BookGPT privacy notice

1. Controller

The controller under the General Data Protection Regulation is:

Maximilian Löser IT Solutions
c/o IP-Management #6776
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany

Phone: +49 163 7929930
Email: hello@book-gpt.app

This notice applies to the BookGPT websites at book-gpt.app and buch-gpt.de and to the app at account.book-gpt.app and app.buch-gpt.de.

2. Hosting and server logs

BookGPT runs on its own server in Germany. When the service is accessed, we process data required for technical operation. This includes the IP address, browser user agent, time and requested page. Logs are used to keep the service secure and reliable, diagnose errors and prevent attacks. They are deleted within 14 days unless a security incident requires longer retention.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the service.

3. Registration and account

To create an account, we process first and last name, email address, language and the time at which the legal documents were accepted. Passwords are not stored in plain text. We store a salted password hash and the security data needed for authentication.

Two-factor authentication is optional. If enabled, the TOTP secret is encrypted and recovery codes are stored only as hashes. Account activation and password-reset tokens are time-limited or stored as one-way lookup values.

We also process the credit balance, credit transactions, Stripe customer ID and necessary account and security settings. The legal basis is Article 6(1)(b) GDPR. Security measures are additionally based on Article 6(1)(f) GDPR.

4. Cookies

BookGPT does not use analytics or advertising cookies.

The connect.sid cookie maintains the login and protects account operations. It is strictly necessary, is stored only when a session is needed and expires after no more than 30 days. The bgpt_ui cookie stores only display preferences such as the theme and text size. It expires after one year. The legal bases are section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act and Article 6(1)(b) or (f) GDPR.

Visitors who follow a referral link under /r/ receive the signed bg_ref cookie. It contains only the referral code and expires after 60 days. Attribution of a registration does not store an IP address or referrer. Technical access data may nevertheless be processed for a short period in server logs for abuse prevention. The referral programme is based on Article 6(1)(f) GDPR. Our legitimate interest is the correct attribution and settlement of successful referrals. The cookie can be deleted in the browser.

5. Payments through Stripe

We use Stripe Checkout for one-time purchases. The provider for European business users is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Other Stripe entities, banks or payment services may be involved depending on the selected payment method.

Stripe receives the data needed for payment and invoicing. This may include the buyer's name, email address, billing and, where applicable, shipping address, country, tax status or tax ID, package, amount, currency, order reference, IP address and payment method information. Buyers enter full card or bank details directly with Stripe. BookGPT receives information such as the Stripe customer ID, Checkout session ID, payment status, amount and currency.

Processing is necessary to conclude and perform the purchase, prevent fraud and comply with accounting and tax obligations. The legal bases are Article 6(1)(b) and (c) GDPR. Security checks are also based on Article 6(1)(f) GDPR.

More information is available in Stripe's Privacy Policy.

6. Book generation through AI providers

BookGPT does not operate its own AI model. When a book function is requested, the required input, instructions, manuscript sections and technical parameters are sent to the provider selected by the user or designated for that function. The provider's response is returned to BookGPT and associated with the book.

Provider Location or processing region Purpose Anthropic PBC United States Text planning, generation and editing OpenAI United States Text planning, generation and editing Google Ireland Limited, Gemini Ireland, with possible further processing under Google's terms Text and image functions Melious AI GmbH Germany and EU infrastructure Text and image functions fal, Features & Labels Inc. United States Cover and image generation Nebius EU infrastructure where an EU endpoint is configured Text and image functions

For text functions, the user's selection will normally determine the provider. For covers and other image functions, BookGPT may use a configured sequence of Gemini, Melious and fal.ai. If one service fails, the same image prompt may be sent to the next service. Before an action is triggered, the app identifies the intended provider or function where the interface offers a choice.

The legal basis is Article 6(1)(b) GDPR. Users may include third-party personal data only where they have a legal basis to do so. Special categories of personal data under Article 9 GDPR should not be included in prompts or manuscripts unless this is necessary and lawful.

Transfers outside the EEA

Providers in the United States may receive data in a third country. BookGPT may rely on an adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework where the recipient has a valid certification, or must put appropriate safeguards such as the Standard Contractual Clauses under Article 46(2)(c) GDPR in place. Supplementary safeguards must be used where required and available. US public authorities may access data under the conditions of US law. Consent under Article 49(1)(a) GDPR may be required for non-essential transfers that are not covered by another transfer mechanism.

The providers' privacy notices are available here:

• Anthropic
• OpenAI
• Google
• Melious
• fal.ai
• Nebius

BookGPT does not use inputs or books to train its own model. Several commercial API providers state that they do not use inputs and outputs for model training by default. This applies only to the extent of their current contracts, settings and commitments. Providers may retain content for a limited period for security, abuse review, support or legal obligations. BookGPT therefore cannot make a general promise that an external provider keeps no copy or log at all.

7. Storage of books and files

Prompts, plans, manuscripts, covers, exports and editing states are stored on the BookGPT server so that users can continue their work and download files. They remain there until the user deletes the individual book or the account. A generation or deletion job already in progress may briefly delay final removal. Statutory retention obligations remain unaffected.

BookGPT does not publish a book automatically. A public book page is created only after a separate publication approval in the system. Once approved, the title, author name, cover, sample and downloads can be accessed without logging in and may be indexed by search engines. Approval can be withdrawn for the future. Copies made by third parties and search engine caches are not fully under our control.

The legal basis for private storage is Article 6(1)(b) GDPR. Publication is based on Article 6(1)(b) GDPR and, where required, consent under Article 6(1)(a) GDPR.

8. Email

BookGPT sends transactional email through its own mail server. Messages include account activation, password reset, security messages and support replies. We process the recipient address, subject, message, delivery status and technical delivery data. Messages awaiting delivery may remain encrypted in an outgoing queue for up to 24 hours.

The legal bases are Article 6(1)(b) and (f) GDPR. Our legitimate interest is the reliable delivery of security and contract-related messages.

9. Error reports

When a technical error occurs, BookGPT creates an error reference. The error type, requested route, time and, for logged-in users, user ID are stored. The technical stack is sanitised. Prompt, manuscript and message content is not copied into the error record. Max may receive the error report by email.

The data is used for troubleshooting and operational security. The legal basis is Article 6(1)(f) GDPR. Account-linked error data is removed when the account is fully deleted. Other error records are deleted when no longer needed for analysis unless a security or evidentiary requirement applies.

10. Support and feedback

The support chat stores the subject, message, language, timestamps and conversation history. A user ID is linked for logged-in users. Guests provide an email address. Replies may also be sent by email. Feedback may include the affected page, a selected page element and window size. Forms are rate-limited to prevent abuse, and the IP address may temporarily serve as the technical rate-limit key.

The legal basis is Article 6(1)(b) GDPR where an account or contract is concerned. General enquiries, feedback and abuse prevention are based on Article 6(1)(f) GDPR. Support conversations and feedback are removed when the account is fully deleted unless a legal duty or pending legal matter requires retention.

11. No tracking and local resources

BookGPT does not use audience analytics, third-party trackers or personalised advertising. Google Fonts and frontend assets are not loaded from Google or a public CDN. Fonts, stylesheets and scripts are served from BookGPT's own server. External connections occur only when needed for a function requested by the user, such as Stripe Checkout or the selected AI processing.

12. Recipients

Access is limited to people and service providers who need it to operate BookGPT, process payments, provide support or perform the selected AI function. A data processing agreement under Article 28 GDPR must be entered into where required by law. Data may also be disclosed to authorities, courts or advisers where required by law or necessary to establish, exercise or defend legal claims.

13. Retention periods

Each category is kept for the shortest period needed for its purpose:

• Server logs are normally deleted within 14 days.
• Session, display and referral cookies expire after 30 days, one year and 60 days respectively.
• Account data, books and support data remain until the relevant item or account is deleted.
• Encrypted outgoing email queue records expire after no more than 24 hours.
• Contract, payment and tax data is retained for statutory retention periods.
• External providers determine their retention periods under their contracts and privacy notices.

Where legal proceedings are reasonably foreseeable, relevant data may be restricted and retained until the applicable limitation and evidentiary periods expire.

14. Account deletion

Logged-in users can permanently delete their account in the security settings. The app requires an explicit confirmation, the current password for local accounts and a second factor where two-factor authentication is enabled.

Deletion covers the account, books, files, folders, sessions, tokens, credit records, support conversations, feedback, referral records and account-linked error data. Active generation jobs are cancelled or allowed to finish before deletion proceeds. Deletion cannot be undone. Separate payment and accounting records held by Stripe or in the accounts remain only to the extent required by statutory retention duties. They are no longer available as an active app account.

15. Data subject rights

Subject to the statutory conditions, individuals have the right to:

• access under Article 15 GDPR
• rectification under Article 16 GDPR
• erasure under Article 17 GDPR
• restriction under Article 18 GDPR
• data portability under Article 20 GDPR
• object to processing under Article 21 GDPR
• withdraw consent with future effect under Article 7(3) GDPR

Requests can be sent to hello@book-gpt.app. We may require proof of identity to prevent disclosure to an unauthorised person.

Individuals may also lodge a complaint with a data protection authority. The authority particularly relevant to the controller is the Hamburg Commissioner for Data Protection and Freedom of Information: datenschutz-hamburg.de.

16. Version and changes

This notice is dated 5 November 2026. We will update it if functions, providers or legal requirements change. The current version will be made available on the BookGPT websites.