Privacy notice

1. Controller

2. Account and sign-in

We process your name, email address, password hash, verification status, sessions, language and security events to provide and protect your account. The legal basis is Article 6(1)(b) GDPR; security logging additionally relies on Article 6(1)(f) GDPR.

3. Book projects and files

Manuscripts, book details, covers, images, versions, validation results and generated editions are processed to provide the authoring service. The legal basis is Article 6(1)(b) GDPR. Content remains project-specific and is not used for general advertising profiles.

4. Payment and accounting

BookPass purchases involve contact, product, price, payment-status and transaction data. Payments are handled by Stripe; epubio does not receive full card details. Processing supports contract performance and statutory commercial and tax obligations under Article 6(1)(b) and (c) GDPR.

5. Email and operations

Transactional emails are sent through the configured email provider. The application and database run on separate OVHcloud infrastructure; project files remain in epubio's private object storage. Technical logs support stability, abuse prevention and diagnostics under Article 6(1)(f) GDPR.

6. Recipients

• OVHcloud for server operations and storage
• Stripe for payment processing
• one.com for system email delivery
• legally authorised bodies where disclosure is required

Processors are used only where necessary. Transfers outside the EEA take place only under the safeguards provided by law for the relevant service.

7. Cookies and local preferences

epubio uses necessary session cookies for authentication and security. Language preferences are stored in the browser as a necessary preference. No advertising or tracking cookies are currently used.

8. Retention

Account data and book projects are retained during the contractual and usage relationship. Payment and invoice records are subject to statutory retention duties. Security and error logs are retained only as long as required for operations, evidence and abuse prevention. A deletion request is fulfilled unless statutory duties or legitimate evidentiary interests require retention.

9. Your rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn prospectively. You may also complain to a data protection authority. Send requests to trogisch.d@gmx.net.

10. No automated legal decisions

epubio does not make solely automated decisions producing legal or similarly significant effects. Quality and release notices support decisions made by the author.