Privacy Policy

Infinite Library helps you create, read, listen to, publish, and sell books with the help of AI. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights and controls you have. We design the Services to collect what we need to deliver them well, and we do not sell your personal data. Because our Services rely on trusted providers (for AI, voice, payments, print, hosting, email, and analytics), this policy is specific about who they are and what they receive.

• "Personal data" means information relating to an identified or identifiable individual.
• "Processing" means any operation performed on personal data (such as collecting, using, storing, sharing, or deleting it).
• "Services" means our websites, applications, and features operated by Infinite Library.
• "Provider" or "sub‑processor" means a third party that processes personal data on our behalf or to power a feature.

Infinite Library, a French société par actions simplifiée (SAS), is the controller of personal data processed through the Services. Our registered office and company details are in our Legal Notice. You can contact us about privacy at any time at hello@infinitelibrary.ai. When you publish content under your own identity, you may also act as a controller of any personal data you choose to include — please only include personal data you are entitled to use.

We collect information you provide, information generated as you use the Services, and information from the providers we work with:

• Account & identity: name, email address, profile photo, and the sign‑in method you use (Google or passwordless email). We do not store passwords.
• Profile & author data: display name, handle, bio, links, preferences, and — if you sell — author and payout details.
• Content you provide: prompts, instructions, uploaded files and documents, notes, messages, highlights, and reviews used to create and improve your books.
• Voice data: if you use Voice Studio, the voice sample you record or upload and the resulting voiceprint — this is biometric data (see Section 7).
• Books & activity: the books you generate, read, save, publish, or buy; reading progress; ratings and reviews; and the social graph (who you follow).
• Transactions & payouts: purchases, Word Credits, order and shipping details, author earnings, and identifiers from our payment provider (we do not store full card numbers).
• Communications & email engagement: messages you send us, your email preferences, and whether marketing emails were delivered, opened, or clicked.
• Device & usage data: pages and features used, approximate location derived from IP address, device and browser type, timestamps, diagnostic logs, and — for guests — a privacy‑preserving device signal used to limit abuse of free credits.
• Cookies & similar technologies: limited cookies and identifiers for essential functionality, preferences, analytics, and advertising measurement (see Section 9).
• Business‑visitor identification: if you visit on behalf of a company, business‑contact details (name, work email, job title, employer, and LinkedIn profile) and the pages you viewed, obtained from a third‑party B2B identity‑resolution provider (see Section 24).

Please do not submit sensitive or special‑category data (such as health, political, or biometric data about others) except the voice data you knowingly provide for Voice Studio. If you voluntarily include sensitive data in prompts or uploads, you ask us to process it to deliver the feature you requested.

• Contract: to provide the Services and features you request, process payments, and support you.
• Legitimate interests: to secure and improve the Services, prevent fraud and abuse, measure performance, and communicate about your account — balanced against your rights.
• Consent: where required — for example, non-essential analytics and advertising cookies and conversion measurement, marketing emails, and the processing of voiceprint biometric data — which you may withdraw at any time.
• Legal obligation: to comply with law, tax and accounting rules, and lawful requests.

We use personal data to:

• Provide, maintain, and improve the Services, including generating, narrating, translating, publishing, and printing your books.
• Personalize your experience, including recommendations and "For You" reading.
• Process purchases, Word Credits, marketplace sales, and author payouts, and prevent payment fraud.
• Operate community and marketplace features, including public profiles, ratings, following, and notifications.
• Communicate with you about your account, transactions, and — where permitted — product updates and offers.
• Understand how features perform and measure marketing, using analytics and conversion measurement.
• Keep the Services safe: detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms, and comply with law.

We do not use your prompts, uploaded files, voice, or generated books to train our own or third parties' foundation models.

To generate and assist with your books, we transmit your prompts, instructions, and any files you upload to AI providers in the United States. Text generation is performed primarily by OpenAI, with Anthropic used for certain suggestions (such as titles and ideas). Page translation is performed by DeepL. These providers process your content to return results to you.

Under the terms on which we use these providers, your content submitted through their APIs is not used to train their models. Because we use a stored-response mode to power generation and let you retrieve and continue your work, your prompts and generated outputs are stored at the AI provider (OpenAI) for retrieval until deleted, separately from the limited, transient retention providers apply for abuse monitoring. In our own database we store references and metadata (such as response identifiers and a short prompt preview) rather than your full prompts and generated text. You can ask us to delete this content as described in Sections 16 and 17, and we will delete the stored content we control.

Transfers to the United States are protected by appropriate safeguards, such as the EU‑U.S. Data Privacy Framework and/or Standard Contractual Clauses. See Section 13.

If you use Voice Studio to clone a voice, the voice sample you record or upload and the resulting voiceprint are biometric data. We process them only to create the voice clone and to generate audio narration for your books, based on your explicit consent. Voice cloning is performed by our voice provider, ElevenLabs (United States), to which we send your voice sample and the text to be narrated.

You may only clone your own voice, or a voice you are explicitly authorized to clone. We and our voice provider do not use your voice data to train voice models on the terms we operate under. We store a reference to your voiceprint (a voice identifier) and may cache generated audio to deliver the feature.

You can delete a voice or withdraw your consent at any time in Voice Studio or by emailing hello@infinitelibrary.ai. On your request, or when you delete your account, we delete the voiceprint reference and any audio cached from it from our systems and instruct our voice provider to delete the underlying voiceprint. Creating a voice clone serves as your written release authorizing this processing for the stated purpose. We keep voice biometric data only as long as needed to provide the feature, and in any event delete it when you delete the voice or your account and no later than three (3) years after your last interaction with the feature.

We send two kinds of email. Transactional and service emails (such as sign-in codes, receipts, order and shipping updates, payout notices, and notifications when an author you follow publishes) are sent to operate your account and the features you use, and are delivered through our email providers, SendGrid and the Firebase "Trigger Email" service. Follower notifications are on by default and can be turned off at any time in your email preferences. Marketing and lifecycle emails (such as welcome, onboarding, tips, re-engagement, and offers) are sent where permitted and are delivered through SendGrid.

For email we send, our provider may record whether a message was delivered, opened, or clicked, tied to an identifier, so we can measure and improve our communications and run subject-line tests. We honor your choices: every marketing email includes an unsubscribe link and one-click unsubscribe, and you can manage granular preferences in your email-preferences center or by emailing us. If you subscribe to our newsletter, we record your subscription together with limited technical signals (such as your IP address, approximate location, and a device/browser signal) to confirm the subscription and prevent abuse.

We use essential cookies for authentication, security, and core functionality, and limited cookies and similar technologies for preferences, analytics, and advertising measurement. We present a cookie notice and, where required by law, controls to accept or decline non-essential cookies, and you can also manage cookies through your browser settings. We are enhancing these controls so that, where the law requires it, non-essential analytics and advertising cookies load only after you consent.

We use privacy‑respecting product analytics, including Vercel Analytics and Vercel Speed Insights, and Google Analytics (GA4) / Firebase Analytics, to understand feature adoption and performance. We also use Google Ads conversion measurement to understand which marketing drives sign‑ups and purchases. Referral and affiliate attribution is handled entirely first‑party: a first‑party cookie set by our own site records which partner referred you, and no affiliate network or third‑party tracker receives your data.

We do not sell your personal data, and we do not use it for cross-context behavioral advertising in a way that requires it. To the extent advertising-measurement or analytics technologies are treated as a "sale" or "sharing" under certain U.S. state laws, you can opt out by contacting us or using available browser and cookie controls; we are working to recognize Global Privacy Control (GPC) signals automatically.

Some information is public by design. If you create an author profile or publish a book, your profile (name, handle, bio, photo, and links), your published books and their metadata, and your ratings and reviews are visible to anyone, may be indexed by search engines, recommended to readers, and cached by third parties. Follower and rating counts may be shown. Please share only what you are comfortable making public. You can unpublish a book or edit your profile, but content already distributed, sold, printed, indexed, or cached may persist. You can also keep your author page and books out of search engines entirely — without unpublishing anything — with Settings → Privacy → "Show me in search engines"; turning it off notifies search engines immediately, and existing results usually clear within days.

Payments are processed by Stripe. We do not store full card details; Stripe handles them directly under its own privacy policy. If you sell and receive payouts, we use Stripe Connect, and Stripe collects the identity, banking, and tax information needed to pay you and meet legal requirements; that information is held by Stripe as a payment institution.

If you order a paperback, we transmit your name, shipping address, phone number, and email, together with your book's print files and metadata, to our print provider, Lulu Press, Inc. (United States), solely to manufacture and ship your order. Carriers receive the information needed for delivery. These providers retain transaction and fulfillment records as required for their own legal and accounting obligations.

We do not sell your personal data. We share it only with providers that process it on our behalf to deliver the Services, with authorities where required by law, in connection with a merger or sale of assets (with notice), and with others at your direction or with your consent. Our main providers are:

• Hosting & infrastructure: Vercel (application hosting, file/blob storage, analytics) and Google Cloud / Firebase (database, authentication, storage, and email delivery).
• AI & translation: OpenAI and Anthropic (text generation) and DeepL (translation); files you upload for generation are stored with our AI provider (OpenAI) to power the feature.
• Voice & audio: ElevenLabs (voice cloning and narration) and OpenAI (standard narration).
• Payments & payouts: Stripe and Stripe Connect.
• Print-on-demand: Lulu Press, Inc.
• Email: SendGrid (Twilio) and Firebase Trigger Email.
• Analytics & advertising: Google Analytics (GA4) / Firebase Analytics, Google Ads, Google Search Console, and Vercel Analytics (affiliate/referral attribution is first‑party — no external provider).
• Security & operations: Upstash (rate limiting and abuse prevention, which processes IP-derived identifiers), and YouTube (only when you embed or fetch a book trailer).
• B2B identity resolution: RB2B (identifies the business contact behind an anonymous business visit so we can follow up about business and enterprise services — see Section 24).

This list may change as we improve the Services; we keep it current and will tell you on request which providers process your data.

When you visit as a representative of a business, we may use a third‑party identity‑resolution provider (currently RB2B) to identify the organization and, where available, the business contact behind your visit — such as your name, work email, job title, employer, and LinkedIn profile — together with the pages you viewed. We use this to gauge interest in our products and to follow up about our business and enterprise offerings (for example, White Glove).

This business‑contact information comes from the provider's business database rather than directly from you. Where applicable, our legal basis is our legitimate interest in business development (Article 6(1)(f) GDPR); we limit this to business contacts, do not use it for consumer profiling, and do not sell it.

Don't want to be identified this way? Email hello@infinitelibrary.ai and we will remove your business contact and exclude you from future identification.

We and our providers may store and process your data in countries other than where you live, including the United States and the European Union. Where we transfer personal data internationally, we rely on appropriate safeguards — such as the EU‑U.S. Data Privacy Framework and/or Standard Contractual Clauses — to protect it. You can contact us for more information about these safeguards.

We keep personal data only as long as needed for the purposes in this policy, to provide the Services, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Retention varies by data type — for example, transaction and payout records are kept for the periods required by law, while voice biometric data is deleted when you delete the voice or your account.

When you delete your account, it locks immediately: your books and author page stop being publicly visible right away, and we notify search engines that those pages are gone (their results can take some days to refresh). After a 14-day safety window — during which one click on the link we email you restores everything — we permanently erase your books, audiobooks, profile, reading history, and personal data; any cloned voice is deleted immediately when deletion is requested (including instructing our voice provider to delete the voiceprint). What remains afterwards: anonymized sales records where tax law requires the amounts (never your name or email), a one-way hashed reference that prevents sign-up-credit abuse, and records our payment, payout, and print providers must keep under their own legal duties. Books other people purchased stay available to those buyers, with your name and email removed. You can start deletion yourself in Settings → Delete account; if you can't sign in or no longer control the account's email address, write to hello@infinitelibrary.ai from any address and we'll verify your identity another way.

We use reasonable technical and organizational measures to protect personal data, and our infrastructure providers encrypt data in transit and at rest. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal data, we will investigate and, where required by law, notify you and the relevant authorities without undue delay, describing the steps taken to mitigate harm.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data and complete incomplete data.
• Delete your data, subject to legal and operational limits described above.
• Port your data — receive it in a structured, commonly used format.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent (such as marketing or voice biometrics).
• Opt out of any "sale" or "sharing" and of targeted advertising, including via Global Privacy Control.

We do not sell or "share" your personal data for cross‑context behavioral advertising as those terms are defined by applicable U.S. state laws, and we will not discriminate against you for exercising your rights.

To exercise your rights, email hello@infinitelibrary.ai with the subject "Privacy Request" and include the email address associated with your account. We may need to verify your identity before acting, and you may use an authorized agent where the law allows. We respond within the timeframes required by law. If you are in the EEA/UK/Switzerland, you also have the right to lodge a complaint with your local data‑protection authority; in France, that is the CNIL.

The Services are not directed to children under 13, and we do not knowingly collect personal data from children under 13 (or under the higher age of digital consent where applicable). We rely on the age representations users make and do not otherwise verify age. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

• EEA/UK/Switzerland: You have rights under the GDPR/UK GDPR, including access, rectification, erasure, restriction, objection, portability, and the right to complain to a supervisory authority. Our legal bases are in Section 4.
• California & other U.S. states: Depending on your state, you may have rights to know, access, correct, delete, and opt out of sale/sharing and certain profiling, plus a right against discrimination. We treat voice/biometric data and account credentials as "sensitive personal information" and use it only to provide the features you request. We do not sell personal information as defined by the CCPA/CPRA.
• Illinois (BIPA): If you are an Illinois resident and use voice cloning, we collect and store a voiceprint, which is biometric data. We obtain your consent before collection, never sell or profit from biometric data, use it only to provide the narration features you request, and delete it when you delete the voice or your account and no later than three (3) years after your last interaction with the feature, consistent with our biometric retention schedule in Section 7.
• Quebec: You have rights of access, correction, and de-indexing, and we provide information about automated processing on request.

Bindery (bindery.infinitelibrary.ai) is our affiliated companion product, governed by its own privacy policy. When you send a book from Infinite Library to Bindery, we share what is needed for the handoff — such as a temporary link to your manuscript and its metadata — and you may use the same sign‑in identity. Limited account, book, and earnings information may be shared between the two services to operate them together. Your use of Bindery and the data it collects are subject to Bindery's own privacy policy.

Some browsers send "Do Not Track" (DNT) signals. Because there is no common standard for DNT, we do not respond to DNT signals. Where required by law, you can opt out of any "sale" or "sharing" of personal data by contacting us at hello@infinitelibrary.ai or using available browser and cookie controls, and we are working to recognize Global Privacy Control (GPC) and similar opt-out preference signals automatically.

We may update this policy from time to time. We will post the updated policy on this page and update the "Last updated" date, and where changes are material we will take reasonable steps to notify you. Your continued use of the Services after the changes take effect means you accept the updated policy.

For any question about this policy or your personal data, contact us at hello@infinitelibrary.ai. Postal and company details are in our Legal Notice.