Privacy Notice

This notice explains what personal data BookSemantic uses, why it is used, where it may be processed, and the choices available to you. It applies to the website, author workspace, support, and billing. It uses the terminology of the UK GDPR and Data Protection Act 2018 as amended by the Data (Use and Access) Act 2026, and PECR where applicable.

1. Who is responsible for your data

The BookSemantic service is operated by Intrellus Ltd, which is the UK data controller for account administration, service operation, security, billing records, and direct customer communications. Contact the controller at:

If EU GDPR Article 27 applies, the appointed EU representative and its contact details are shown above.

When you place personal data about readers, collaborators, research subjects, or other people in a manuscript, you determine why that data is used. For that content, you are the controller and BookSemantic acts as your processor only to provide the service on your instructions.

2. Data we collect

• Account data, such as name, email address, user ID, and sign-in events.
• Author content, including manuscripts, uploads, semantic marks, comments, revisions, canon, character and scene references, and generated files.
• Service and security data, such as device and browser information, IP address, request logs, usage totals, error reports, and abuse signals.
• Billing data, including Stripe customer and transaction identifiers, subscription status, credit ledger entries, refunds, and disputes. BookSemantic does not receive full payment-card details.
• Messages and files you send to support.

We normally collect this information from you, your invited collaborators, your device, and the services used to complete sign-in, payment, support, or a task you request. Account and billing information is required to enter or administer the service contract; optional manuscript content and marketing choices are not statutory requirements.

3. Purposes and lawful bases

4. AI processing and author controls

Content is sent to a configured AI provider only when you request a writing, analysis, image, brand, or advertising task. The request may include the selected passage and the book context needed to complete it. Human approval controls remain available before generated material becomes approved book content. Do not submit unnecessary special category data or personal data that you are not entitled to use.

5. Service providers and disclosures

We use contracted providers for cloud hosting and Firebase services, payments through Stripe, configured AI generation, database and file storage, transactional communications, support, and production monitoring. They receive only the data needed for their function and process it under their service and data-protection terms. We may also disclose data where required by law, to protect users and the service, or during a corporate transaction subject to appropriate safeguards. We do not sell personal data.

6. UK, European, and US data locations

BookSemantic may operate separate Google Cloud/Firebase resources in Europe and the United States. Your assigned deployment is communicated through the service configuration. A Firebase project has no single universal location: storage and processing location depends on each product and resource, and authentication, support, security, and subprocessors may involve processing outside the selected application region.

Where personal data is transferred from the UK or EEA to a country without an applicable adequacy decision, we use an appropriate transfer mechanism, such as the European Commission Standard Contractual Clauses and the UK International Data Transfer Agreement or UK Addendum, plus the UK data protection test and supplementary measures where required.

7. Retention

Account and book data is retained while your account is active and until you delete it or request account closure, subject to operational backup cycles. Billing, tax, fraud-prevention, dispute, and security records are retained for the periods required by law or reasonably needed to establish or defend legal claims. We then delete or anonymise data unless a legal hold applies. You should export your books before closing an account.

8. Your rights

Depending on your location, you may ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. Email privacy@booksemantic.com; we may need to verify your identity. You may complain to the UK Information Commissioner’s Office or, where EU GDPR applies, your local supervisory authority. The service does not make solely automated decisions that produce legal or similarly significant effects about users.

9. Cookies, security, and children

Strictly necessary storage and similar technologies support sign-in, fraud prevention, checkout, and security. Non-essential analytics or advertising technologies will be used only after the consent required by applicable law. BookSemantic is an authoring service for adults and is not directed to people under 18; creating a children’s book does not create a child account. We use layered access controls, encryption in transit, restricted storage, signed payment webhooks, validation, logs, and incident procedures, but no online service can promise absolute security.

10. Changes and complaints

Material changes will be announced in the service or by email before they take effect where required. Send a privacy question, rights request, or data protection complaint to privacy@booksemantic.com, or use the tracked support portal. We acknowledge a data protection complaint within 30 days, investigate it appropriately, and communicate the outcome without undue delay. If you remain dissatisfied, you can contact the ICO through its complaint service.