Privacy Policy

Version of 8 November 2026.

1. Controller

The controller responsible for processing personal data on Bookfairy is:

• Orbita Media GmbH, Ericusspitze 4, 20457 Hamburg, Germany
• Managing directors: Noah Malik, Stefan Schott
• Local Court of Hamburg (Amtsgericht Hamburg), HRB 161613

Please send data protection requests to support@getbookfairy.com. Further details are in the Legal Notice.

2. What this policy covers

This policy describes which personal data we process when you visit the website https://getbookfairy.com, use the free tools, create an account, buy services and use the Bookfairy tools, or scan a Bookfairy dynamic QR code. It applies to visitors, customers, people who scan codes and anyone who contacts us or reports something.

In short:

• Without your consent we do not set any analytics or marketing cookies. Our visitor statistics with Plausible work without cookies on our own server in Germany.
• We process your manuscripts, texts and images to provide the service you booked. For this, content is sent to AI providers, which we describe in section 4.9. Two of them, in Hong Kong and in the USA, work without a data processing agreement and without safeguards for the transfer to third countries (section 7).
• We ourselves do not use your content to train AI models unless you have separately agreed to this (§ 8(3) of the Terms and Conditions). For these two providers and the parties they use, we cannot rule out that they use content for their own purposes (section 4.9).
• If you scan a dynamic QR code, we forward you without cookies and without JavaScript and count the scan only by day, country and device type, without storing your IP address for this (section 4.16).
• We do not sell personal data.

3. Legal bases

We rely on the following legal bases of the General Data Protection Regulation (GDPR):

• Art. 6(1)(b) GDPR – performance of a contract and steps prior to entering into a contract: account, order, credit, provision of the tool services, support.
• Art. 6(1)(c) GDPR – legal obligation: in particular the retention of accounting records and invoices under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code, and VAT records; handling reports and giving reasons for blocks under the Digital Services Act (section 4.16).
• Art. 6(1)(f) GDPR – legitimate interests: security and stability of the platform, prevention of abuse and fraud, cookieless audience measurement, forwarding and checking of dynamic QR codes, enforcement of claims, offers by email to customers (section 4.11), market analysis of model books (section 4.19).
• Art. 6(1)(a) GDPR – consent: statistics and marketing services according to your choice in the cookie banner, tips and news by email (section 4.11) and the newsletter (section 4.12), the waiting lists for upcoming offers (section 4.17), any use of content for training. You can withdraw consent at any time with effect for the future.

Where information is stored on or read from your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies: Section 25(2) no. 2 TDDDG for what is strictly necessary, and your consent under Section 25(1) TDDDG for everything else.

4. What we process and why

4.1 Visiting the website and server logs

With every request, our servers process the IP address, date and time, the address requested, the referring page, the browser and the operating system. Purpose: delivering the pages, security and troubleshooting. Legal basis: Art. 6(1)(f) GDPR. We delete these logs after 7 days unless they are needed to investigate a specific security incident.

The website, the customer account and the tools run on servers of Hetzner Online GmbH in Germany. We serve fonts and program libraries from our own servers; no data is sent to font providers such as Google Fonts when a page loads.

4.2 Cloudflare

We use Cloudflare for name resolution (DNS), fast delivery of the pages (CDN) and protection against attacks and bots. Traffic passes through Cloudflare servers, which process the IP address and technical connection data. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Legal basis: Art. 6(1)(f) GDPR, our interest in a secure and fast website. Cloudflare is certified under the EU-US Data Privacy Framework (section 7).

4.3 Visitor statistics with Plausible (no cookies)

To understand which pages are read and where visitors come from, we use Plausible Analytics. We run Plausible ourselves on an Orbita Media server at Hetzner in Germany; no data is sent to Plausible Insights OÜ or any other third party. Plausible sets no cookies and reads nothing from your device. A value is derived from the IP address and the browser identifier, encrypted with a random value that changes daily, and is not stored permanently; the IP address itself is not stored. Only aggregated figures such as page views, referring page, country, device type and browser are stored. Recognising you across several days or devices is not possible.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to improve the website without intruding on your privacy. You can object (section 9); technically, a browser tool that blocks Plausible is enough.

4.4 Cookie banner and record of your choice

On your first visit we ask whether you agree to statistics and marketing services. We store your choice in the bs_consent cookie in your browser for 6 months. To prove your choice (Art. 7(1) GDPR), we record on our server a random consent ID, the categories chosen, the banner version and the date and time, without any link to an account. Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; for the cookie, Section 25(2) no. 2 TDDDG.

You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page.

4.5 Statistics and marketing only with consent

Before you consent, the following services are not loaded and no data is sent to Google or Microsoft. We use them only on the public pages of the website (including the pages of the free tools), not in the customer account, the checkout or the paid tools.

"Statistics" category:

• Google Analytics 4 counts visits, pages viewed, origin (referring page, campaign parameters), device type and approximate region, and measures events such as scrolling, clicks on links to other websites and filling in forms. The script loads from www.googletagmanager.com, which gives Google your IP address. Cookies: _ga and _ga_<ID>, 2 years each. Google does not store the full IP address. The data is deleted after 14 months.
• Microsoft Clarity creates session recordings and heatmaps: which pages you view and how you scroll, click and move the mouse. Input in form fields is masked and not recorded. Cookies: _clck (1 year), _clsk (1 day), and on Microsoft domains further technical cookies such as MUID (13 months). Recordings are deleted after 30 days; recordings marked as examples after 13 months at the latest.
• Visitor identifier in the tool log and entry point: with your consent we store in the log of the free tools (section 4.10) a pseudonymous visitor identifier, a shortened hash (HMAC) of your consent ID, so that we can assign several creations of the same browser to each other. Your browser also remembers the entry point of your visit in the storage bf_attr (sessionStorage): landing page, host of the referring page and UTM parameters. The entry ends with the session. Both stay with us and are not sent to Google or Microsoft.

"Marketing" category:

• Free tool progress: we remember in your browser's local storage which of the six free tools you have already used, so that the "x of 6" progress and the blurb bonus keep counting across pages (section 5). The list stays in your browser and is not sent to Google or Microsoft.

Google Signals (linking with Google accounts for cross-device reports) is switched off in our Google Analytics property; the consent mode settings ad_storage and ad_user_data therefore always stay "denied". We do not show ads or use retargeting.

Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Both act as our processors for these services; Microsoft additionally uses some data for its own purposes as described in its privacy statement. We have switched off the data sharing settings in Google Analytics that would allow Google to use the data for its own purposes. Google LLC and Microsoft Corporation in the USA may access the data (section 7).

Legal basis: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw at any time via "Cookie settings"; the services are then no longer loaded and we delete the cookies mentioned from your browser.

4.6 Account and sign-in

For an account we process your email address, your name if you provide it, a password in encrypted form or the identifier of a sign-in service, language setting, currency, and the time of registration and of the confirmation of your email address. For invoices you can add a billing address, company name and VAT identification number.

Registration, sign-in and session management are handled for us by Clerk, Inc., USA. Clerk processes your email address, sign-in data, IP address and browser details for this purpose and sets the cookies required for sign-in. Clerk is certified under the EU-US Data Privacy Framework (section 7).

Purpose: access to your account and assignment of your projects, purchases and credit. Legal basis: Art. 6(1)(b) GDPR.

Free samples. In its first 14 days, a new account can try up to three tools for free, each once per account and device. Addresses at disposable email services receive no samples, and no more than three new accounts per day from one IP address receive samples. For each sample we store the account ID, the confirmed email address, a device identifier taken from your browser's security cookie (section 5) and the time. We do not store your IP address for this, only a value encrypted with a key that changes daily (HMAC), which we delete after 7 days. Legal basis: Art. 6(1)(f) GDPR, our interest in preventing abuse of the free services; you can object under section 9. Welcome bonus. For this we store the time of your first sample, the deadline calculated from it and whether you received the bonus (Art. 6(1)(b) GDPR).

4.7 Orders, credit and payments

We process your orders, purchased services and quotas, your credit with all transactions (top-up, bonus, use, expiry, refund), redeemed discount codes, referral credits, invoices and payment status.

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your card or account details directly with Stripe; we do not store them. From Stripe we only receive the payment confirmation, the amount, the payment method, for cards the last four digits, and a transaction ID. Stripe also calculates VAT for us based on your country and, where applicable, your VAT identification number, and creates the invoice. For fraud prevention, compliance with anti-money laundering rules and its own legal obligations, Stripe acts as an independent controller. If you choose PayPal, Satispay, Apple Pay or Google Pay, the respective payment service also receives the data required for the payment under its own responsibility.

Purpose: performance of the contract, billing, accounting and fraud prevention. Legal basis: Art. 6(1)(b) and (c) GDPR; for fraud prevention Art. 6(1)(f) GDPR. In the event of a chargeback we provisionally block the account; a person reviews the case before a final decision is made.

4.8 Your projects, manuscripts and results

When you use the tools, we store your book projects with all uploaded files (for example manuscripts, images, covers), your inputs and settings, and the results generated (for example outline and chapters, edited text with tracked changes, cover files, print PDF, EPUB, blurbs, titles, keywords, categories, A+ modules) together with their versions. This data is stored on our servers at Hetzner in Germany.

Your content may contain personal data, such as your author name, an author photo, a biography or information about people who appear in the book. Purpose: providing the service booked and making your library available with download and data export. Legal basis: Art. 6(1)(b) GDPR.

If your content contains personal data of third parties, you are responsible for it yourself (§ 17(3) of the Terms and Conditions). Insofar as we process such data on your behalf, the data processing agreement under § 17(4) of the Terms and Conditions applies.

To convert print files into the PDF/X print format, we use the pdfRest service of Datalogics, Inc., USA, exclusively via its data centres in the EU.

4.9 AI processing in the tools

The tools "Write a book", editing, cover, blurb, titles, categories, keywords and A+ work with AI models (details in the AI transparency notice). For this, we send the content needed for each result to external AI providers: for example your book idea and outline, sections of your manuscript, images for the cover or your description of the book. We do not send payment data and, unless needed for the result, neither your name nor your email address.

We currently use the following providers:

The two intermediaries pass the content on for processing to the makers of the respective model, in particular Anthropic PBC (USA), OpenAI (USA), Google (USA) and, for individual image functions, ByteDance or BytePlus (outside the EU). According to the intermediary in Hong Kong, depending on price and availability it also routes requests through further resellers and through the capacity of subscriptions; it does not disclose which parties these are in a given case or in which country they are based. Which model a tool uses may change if a model fails or we switch to a better one. We will tell you the specific recipients on request at support@getbookfairy.com (Art. 15(1)(c) GDPR).

The providers process the content to generate the result for us. We ourselves do not use your content to train, fine-tune or improve AI models unless you have separately and expressly agreed to this (§ 8(3) of the Terms and Conditions). We call all providers through their programming interfaces (APIs); which routes and accounts the intermediaries use behind them to handle the requests is up to them.

We have no contract under Art. 28 GDPR with the two intermediaries, and no agreement that excludes the use of your content for training. We therefore cannot rule out that the intermediaries or the parties they use store the content under their own terms or use it to operate and improve their services and models. How long they keep data is governed by their terms; we cannot have the data deleted there. For this reason, please do not upload identity documents, tax or health data, or photos of other people to the tools.

Legal basis: Art. 6(1)(b) GDPR, because the AI processing is the service you booked. For transfers to third countries, see section 7.

AI results are suggestions; they are not a decision about you within the meaning of Art. 22 GDPR.

Voice input. In long text fields you can dictate instead of typing. Recording only starts once you tap the microphone button and your browser has allowed access to the microphone; if you discard a recording, nothing is sent. When you finish with "Done", we send the recording to Groq (Groq UK Limited, 3 Hammersmith Grove, London W6 0ND, United Kingdom, together with Groq LLC in the USA), where the speech model Whisper large-v3 transcribes it. The recording contains your voice and whatever you say, so it may include personal data about you or other people. Your voice is only transcribed; it is not analysed to identify you. The text appears in the field so that you can check it, and it is only processed further once you submit the form yourself (section 4.8 then applies).

The purpose is to let you enter text by speaking. Legal basis: Art. 6(1)(b) GDPR; using voice input is voluntary, and you can always type instead. We store neither the recording nor the transcribed text. For the daily limit and our cost overview, we only keep the time, length, detected language and cost of each recording with your account. Groq acts as our processor under a contract pursuant to Art. 28 GDPR, which does not allow it to use recordings or texts to train AI models. According to Groq, it does not keep requests by default; only to fix faults or when abuse is suspected may it log requests and results for up to 30 days, unless the law requires a longer period. For transfers to the United Kingdom and the USA, see section 7.

4.10 Free tools without an account

The QR code generator, spine width calculator, KDP cover template, ISBN barcode, printing cost calculator and words-to-pages estimator work without an account. We use your inputs (for example page count, paper type, ISBN or the content of a QR code) to calculate the result or create the file. Legal basis for this: Art. 6(1)(b) GDPR.

Files. Images and PDFs of the tools are created in working memory for each request, sent to you and never stored, neither on disk nor in the database. The downloads contain no metadata that points to you or to us as a person (PDF author empty, creator only the name of the tool).

Log. We do, however, keep a log of what is created with the tools. For each creation we store one entry with:

• time, tool, kind (preview, download or result) and file format,
• your inputs in a minimal form: ISBN and barcode text; for QR codes, of a target address only scheme, host and path (no parameters), of a text only its length, for email, phone and SMS only the type, for Wi-Fi only the type of encryption, for a vCard only which fields are filled in and the host of the website; of the logo only "yes" or "no", no image data; email addresses in free text are replaced by a placeholder,
• for the calculators, the values entered and the key figures of the result,
• the origin: host of the referring page, UTM parameters, landing page, current page and language,
• your customer ID, only if you are signed in,
• the link to your newsletter sign-up (section 4.12), if you sign up right after a creation.

Previews within one page view are combined in one entry (with a counter). We do not store an IP address in the log, and without your statistics consent an entry contains no visitor identifier.

Only with your consent (statistics, section 4.5), a pseudonymous visitor identifier is added to the log, together with the storage bf_attr in your browser, which holds the entry point of your visit (landing page, host of the referring page, UTM parameters). Without consent the entry contains only the values of the current page.

Purpose, legal basis, duration. We want to improve the tools and to evaluate for which books (ISBN) and purposes they are used and through which channels visitors reach us. The legal basis for the log is Art. 6(1)(f) GDPR; for the visitor identifier and bf_attr it is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can object to the log under section 9 (Art. 21 GDPR). We delete the entries automatically after 14 months (daily deletion run), so that a full year can be compared with the previous one; Google Analytics keeps its data just as long.

4.11 Emails

We send you emails that are necessary to perform the contract, for example to confirm your email address, order and contract confirmations, invoices, notices about finished results, expiring credit or changes to the terms. Legal basis: Art. 6(1)(b) and (c) GDPR.

Emails needed to perform the contract also include a welcome email after you create your account, the message that your free sample is ready, a reminder before unused samples expire and a message if a payment was not completed. These emails contain no advertising. Offers by email. If you have an account, we send you offers for our own similar Bookfairy tools and services, for example to unlock a tool you have tried, about the welcome bonus before it expires, about other suitable tools, about unused credit or after a longer break. Legal basis: Sec. 7(3) of the German Act against Unfair Competition (UWG) and Art. 13(2) of Directive 2002/58/EC; to the extent the GDPR also applies, Art. 6(1)(f) GDPR, our interest in direct marketing. Which email you receive depends on your account: samples used, purchases, open payments, credit, bonus deadline and last use. With the consent you give when creating your account (Art. 6(1)(a) GDPR) we also send tips and news. You can object to offers and withdraw consent at any time at no cost other than standard transmission charges: via the link in every such email, in your account settings or by message to support@getbookfairy.com; this takes effect immediately. We store your objection so that we do not contact you again. As proof of your consent we store the time, wording and language of the consent text and the confirmation of your email address by Clerk (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Emails are sent via Amazon Simple Email Service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, using data centres in the EU. Access by Amazon.com, Inc. in the USA cannot be ruled out (section 7).

4.12 Newsletter, free PDF and personal codes

After using one of the free tools you can sign up for our newsletter and get a free PDF for it. For this we process:

• your email address and the language and currency of the website,
• the tool where you signed up, the moment of the sign-up (after a result or when leaving the page) and the free tools that, according to your browser, you have already used (at most six),
• date and time of the sign-up, the confirmation and, where applicable, the unsubscription,
• as proof of your consent, the version and the full wording of the consent text you saw, plus an encrypted value (HMAC) of your IP address and of your browser identifier; we do not store the IP address or the browser identifier themselves,
• which emails we sent you and when, with the delivery ID of Amazon SES, and the personal codes that belong to your sign-up.

Double opt-in. After signing up you receive an email with a confirmation link. The sign-up only takes effect once you confirm it on the linked page. This email contains no advertising; we send it at most every 10 minutes and at most three times to the same address. If you do not confirm, you get no further email, and we delete the sign-up after 30 days.

Content and frequency. In the first two weeks after the confirmation you receive up to six emails: the free PDF, notes on print files, a worked example, a personal discount code with a reminder before it expires, and an overview of the free previews. After that we send at most two emails a month with tips on writing, typesetting, printing and publishing books, news and offers from Bookfairy.

Tailored to your tool. Which notes and examples the emails contain depends on the tool where you signed up, for example print files after the barcode, cover template or spine tool. We do not build any further profile. We do not measure whether you personally open our emails or click links in them. Only in emails with offers do we count anonymously how often a button in them was clicked: one total per kind of email and day, without storing an email address, account, IP address or device, so the number cannot be traced to a person (Art. 6(1)(f) GDPR, improving our offers). For this, these emails send the buttons through our own address; service emails do not. Our emails contain no counting image or any other measurement of opening.

Personal codes. With the newsletter you receive a personal discount code for your first order, valid for 48 hours. If you had used at least three different free tools when you signed up, you also receive a code for a free blurb after the confirmation, one per email address. Your browser counts the free tools used; we take the number from the sign-up. When you redeem a code, we process this like any redemption at checkout (section 4.7).

Link to the tool log. If you sign up right after a creation, we link the sign-up to the matching entry in the log of the free tools (section 4.10), so that we can see which tool led to the sign-up. The log itself does not contain your email address.

Voluntary. Signing up is voluntary. The free tools work fully without signing up and without consent; only the PDF and the personal codes come with the newsletter.

Legal bases. For the newsletter, your consent (Art. 6(1)(a) GDPR; for advertising by email also Section 7(2) no. 2 of the German Act against Unfair Competition, UWG). For the record of the consent, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. To prevent mass sign-ups we limit the number of sign-ups per IP address; for this an encrypted value of the IP address is kept in the cache of our server for 10 minutes. The legal basis for this is Art. 6(1)(f) GDPR, our interest in preventing abuse.

Withdrawal. You can withdraw your consent at any time with effect for the future: with one click on the unsubscribe link in every email, with the unsubscribe function of your email program, or by writing to support@getbookfairy.com. Unsubscribing takes effect at once; we no longer send emails of the sequence that were still planned.

Sending. The emails are sent by Amazon Simple Email Service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as our processor, via the data centre in Stockholm, Sweden (region eu-north-1). Addresses that cannot be delivered to, or whose recipients reported an email as spam, are put by Amazon SES on a suppression list of our account, so that we do not write to them again.

Retention. We delete unconfirmed sign-ups after 30 days. As long as you are signed up, we keep the data for the newsletter. After you unsubscribe, we delete your email address after 30 days; we keep the record of consent and withdrawal, with an encrypted value of the address instead of the address itself, for another 3 years as proof and then delete it.

4.13 Referrals

If you come to us via a referral link, we assign your account to the referring person when you register. If you buy for at least the minimum amount named on the referral page in one order, you and the referring person each receive a credit in tokens after the waiting period named there, provided the purchase was not refunded or charged back; if it is refunded or charged back later, we take the credit back. Before the credit, we check whether someone referred themselves. To do so, we compare the two accounts by email address, the device identifier from the free previews, the IP addresses stored at sign-in and the card identifier formed by our payment provider Stripe (not the card number). The referring person only sees the first letter of your name or email address, whether a purchase triggered the credit and when it will be booked; they do not see your email address, your orders or your content, nor why a referral did not count. Legal basis: Art. 6(1)(b) GDPR towards the referring person and Art. 6(1)(f) GDPR towards you (legitimate interest: running the programme and preventing abuse); you can object.

4.14 Contact and support

If you write to us, we process your message, your contact details and any attachments to handle your request. Legal basis: Art. 6(1)(b) GDPR for questions about the contract, otherwise Art. 6(1)(f) GDPR.

4.15 Data export and deleting your account

You can export your data and content in your account at any time. If you delete your account, we first move it to a trash bin from which you can restore it; it is only deleted permanently in a second step. Data we are required to keep (for example invoices) is restricted until the retention period ends instead of being deleted.

4.16 Short addresses and QR forwarding (dynamic QR codes)

With the "Dynamic QR codes" subscription, customers create QR codes that contain a short address on a separate domain of ours that is used only for this purpose (the forwarding domain). Anyone who scans such a code opens this short address, and our server immediately forwards them to the target the customer has set. This section applies to everyone who scans or reports a code and to customers who manage codes. You can also find it on the forwarding domain at /privacy.

Who is responsible. We are the controller for the forwarding itself, the security of the service, the prevention of abuse and the handling of reports (section 1). We compile the scan statistics on behalf of the customer who distributes the code, for example on a book, a poster or a flyer (processing on behalf under Art. 28 GDPR). The customer is the controller for these statistics and informs you about them in their own privacy policy. We forward any requests about the statistics that reach us to the customer.

What is processed when you scan. When a short address is opened, our servers receive, as with any website, your IP address, the date and time, the short address requested and the information your browser sends on its own (user agent, language setting). The traffic passes through Cloudflare (section 4.2); Cloudflare determines the country from the IP address and passes on only the country code to us. We use this information to forward you or to show a notice page in your language, to count the scan and to protect the service against abuse and overload. Unlike for the website (section 4.1), we do not write requests to the forwarding domain to our server logs; we process the IP address only for the duration of the request. We do not pass any information about you to the target site; what happens there is governed by the target site's privacy policy.

No cookies, no JavaScript, no recognition. The short addresses and all pages of the forwarding domain set no cookies, use no browser storage and contain no JavaScript. We store nothing on your device and read nothing from it. We do not create an identifier or a hash from your IP address and user agent, and we do not recognise you when you scan again. We count scans, not people.

Scan statistics. For each scan we increase a daily counter. We store only the code, the day (Coordinated Universal Time, UTC), the country as a country code or "unknown", the device class (smartphone, tablet, computer, automated request, other), the operating system family (iOS, Android, Windows, macOS, Linux, other) and the count. We derive the device class and operating system from the user agent at the moment of the request; we do not store the user agent itself or the IP address for the statistics. Automated requests, such as link previews in messengers, are counted separately. The counters stay in our server's cache for up to 3 days and are transferred to the database every minute. The stored daily figures do not allow any conclusions about individual persons. The customer sees them in their account and can download them as a CSV file.

Notice pages. Instead of an immediate redirect, a page of the forwarding domain may appear: "Code is being checked" while a new or changed target has not yet been checked; a notice showing the target with a "Continue" button during the first 3 days after a customer's first subscription and while a reported or suspicious code is being reviewed; a block page for blocked codes. These pages also set no cookies and contain no JavaScript.

Checking the targets. Before a new target is activated, we check it automatically on our own server: against public block lists of known phishing, scam and malware sites (currently Phishing.Database, Block List Project and HaGeZi Threat Intelligence Feeds) and against our own rules, for example no third-party link shorteners, no direct downloads of executable files, and our own block list of domains. The same check runs whenever a target is changed and regularly for all active targets; we download the lists again several times a day. We only download the lists and compare the targets on our side: no target addresses, no data about people who scan and no customer data are passed to third parties for this. New accounts that change many targets in a short time are slowed down automatically.

Reporting abuse. On the forwarding domain you can report a code at /report, without an account (Art. 16 of Regulation (EU) 2022/2065 on digital services, "DSA"). We process the short address or code, the category, your explanation, in the case of copyright, trade mark or personality rights the right concerned and who holds it, your name and email address, your confirmation that you are reporting in good faith, the language and the time. For reports of child sexual abuse material, your name and email address are optional. Purpose: reviewing the report, acknowledging receipt, informing you of our decision and keeping evidence for authorities and courts. The customer learns that and why a code was reported or blocked; we only pass on your name if this is strictly necessary for the review, for example when your own rights are concerned. We report information about criminal offences that threaten the life or safety of persons to law enforcement authorities (Art. 18 DSA). To prevent mass reports, we limit the number of reports per connection; for this, an encrypted value (HMAC) of your IP address stays in our server's cache for 10 minutes.

Customer data. For the subscription we process, for each code, the short address, the current and earlier targets, the name of the code, its design and any uploaded logo, its status, the check results and any reports, blocks, reasons and appeals relating to it; payments are handled by Stripe (section 4.7). If we block a code, you receive the reasons by email. After the subscription ends, a code keeps forwarding to its last target; for this we continue to store the code and its target. If you delete a code permanently, we remove the target, name, design and logo; only the short address stays reserved so that it never points to a different target.

Legal bases. Forwarding, notice pages and checking of targets: Art. 6(1)(f) GDPR. Our legitimate interest, and that of the people who scan, is to reach the intended target reliably and to be protected against phishing, malware and overload (Recital 49 GDPR). Towards customers, forwarding, checks and the management of codes are also part of the contract (Art. 6(1)(b) GDPR). Scan statistics: Art. 6(1)(f) GDPR; the customer's legitimate interest is to measure the reach of their own printed codes. As we create no identifier, store nothing on your device and recognise no one, your interests do not prevail. Reports, reasons for blocks and information to law enforcement authorities: Art. 6(1)(c) GDPR in conjunction with Art. 16, 17 and 18 DSA; keeping evidence and limiting reports: Art. 6(1)(f) GDPR.

Retention. Scan counters in the cache up to 3 days; daily statistics for the term of the subscription and up to 30 days after it ends (exportable in the account while the subscription runs); reports, decisions, appeals and earlier targets 3 years (limitation period under Sections 195 and 199 BGB); value for limiting reports 10 minutes; codes with their target for as long as the forwarding runs.

Waiting list. As long as dynamic QR codes cannot be booked yet, you can join a waiting list; section 4.17 applies to it.

Your rights. The rights under section 9 apply, in particular the right to object under Art. 21 GDPR and the right to lodge a complaint with the Hamburg Commissioner for Data Protection and Freedom of Information. We store nothing about people who scan that identifies them. We therefore cannot attribute an individual scan to a person; the rights under Art. 15 to 20 GDPR apply in this respect only if you provide additional information that makes attribution possible (Art. 11(2) GDPR).

4.17 Waiting lists for upcoming offers

For offers that cannot be booked yet, you can join a waiting list on our website, currently for dynamic QR codes (section 4.16) and for our subscription (Start, Plus, Pro). The only purpose is to send you one email as soon as the chosen offer can be booked, plus at most one reminder. We send no newsletter and no other advertising to this address. The number of confirmed sign-ups helps us decide whether and when we launch an offer; for this we only look at totals per offer, currency and preferred billing. You sign up separately for each offer. We process:

• your email address, the chosen offer, the language and the currency of the page and, if you state it, whether you would prefer monthly or yearly billing,
• the date and time of the sign-up, the confirmation and, where applicable, of leaving the list,
• as proof of your consent, the version and the full wording of the consent text you saw, and an encrypted value (HMAC) of your IP address and your browser identifier at sign-up and at confirmation; we do not store the IP address and the browser identifier themselves.

Double opt-in and withdrawal. After signing up you receive an email with a confirmation link. You are only on the list once you confirm on the linked page. The link is valid for 7 days; per offer we send at most three confirmation emails to the same address within 24 hours. Signing up is voluntary and commits you to nothing, including no later purchase. You can withdraw your consent at any time with effect for the future and leave the list: with the link in every email, with the unsubscribe function of your email program or by writing to support@getbookfairy.com. The emails are sent by Amazon Simple Email Service as described in section 4.12. Only our team sees the lists.

Legal bases. For the waiting list, your consent (Art. 6(1)(a) GDPR); for the record of the consent, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. To prevent mass sign-ups we limit the number of sign-ups per connection; for this an encrypted value (HMAC) of your IP address is kept in the cache of our server for 10 minutes (Art. 6(1)(f) GDPR, our interest in preventing abuse).

Retention. We delete unconfirmed sign-ups after 30 days. After you leave the list, or after we have deleted an entry, we remove the email address after 30 days. We remove confirmed sign-ups 3 months after the launch email of the offer or, if it does not launch, 24 months after your confirmation. After that we keep only the record of the consent, with an encrypted value of the address instead of the address itself, for another 3 years as proof and then delete it.

4.18 App and notifications

You can install Bookfairy as an app on your device and switch on notifications in your account. We then let you know on this device when a result is ready, support answers, or tokens run out or expire. Notifications contain no advertising. Only after your click in the account do we process:

• the address your browser or device issues for notifications and its keys, the device name (for example "Android, Chrome") and the time of the last delivery; a subscription is stored in the browser or on the device for this,
• whether the page runs as an installed app and whether the confirmation message arrived.

The content of each notification is end-to-end encrypted. The push service (section 6) only sees the address, the time and the size of the message.

Gift for app and notifications. If we offer tokens for using the app with notifications on, we check once per account and device whether the conditions are met. For this we store an encrypted value (HMAC) of the address and of your browser ID, plus a daily changing value of the IP address to limit the number of gifts per address and day.

Legal bases. Art. 6(1)(b) GDPR for delivery and the gift, Section 25(2) no. 2 TDDDG for the subscription on your device, because you expressly request the service with your click; Art. 6(1)(f) GDPR for protecting the gift against abuse.

Switching off. You can switch notifications off at any time in the settings or remove a device from the list; when you sign out, we remove the current device from your account. We then delete the subscription data at once, also when the push service no longer knows the subscription. The gift remains unaffected.

4.19 Public details of model books (bestseller analysis)

In some tools (for example "Write a book" and cover) you can name books of your genre as models, by ASIN or a link to the Amazon product page. Bookfairy then reads the public details of those product pages, recognises what readers praise and miss, and builds an original concept or cover for your book from that. The model books only serve as a signal for style and market; we do not take titles, author names, characters, logos or sentences of other books into your result.

This data does not come from the people concerned themselves (Art. 14 GDPR):

• Source: the publicly accessible product pages of the books you name on Amazon. We only retrieve what every visitor sees without signing in.
• Categories of data: title and subtitle, description, name of the author, categories, for covers the cover image, a short excerpt of the preview and the texts of public reviews. We use reviews as text only, without the names, profile links and profile pictures of the reviewers.
• People concerned: authors of the books you name and writers of reviews.
• Purpose: the market analysis for your book that you ordered.
• Legal basis: Art. 6(1)(f) GDPR. It is our legitimate interest and yours as a customer to align the service with the market of your genre. The data is publicly accessible, we read little and store it briefly; the interests of the people concerned therefore do not override.
• Recipients: the AI providers from section 4.9, as far as they evaluate the data; they receive reviews without names.
• Retention: we delete the retrieved raw data (page texts, reviews, preview images) after the analysis. Only the summary made from it, without names of reviewers, stays with your project (section 8).

We do not notify the people concerned individually because that would take disproportionate effort (Art. 14(5)(b) GDPR); this policy is the public information on it. They have their rights under section 9, in particular the right of access and the right to object under Art. 21 GDPR, also against this processing. Send requests to support@getbookfairy.com.

5. Cookies and similar storage

Plausible sets no cookies (section 4.3).

6. Recipients

We use the following service providers. Those listed as processors act on our instructions under a contract pursuant to Art. 28 GDPR. The AI model intermediaries based in Hong Kong and in the USA also act on our behalf, but without such a contract (sections 4.9 and 7). We will tell you the specific recipients on request (Art. 15(1)(c) GDPR).

For market and keyword research, the tools query market data providers (for example DataForSEO and Helium 10). Only search terms, categories or titles are sent, no manuscripts and no information about you.

Data that you yourself send to third parties, for example when uploading your book to Amazon KDP or other directories, is subject to the privacy policy of the respective provider.

7. Transfers to third countries

Some of the recipients named above process data outside the EU or EEA. Except for the AI model intermediaries (section 4.9), transfers take place on one of these bases:

• Adequacy decision of the European Commission of 10 July 2023 on the EU-US Data Privacy Framework, where the recipient is certified under it (Art. 45 GDPR). According to their own information, this applies to Amazon, Cloudflare, Clerk, Google, Microsoft and Stripe.
• Adequacy decision of the European Commission for the United Kingdom, most recently renewed on 19 December 2025 (Art. 45 GDPR). This covers Groq UK Limited, our contractual partner for voice input.
• Standard contractual clauses of the European Commission of 4 June 2021 with supplementary measures such as encryption in transit (Art. 46(2)(c) GDPR), insofar as no adequacy decision applies. Runpod, Inc. is not certified under the EU-US Data Privacy Framework; the basis is the standard contractual clauses of 4 June 2021 (Module 2) in Runpod's data processing agreement. Runpod processes the files in data centres in the EU and deletes them after processing. Groq also processes voice recordings in the USA (Groq LLC, Google Cloud) and is not certified under the EU-US Data Privacy Framework; the basis is the standard contractual clauses of 4 June 2021 (Module 2) in Groq's data processing agreement, under which Groq must put a lawful transfer mechanism in place before passing data on to another country.

You can obtain a copy of the safeguards on request at support@getbookfairy.com.

The push services of the browsers (section 4.18) are chosen by your browser, not by us. Where a service is not certified under the EU-US Data Privacy Framework, the transfer is based on its being necessary for the performance of the contract after you switched on notifications (Art. 49(1)(b) GDPR).

None of these bases exists for transfers to the two AI model intermediaries (section 4.9):

• One intermediary is based in Hong Kong, the other in the USA. There is no adequacy decision of the European Commission for Hong Kong. We could not verify a certification of the intermediary in the USA under the EU-US Data Privacy Framework.
• We have agreed neither standard contractual clauses nor any other appropriate safeguards under Art. 46 GDPR with either of them, and their terms of use contain no contract under Art. 28 GDPR.
• Both may pass the data on to resellers and to the makers of the models in the USA or in other countries outside the EU. We have agreed no safeguards with these parties; we do not know which resellers the intermediary in Hong Kong uses or where they are based.

What this means for you: authorities in these countries may under certain circumstances access the data, under rules that do not match the protection in the EU, and without you having the same legal remedies as in the EU. Your rights are harder to enforce there. The recipients may use the data under their own terms, including to improve their services, and we cannot have the data deleted there.

8. Retention periods

Where a retention obligation applies, we restrict processing until the period ends instead of deleting the data.

9. Your rights

You have the right to:

• access the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless we are required to keep the data,
• restriction of processing (Art. 18 GDPR),
• data portability in a machine-readable format (Art. 20 GDPR),
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing at any time without giving reasons.

Please send requests to support@getbookfairy.com. We will reply within one month.

Complaint. You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

10. Do you have to provide data?

For an account and a purchase we need a confirmed email address and the payment details; without them we cannot conclude a contract. For the tools we need the content you want to have processed. All other information is voluntary. You can decline the statistics and marketing services without any disadvantage.

11. Automated decision-making

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing (Art. 22 GDPR). The results of the AI tools concern your content, not you as a person. Automated checks to prevent abuse only prepare decisions; a person decides on blocking an account. For dynamic QR codes, the check immediately and automatically blocks a single code if one of the public block lists names its target as a phishing, scam or malware site; a person reviews every such block, and you can appeal (section 4.16).

12. Changes

We update this policy when the processing changes, when we add or replace a service provider, or when the law requires it. The current version is always available on this page. If a material change affects a consent, we will ask you again.