Privacy Policy
Effective date: [EFFECTIVE DATE]
This policy explains how Gold Prints Publishing ("Gold Prints", "we", "us") collects and uses personal data when you use Gold Prints Publishing Studio (the "Service"). We are the controller of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
Contact: goldprintspublishing@gmail.com, [REGISTERED ADDRESS] [ICO registration number: XXXXXXXX — data protection fee to be paid before launch] [EU representative under Article 27 EU GDPR, if required: NAME AND ADDRESS — SOLICITOR TO ADVISE]
1. The personal data we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, encrypted password, sign-in times | You, when you register or sign in |
| Workspace and team details | Workspace names, your role, display name, invitations you send or receive, book assignments | You and your team |
| Your content | Book details, chapters and their version history, Story and Series Bibles, outlines, research notes, tasks, comments, uploaded files, exports and backups | You and your team |
| AI requests | The text sent to our AI provider when you use an AI feature, the AI's reply, and a usage record (feature, time, model, amount of AI used) | Created when you use AI features |
| Activity records | Actions such as creating a book, saving a review or inviting someone | Created as you use the Service |
| Technical data | IP address, browser type, error logs, request logs | Your device and our hosting provider |
| Support messages | Anything you write to us | You |
Your manuscripts may themselves contain personal data (for example about real people). You are responsible for having the right to include it; we process it only to provide the Service.
We do not collect payment details at present. We do not use advertising or analytics tracking tools.
2. How and why we use it
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and workspaces, storing and displaying your content, backups, exports | Contract: necessary to provide the Service you signed up for |
| Running AI features you choose to use | Contract |
| Sending service emails (account confirmation, password reset, invitations, important changes) | Contract and legitimate interests |
| Keeping the Service secure, preventing abuse, enforcing our Terms, managing AI costs and usage limits | Legitimate interests (keeping the Service safe and sustainable) |
| Fixing errors and improving the Service | Legitimate interests |
| Answering support requests and complaints | Legitimate interests / contract |
| Meeting legal obligations (for example responding to lawful requests, keeping records) | Legal obligation |
Where we rely on legitimate interests, we have considered your rights and you can object (see section 7). We will ask for your consent before any optional use not listed here, such as marketing emails.
We do not use your content to train AI models, and we do not sell personal data.
3. Who we share it with
We use the following service providers ("processors"), who act only on our instructions under contracts that protect your data:
| Provider | What it does | Location of processing |
|---|---|---|
| Supabase | Database, sign-in and file storage | [REGION OF THE SUPABASE PROJECT — check Project Settings] |
| Vercel | Hosting the application | United States and other regions |
| OpenAI | Processing text for AI features you use | United States |
| [EMAIL PROVIDER, e.g. Resend or Postmark, once set up] | Sending service emails | [LOCATION] |
| [Stripe, only if paid plans are introduced] | Payments | [LOCATION] |
People in your workspace can see content according to the roles and book access the workspace owner gives them. We may also disclose data if required by law, to protect rights and safety, or as part of a sale or reorganisation of the business (in which case we would tell you).
4. International transfers
Some providers process data outside the UK and the European Economic Area, mainly in the United States. Where this happens we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified. [SOLICITOR TO CONFIRM THE MECHANISM FOR EACH PROVIDER.] You can ask us for details.
5. How long we keep it
See our Data Retention Policy for full details. In summary, we keep your account and content while your account is open; deleting your account deletes the data that belongs only to you; and work you contributed to a team's books stays with that team.
6. Security
We protect data with access rules enforced in the database (so people can only reach books they are allowed to see), encrypted connections, private file storage with short-lived download links, version history and daily backups. No system is perfectly secure; if a breach affects you, we will tell you and the regulator where the law requires.
7. Your rights
Depending on where you live, you have the right to:
- access your personal data (Settings → "Download my data" gives you a copy of your account details and your books);
- correct inaccurate data;
- delete your data (Settings → "Delete my account");
- restrict or object to some processing;
- data portability (the download is in a common, machine-readable format);
- withdraw consent where we rely on it.
To exercise a right, use the options in Settings or email goldprintspublishing@gmail.com. We will reply within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EU, to your local data protection authority. We would appreciate the chance to resolve your concern first.
8. Cookies and similar technologies
We use only what is strictly necessary to run the Service: sign-in cookies, and a copy of unsaved chapter text kept in your browser until it is saved. See the Cookie Policy.
9. Children
The Service is not intended for anyone under [18], and we do not knowingly collect their data.
10. Changes
We will post updates here and, for significant changes, tell you by email or in the Service.