokers or research aggregators.

C. Human-in-the-Loop Production Checkpoint

BookSpace employs a hybrid production model. As detailed in our production documentation, manuscripts pass through a 7-stage engine. At Stage 5 (Human Review Checkpoint), authorized BookSpace production specialists inspect manuscript formatting, continuity, and layout before compilation into final export formats.

Reviewers access manuscripts strictly through authenticated, auditable internal tools for quality assurance. Our personnel are bound by strict non-disclosure obligations and access controls.

Authors often bring years of original research, proprietary notes, or early drafts into BookSpace. Our terms and data practices reflect strict respect for your intellectual property:

• User Ownership: You retain complete, unencumbered ownership of all intellectual property rights, copyrights, and moral rights in the materials you upload to BookSpace, including outlines, drafts, notes, and research documents.
• Limited Operational License: You grant BookSpace only the narrow, non-exclusive, worldwide, royalty-free license strictly necessary to store, parse, index, format, review, and reproduce your materials for the sole purpose of operating the services you request. This license terminates when your project and account are deleted.
• Generated Works: Subject to your compliance with our terms and applicable copyright laws, BookSpace assigns to you any ownership rights or interests that BookSpace may hold in the specific output manuscripts and deliverables generated for your projects. We assert zero copyright or royalty claim over your finished books.
• Author Responsibility: Because BookSpace is a writing and production engine, you remain solely responsible for ensuring that you have the necessary rights to any source material you upload, and that your finished manuscript complies with applicable defamation, privacy, and copyright laws.

BookSpace does not sell, rent, or trade your personal data. We share information only with trusted service providers who require access to perform specific infrastructure, database, billing, and AI inference tasks on our behalf:

All service providers are bound by strict data processing agreements and security obligations requiring them to handle user data in compliance with applicable privacy standards.

Legal Disclosures: We may disclose user information only if required to do so by law, court order, subpoena, or governmental regulation, or if we believe in good faith that disclosure is strictly necessary to protect the security of our platform, our users, or the general public.

We retain your project files, manuscripts, and account data for as long as your account remains active, allowing you to access, refine, and re-export your books at any time.

A. Project Deletion by the Author

When you delete a book project from your dashboard, the project is marked for deletion in our primary database. Associated source material references and deliverable file pointers are removed from active query indexes, and requests are dispatched to our Cloudflare R2 storage gateway to purge the underlying manuscript and export files.

B. Disaster Recovery Backups

Like all professional cloud platforms, BookSpace maintains encrypted database and storage snapshots for business continuity and disaster recovery. When you delete a book or account, data is immediately inaccessible in the live platform. Residual copies in encrypted backup snapshots expire and are permanently overwritten on our standard backup rotation cycle (typically within 30 to 90 days).

C. Financial & Statutory Records

Transaction records, credit purchases, and invoice references cannot be immediately deleted upon request, as they must be preserved to comply with legal, tax, and audit obligations under applicable commercial law. These records are retained by Paddle and BookSpace for the minimum statutory period required by tax authorities.

BookSpace employs defense-in-depth engineering practices to protect your manuscripts, personal data, and account access:

• Encryption in Transit: All communications between your browser, our edge workers, and database services are secured using TLS 1.3 / HTTPS encryption.
• Encryption at Rest: Cloudflare R2 object storage volumes and Supabase PostgreSQL database tables are encrypted at rest using industry-standard AES-256 encryption.
• Database Row Level Security (RLS): Our database enforces strict PostgreSQL Row Level Security policies. Project records, uploaded source files, and credit balances can only be accessed by the authenticated user who created them.
• Passkey & Biometric Security: We support hardware-backed WebAuthn passkeys (FIDO2) for fingerprint and facial recognition sign-in, eliminating the risk of password credential stuffing.
• Support Access Isolation: If an administrator or support specialist assists you with a technical problem, support sessions are strictly logged, time-limited, and auditable. Administrative access to private manuscripts is strictly restricted to authorized production operators.

While we implement robust, verified security controls, no internet-connected platform can promise 100% invulnerability. We encourage authors to use strong, unique passwords and enable passkey authentication on their accounts.

BookSpace respects author privacy and does not engage in invasive behavioral profiling or third-party advertising tracking. We use browser storage strictly for essential operational purposes:

• Essential Session Storage: Used to maintain your active authentication session, remember temporary plan selections during checkout, and manage active workspace book views.
• Local Storage: Used to persist client-side authentication tokens (Supabase Auth tokens) and UI preferences (such as collapsed sidebar states) across browser refreshes.
• Essential Security Cookies: Utilized for CSRF mitigation and load-balancing integrity.
• No Third-Party Advertising Trackers: BookSpace does not deploy Facebook Pixel, Google Ads remarketing pixels, or third-party behavioral advertising cookies.

BookSpace operates globally. By accessing or using our services, your information may be transferred to, stored, and processed in the United States and other jurisdictions where our cloud infrastructure partners (Cloudflare, Supabase, Paddle, and AI inference providers) maintain facilities.

Data privacy laws in these countries may differ from the laws in your country of residence. Where we transfer personal data across borders, we implement recognized contractual safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and equivalent international data transfer mechanisms, ensuring that your information receives a level of protection comparable to international standards.

Depending on your location and applicable privacy legislation (such as the European Union's General Data Protection Regulation / GDPR, the UK GDPR, or the California Consumer Privacy Act / CCPA), you may hold certain statutory rights regarding your personal information:

• Right of Access: You can request a summary and copy of the personal data we hold about you.
• Right to Rectification: You can correct or update inaccurate or incomplete profile information in your account settings.
• Right to Erasure ("Right to Be Forgotten"): You may request the permanent deletion of your account and associated project records, subject to statutory retention obligations.
• Right to Data Portability: You can export your manuscripts at any time in standard, open formats including DOCX, PDF, EPUB, and LaTeX.
• Right to Restriction & Objection: You may request that we restrict or cease processing your data under certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting prior lawful processing.

To exercise any of these rights, please contact us through our Contact Page or by emailing privacy@bookspace.ai. We will respond in accordance with applicable legal deadlines.

BookSpace is a professional authoring and publishing platform intended exclusively for adult creators, researchers, and publishing professionals.

We do not knowingly collect, solicit, or maintain personal information from individuals under the age of 18 (or under the age of legal majority in your jurisdiction). If we become aware that a child under 18 has created an account or submitted personal information, we will take immediate steps to terminate the account and purge all associated data. If you believe an underage person has registered an account, please alert us at privacy@bookspace.ai.

We may update this Privacy Policy from time to time to reflect enhancements to our book production pipeline, operational practices, or applicable legal requirements.

When material changes are made, we will post the revised policy on this page with appropriate notice. For significant modifications affecting your rights or how your manuscripts are processed, we will provide prominent notice through our application dashboard or by sending an email notification to registered account holders prior to the changes taking effect. Your continued use of BookSpace after an update signifies your acknowledgment of the revised Privacy Policy.

If you have questions, feedback, or concerns regarding this Privacy Policy, our data practices, or how your manuscripts are handled, please reach out to our team:

• Direct Contact Page: BookSpace.ai Contact Center
• Privacy & Data Rights Email: privacy@bookspace.ai
• General Support Email: support@bookspace.ai
• Security Inquiries: admin@bookspace.ai

We take all privacy questions seriously and will investigate and respond to your inquiry promptly.