Privacy notice

1. Controller

2. Account and sign-in

We process your name, email address, password hash, verification status, sessions, language and security events to provide and protect your account. The legal basis is Article 6(1)(b) GDPR; security logging additionally relies on Article 6(1)(f) GDPR.

3. Book projects and files

Manuscripts, book details, covers, images, versions, validation results and generated editions are processed to provide the authoring service. The legal basis is Article 6(1)(b) GDPR. Content remains project-specific and is not used for general advertising profiles.

4. Payment and accounting

BookPass purchases involve contact, product, price, payment-status and transaction data. Payments are handled by Stripe; epubio does not receive full card details. Processing supports contract performance and statutory commercial and tax obligations under Article 6(1)(b) and (c) GDPR.

5. Email and operations

Transactional emails are sent through the configured email provider. The application and database run on separate OVHcloud infrastructure; project files remain in epubio's private object storage. Technical logs support stability, abuse prevention and diagnostics under Article 6(1)(f) GDPR.

6. Recipients

• OVHcloud for server operations and storage
• Stripe for payment processing
• one.com for system email delivery
• legally authorised bodies where disclosure is required

Processors are used only where necessary. Transfers outside the EEA take place only under the safeguards provided by law for the relevant service.

7. Cookies and local preferences

epubio uses necessary session cookies for authentication and security. Language preferences are stored in the browser as a necessary preference. Optional self-hosted website analytics is activated only after explicit consent. Advertising and profiling services are not used.

8. Retention

Account data and book projects are retained during the contractual and usage relationship. Payment and invoice records are subject to statutory retention duties. Security and error logs are retained only as long as required for operations, evidence and abuse prevention. A deletion request is fulfilled unless statutory duties or legitimate evidentiary interests require retention.

9. Your rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn prospectively. You may also complain to a data protection authority. Send requests to service@epubio.com.

10. No automated legal decisions

epubio does not make solely automated decisions producing legal or similarly significant effects. Quality and release notices support decisions made by the author.

11. Guest access in ReviewRoom

Authors can invite named guest reviewers to a fixed manuscript state using a time-limited invitation link. We process the guest name and email address, invitation and access status, the time of privacy acknowledgement, and review items created in ReviewRoom. An epubio account is not required. The invitation link is stored only as a hash, invalidated after first activation and replaced with a limited, revocable session. The author may optionally require a PIN shared separately. Processing supports the review initiated by the author under Article 6(1)(b) GDPR and secure, auditable operations under Article 6(1)(f) GDPR. The author can revoke access at any time. Contact details are anonymised no later than 90 days after expiry unless legal duties or legitimate evidentiary needs require otherwise.

12. Optional website analytics

After your explicit consent, epubio records visits to the public website, page views, active engagement time, landing and exit pages, referrer domain, voluntary UTM campaign details and coarse device, browser, operating-system, language, time-zone and screen-class data on its own infrastructure. Analytics does not record a full IP address, full user agent or manuscript, account, invitation, review or admin content. The visitor identifier lasts no more than 180 days, a session ends after 30 minutes of inactivity, and analytics data is deleted after no more than 13 months. The legal basis is consent under Article 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. Consent can be withdrawn at any time through cookie settings.