Privacy & Security Policy

Edit faster. Publish better.

Available in: English Dutch

🔒Privacy in Short

  • Your data stays yours. Delete manuscripts anytime; they leave the active environment immediately and backups within 30 days.
  • No AI training. Your manuscripts are never used to train models.
  • Stored in Europe. Primary storage is in EEA data centres.
  • Processing choice. AI processing is Global by default (US under GDPR safeguards) with an optional EU-Only mode.
  • Your rights protected. View, download, correct, or delete data anytime.
  • Questions? Email [email protected].

Privacy Policy – EditBook.ai (Emendara)
Last updated: 1 January 2026
Company name: EditBook.ai (Emendara)
Registered office: Ede, the Netherlands
KvK number: 99114720
VAT: NL868805750B01
Governing law: GDPR & Dutch privacy legislation

1. Introduction

Your privacy matters to us. This Privacy Policy explains how EditBook.ai (Emendara) collects, uses, stores, and protects personal data and uploaded manuscripts when you use our services.

We comply with the General Data Protection Regulation (GDPR) and Dutch privacy laws. By using our services, you agree to this Privacy Policy.

2. What data we collect

We only collect data necessary to provide and secure the Service.

a) Manuscript & project data

  • Manuscripts or other files (e.g., DOCX, PDF, TXT) uploaded for analysis, editing, translation, generation, or related AI tasks.
  • Project metadata such as project name, description, reference ID, and configuration settings.
  • Version history and results generated by the Service.

b) Account & contact information

  • Name and email address used to create an account.
  • Optional author or collaborator contact details you provide.
  • Billing and payment data processed by Stripe Payments Europe Ltd.

c) Technical & operational data

  • IP address, browser, and device information captured for security and error logging.
  • Operational logs required for reliability, security monitoring, and audit trails.
  • Authentication/session tokens for secure login (two-factor authentication is available).

We do not intentionally collect special categories of personal data (such as health or biometric information).

3. Why we process your data

We process personal data to:

  • Deliver the Service (analysis, editing, translation, and generation tasks).
  • Manage accounts, billing, and payments.
  • Communicate and provide support when requested.
  • Comply with legal and tax obligations.
  • Detect misuse, protect the platform, and ensure security.

We do not use your manuscripts or personal data for advertising, profiling, or training AI models.

Legal bases for processing

  • To perform our contract with you (Art. 6(1)(b) GDPR).
  • To comply with a legal obligation (Art. 6(1)(c) GDPR).
  • Based on our legitimate interest in maintaining a secure and reliable service (Art. 6(1)(f) GDPR).

4. How we protect your data

  • Encryption: all transfers use TLS 1.2+; data at rest uses strong encryption (AES-256 or equivalent).
  • Storage: Primary storage of manuscripts and user files is performed exclusively within data centres located in the European Economic Area (EEA).
  • AI Processing: By default, AI processing involves sending text data to global providers (primarily US). Users may configure projects to "EU-Only Mode," in which case data will not leave the EEA for AI processing.
  • Network: Network and security routing is handled by Cloudflare, which operates a global infrastructure under a GDPR-compliant Data Processing Addendum.
  • Access control: Manuscript access is limited to authenticated users in your account.
  • User-controlled deletion: Delete manuscripts anytime. Active copies are removed immediately; backups are destroyed within 30 days.

5. Data sharing & subprocessors

We do not sell or rent manuscripts or personal data, and we never share them for advertising or profiling. We share data only with trusted subprocessors strictly to deliver the Service:

  • Cloud infrastructure & Storage: Google Cloud (EEA data centres)
  • AI Model Providers: OpenAI, Google Vertex AI, or similar. Processing occurs in the US (Global default) or EEA (EU-Only mode).
  • Network and security: Cloudflare, Inc. (Global)
  • Payments: Stripe Payments Europe Ltd.
  • Email delivery: Zoho ZeptoMail

All subprocessors operate under approved GDPR safeguards, such as the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs).

6. Data retention

  • Manuscripts & generated content: retained until you delete them. Deleted data are removed immediately from the active environment and destroyed from backups within 30 days.
  • Account data: retained while your account is active and for a reasonable period thereafter if required for legal or audit purposes.
  • Billing records: retained for up to 7 years (Dutch tax law).
  • Operational logs: retained for a limited period consistent with security and compliance needs.

Projects and manuscripts are never deleted automatically, unless the account is terminated due to long-term inactivity (see Terms & Conditions).

7. Your GDPR rights

  • Access, rectify, delete, port, or restrict processing of your personal data.
  • Delete manuscripts directly in the platform or email [email protected] for assistance.
  • We respond within 30 days. You may also lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

8. Cookies, Analytics & Consent

  • Essential Cookies: We use necessary cookies for secure login, CSRF protection, and language preferences. These do not require consent.
  • Analytics (Optional): With your consent, we use analytical cookies to understand website usage and improve performance. These are only placed if you accept them via our Cookie Banner.
  • Management: You can withdraw or change your consent at any time via the "Cookie Settings" link on our website.
  • No Third-Party Tracking: We do not use marketing or advertising pixels that track you across other websites.

9. International transfers

While primary storage is in the EEA, the use of AI services (by default) involves transferring data to the United States. These transfers are legal under the GDPR because our providers (e.g., Google, OpenAI) are certified under the EU-US Data Privacy Framework (DPF), which ensures an adequate level of protection. Where the DPF does not apply, we rely on Standard Contractual Clauses (SCCs). Users who wish to avoid international transfers may select "EU-Only Mode" in their project settings.

10. Changes to this Policy

We may update this Policy to reflect changes in law or service. Material updates will be announced on our website or by email. The latest version is always available at www.editbook.ai/privacy.

11. Contact

📧 [email protected]
📍 EditBook.ai (Emendara), Ede, the Netherlands

Short FAQ

  • Do you auto-delete manuscripts? No. You control deletion. Removing a manuscript deletes it from the active environment immediately and from backups within 30 days.
  • Do you train AI on my content? No. We never use your manuscripts for model training.
  • Where is my data stored? Primary storage is within secure EEA data centres. AI processing may occur in the US unless you select EU-Only mode.
  • Can I download or delete my data? Yes—any time. Manage this in the platform or email [email protected].

Last updated: 1 January 2026