Privacy notice

What we collect, why, and what we never do with it.

bookmatic is operated by Konsensus LLC, registry 86585140624059, c/o Próspera Employment Solutions LLC, Beta Building, Oficina 6, Próspera ZEDE, St. John’s Bay, Islas de la Bahía 34101, Honduras — the data controller for everything described here. For anything in this notice, write to hello@konsensus.net.

What we collect

• Your account — email address, a password we store only as a hash, and, if you switch on two-factor sign-in, its authenticator secret and recovery codes.
• Your books — the manuscripts, images, covers and translations you upload or create. They are yours; we store them to run the product, nothing else.
• Collaboration — comments, margin notes, chat messages, reactions and reading progress from you and the readers you invite.
• Purchases — when a reader buys a book we keep the sale record and the buyer's email address, which we use to deliver the book and its download links.
• Reports — bug reports sent from inside the app (which can include a small capture of the flagged element), feedback, and abuse reports about public pages.
• Waitlist — if you ask to be told when the next cohort opens, your email address and a name if you give one. Nothing else, and only because you asked.

Cookies

We set functional cookies only: your sign-in session and which book you have open. No advertising cookies, no third-party trackers.

Payments

Card payments are processed by a payment provider, which is named on the checkout page before you pay. Your card details go to that provider and never reach our servers, and that provider’s own privacy policy — linked from its checkout — applies to the payment itself. Card is the only payment method offered on bookmatic.

IP addresses

We use IP addresses only to rate-limit abuse: they live in daily counters that are deleted automatically within 90 days, and anything kept longer — such as an abuse report — records a one-way hash, never the address itself.

Email

We send transactional email only — sign-in and account messages, purchase deliveries, and notices about your books. No marketing email without your explicit consent. The one exception is the single email telling you the next cohort has opened, and only if you asked for it on the waitlist.

Who else processes it

We do not sell, rent, or share your data with advertisers — no exceptions. We do use a small set of processors to run the product, and nothing goes further than this list:

• Cloudflare — hosting, and the database that holds everything.
• Anthropic and Google — the AI models behind translation and the revision memo. When you run one of those features, the text you asked us to process is sent to the model provider to produce the result. It is not used to train their models.
• OpenAI — cover-art generation, when you use it: your art brief is sent, your manuscript is not.
• sats4ai — cover artwork and audiobook narration, when you use them. For artwork, only your art brief is sent. For narration your book itself is sent, as the ebook file we build, because that is what is read aloud. It is processed to produce your audio and is not used to train anything. The voices are a fixed menu of licensed synthetic voices — you cannot submit a recording of anyone. Narration only ever runs when you start it.
• Our payment provider — card payments; named on the checkout page.
• Resend — the transactional email we send you.

Features that use a model provider are marked in the app, and they only run when you start them. If you never run them, your manuscript never leaves Cloudflare. Narration is the one feature that sends your whole book rather than a selection — it is labelled where you start it, and it is never automatic.

Why we are allowed to hold it (legal basis)

Where the GDPR or a law like it applies to you, these are the grounds we rely on:

• Performing our contract with you — your account, your books, and every feature you press. Without this data there is no service to give you.
• Our legitimate interests — keeping the platform up and free of abuse: rate-limiting, fraud prevention, bug reports, and security logs. Our interest is running a service that works and is not overrun; we hold the least we can and delete on the schedule below.
• Your consent — where we ask for it plainly, such as optional email you can switch off at any time. You can withdraw consent whenever you like, and withdrawing it does not undo what was lawful before.
• A legal obligation — where we are required to keep or hand over records.

Where your data goes

bookmatic runs on Cloudflare's global network, and the AI companies named above are based in the United States. So your data does leave the UK and the European Economic Area. Where a transfer is covered by the GDPR, it is made under the Standard Contractual Clauses approved by the European Commission, or under an adequacy decision where one applies to the country in question. Konsensus LLC is established in Honduras (Próspera ZEDE); we accept the same obligations toward EU and UK users as if we were established there.

How we protect it

We use technical and organizational measures appropriate to the risk. In practice: everything travels over HTTPS and is encrypted in transit; passwords are stored only as hashes, never as passwords; optional two-factor authentication is available on every account; payout details are encrypted at rest; access to production data is limited to the people who need it; IP addresses live only in short-lived rate-limit counters and are hashed on abuse reports. No system is perfectly secure, and we do not claim otherwise — but if a breach ever puts your rights at risk we will tell you and the relevant authority without undue delay.

How long we keep it

• Anonymous trial books (uploaded without an account) are deleted automatically after 30 days, with their notes and images.
• Books that belong to an account stay until you delete them or ask us to.
• In-app bug reports are deleted automatically after 90 days.
• Abuse reports are kept so repeat notices show a pattern — see the content & takedown policy.
• Waitlist entries are deleted automatically after 12 months, or as soon as you ask — whichever comes first.

Your rights

Email us to access, correct, export, or delete your data — we honor these requests for everyone, not only where a statute compels it. Deleting your account removes your books, your profile, and your collaboration data.

Where the GDPR or a similar law applies to you, those rights are: access, rectification, erasure, restriction of processing, portability, objection to processing based on our legitimate interests, and withdrawal of consent where consent is what we relied on. Write to hello@konsensus.net and we will answer within one month, which we may extend where the law allows and will tell you if we do.

If you think we have got it wrong, you can complain to a regulator. In the EU that is the data protection authority of the country you live or work in; in the UK it is the Information Commissioner's Office (ico.org.uk). You do not have to come to us first — though we would rather you did, so we can fix it.

Changes

Any change to this notice lands on this page with a fresh revision date below.

bookmatic · Terms · Refund policy · Content & takedown policy · Contact · version 1.6, last revised 2 August 2026