Privacy notice

What we process

We store what the service needs to work, and no more:

• Account: email address, display name, when you registered and confirmed. Signing in with Google or Apple adds the identifier that provider sends us.
• Use of the service: the books you create and their pages, reading position, bookmarks, highlights, likes and the authors you follow.
• Credits and purchases: your balance, every grant and every spend, the books you bought, and the link to a Stripe customer record.
• Preferences: language, currency, theme, and whether you want the newsletter.
• Generation jobs: the brief you give and the state of the job.
• Launch notification: while Fablewerk is not yet public, you can enter your email address on the preview page. We store it with your language and the time, and use it only to write to you once that Fablewerk is live.

Legal bases

• Account, books, reading position, preferences: performance of a contract, Art. 6(1)(b) GDPR — without them there is no service.
• Purchases, credits, invoicing data: performance of a contract, and legal retention duties under Art. 6(1)(c) GDPR.
• Newsletter: consent, Art. 6(1)(a) GDPR, withdrawable at any time in settings.
• Analytics and marketing services: consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, withdrawable at any time under “Cookie settings”.
• Launch notification: consent, Art. 6(1)(a) GDPR, withdrawable at any time via the address in the legal notice.
• Running and securing the servers: legitimate interests, Art. 6(1)(f) GDPR.

Who else sees the data

Four companies process data on our behalf, each under an Art. 28 GDPR agreement. There are other recipients only if you agree to analytics or marketing in the cookie settings: then the services listed there, see “Cookies and browser storage”. We do not sell data.

Transfers outside the EU

Where data reaches the United States, the transfer rests on the European Commission’s standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework.

Payment data

We never see card or bank details. Payment happens entirely at Stripe; we receive only the confirmation that it succeeded, the amount, and a customer reference, so we can credit your balance.

Cookies and browser storage

Strictly necessary are: a cookie that keeps you signed in, one that remembers your chosen currency, while Fablewerk is not yet public one that remembers that you entered the password of the preview page, and an entry in your browser’s storage that keeps your choice in the cookie settings (twelve months). They are required for the service you asked for and need no consent under § 25(2) TDDDG.

We use analytics and marketing services only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Until then none of their scripts is loaded. You decide on analytics and marketing separately, in the notice on your first visit and at any time again under “Cookie settings” at the bottom of the page or in your account preferences. Withdrawal applies for the future; we then delete the services’ cookies from your browser.

The cookie settings show which services are in use right now. A service not listed there is not set up and is never loaded. The candidates are:

What the advertising and analytics services receive

With your consent these services learn which pages you visit, technical details of your device and browser, your IP address, and a few events: that an account was created or someone signed in, that a book was started, that its outline is ready or that it is finished, and that a purchase took place, with amount and currency. We do not pass on your name, your email address or the content of your books.

For the collection through the Meta Pixel we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR); Meta alone is responsible for any further processing. Google and TikTok process the data partly under their own responsibility. Where data reaches the United States or other third countries, the transfer rests on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses.

How long we keep it

• Account data and content: until you delete the account. Your books, bookmarks and highlights go with it.
• Purchase and payment records: ten years, as commercial and tax law require. These outlive the account.
• Newsletter: until you withdraw consent.
• Launch notification: until we have sent it, or earlier if you ask us to delete it.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21 GDPR). Consent once given can be withdrawn at any time, with effect for the future.

You can delete your account yourself in settings. For anything else, a message to the address in the legal notice is enough.

You may also complain to a data protection supervisory authority, usually the one where you live.