Privacy Policy

BookArc is operated by Istiaq Ahmed (sole trader), based in Bangladesh. We decide what happens to the personal data described here, which in data-protection language makes us the controller of it.

For anything in this policy — including a request to see, correct or delete your data — write to support@bookarc.ai. A person reads that inbox; there is no ticket system to get lost in.

Four things, and nothing beyond them.

• Your account. Your email address, and — only if you chose “Continue with Google” — the name and profile picture Google hands over. Passwords are never stored by us in any readable form: sign-in is handled by a specialist provider, and what we hold is a reference to your account with them, not a password.
• What you write. The idea you type into the box, the settings you pick for a book, the plan it produces, every chapter written, and the cover images drawn for it.
• What you have bought. Your plan, your credit balance, and a line for every credit spent or granted. Card numbers are not on that list — see section 4.
• How the service ran. For each generation: which model answered, how many tokens it used, what it cost us and whether it failed. Plus ordinary server logs — IP address, browser, page requested — which is how the site is kept up and abuse is spotted.

There is no analytics tracker, no advertising pixel and no session recorder on this site. If that ever changes, this paragraph changes with it and the cookie policy will say so.

What goes to them, on each request:

• The idea you typed, and the title, genre, audience, format and length settings for the book.
• A short summary of the chapters already written, so the next chapter follows on from them rather than repeating them.
• For a cover: the title, subtitle and genre, and the art direction we derive from them.

What does not go to them: your email address, your name, your account id, your payment details, or anything about what you have bought. The model is sent a brief, not a person.

The work is done by a small number of established AI companies, on their paid developer APIs, under terms in which the provider states that content sent through the API is not used to train their models. We do not grant anybody the right to train on what you write, and we do not sell it, publish it or share it with anyone else.

Which provider answers depends on the kind of request, and it changes as models improve. We do not publish the list, for the same reason we do not publish the rest of what the service runs on — but if you are evaluating BookArc for something sensitive and need to know before you commit, ask at support@bookarc.ai and we will tell you.

Those providers process the request on servers outside Bangladesh, including in the United States. If we change provider, this section is updated before the change goes live.

Payments are taken by Polar, who act as the merchant of record. That means Polar — not us — takes the card, handles the tax and issues the invoice. Your card details go to Polar and their payment processor. They are never sent to us and we could not store them if we wanted to.

What we keep is enough to tie a payment to your account — a customer reference, your plan, and the date your period ends. That is how a payment becomes credits in your balance.

For readers in the EU and the UK, the lawful bases are these, in the language that framework uses:

• Performing our contract with you — your account, your books, your credits, your payments. Without these there is no service to provide.
• Our legitimate interests — server logs and generation records, used to keep the service running, work out what it costs us, and stop abuse.
• Legal obligation — records of what was sold, kept for as long as tax rules require.

Running BookArc means a handful of other companies handle some of this on our behalf. These are the kinds of company involved, and there are no others:

• Infrastructure and hosting. Runs the servers, the database your books are stored in, and the sign-in system. They hold what you write because it has to live somewhere; they do not read it.
• Payments. Polar, our merchant of record, who take the payment, handle the tax and issue the invoice. Card details go to them and their processor and are never sent to us.
• AI providers. The specialist companies whose models write the chapters and draw the covers. What they are sent, and what they are not, is section 3.
• Sign-in with Google. Only if you use that button instead of an email and password, in which case Google tells us your name, email address and profile picture.

Each is bound to use what it is given only to provide the service to us. We name the payment provider because it is who charges you and who appears on your statement; we do not publish the rest of the list, because a public map of the systems a business runs on is worth more to somebody attacking it than to anybody reading this page.

We do not sell personal data, and we do not share it for advertising. If the business is ever sold or merged, whoever takes it on inherits this policy — and you would be told before anything about it changed.

• Your account and your books: until you delete them, or until you ask us to close your account.
• A book you delete: removed from the database, and its cover files removed from storage, at the time you delete it.
• Billing records: kept for as long as tax and accounting rules require, which is longer than your account may live. This is the one category we cannot delete on request.
• Server logs: a short rolling window, then overwritten.

You can ask us for a copy of what we hold about you, to correct it, to delete it, or to stop a particular use of it. Ask from the email address on the account and we will do it within 30 days — in practice, within a few days.

Deleting your account deletes your profile, your books, your chapters and your cover images. Email support@bookarc.ai and it will be done; there is not yet a button for it in the app, and it would be misleading to say otherwise.

These rights are set out in the EU and UK GDPR. We offer them to everyone who uses BookArc, wherever you are, because running two standards of privacy for two sets of customers is not a thing worth building.

Every table holding your work is protected by row-level security in the database itself, so a query for somebody else’s books is refused by the database rather than by a check in the application that somebody could forget to write. Traffic is encrypted in transit, and API keys for the AI providers live only on the server.

No system is perfect. If there is ever a breach that affects you, you will be told about it, and told what to do about it.

BookArc is not for under-18s, and accounts are not knowingly created for them. If you believe a child has an account here, write to support@bookarc.ai and it will be removed.

When this changes, the date at the top changes with it. If a change matters — a new processor, a new use of what you write — you will get an email about it before it takes effect, not a silently edited page.