Privacy Policy

We collect only what we need to deliver the service:

• Account information — your email address and display name when you sign up (directly or via Google OAuth).
• Manuscript text — the content you upload for AI analysis. This is processed to generate your listing metadata and is stored temporarily according to your retention settings.
• Listing data — the titles, subtitles, keywords, descriptions, categories, and other metadata generated through the wizard.
• Payment information — handled entirely by Stripe. We never see or store your full card number. We receive only a confirmation of your plan and subscription status.
• Usage data — which features you use, credit consumption, and basic analytics (page views, session duration) to improve the product. We do not track you across other websites.

• AI processing — your manuscript text is sent to the Anthropic Claude API to generate listing suggestions. The text is used solely for this purpose during your active session.
• Not used for AI training — your manuscript and listing data are never used to train, fine-tune, or improve any AI model. Anthropic's API terms explicitly prohibit using API inputs for model training.
• Service delivery — to operate your account, process payments, deliver email notifications (generation complete, account changes), and provide customer support.
• Product improvement — aggregated, anonymized usage patterns help us understand which features are most useful. We never analyze your actual manuscript content for this purpose.

• Your data is stored in Supabase (PostgreSQL database) hosted in the EU region (eu-west-1).
• All data is encrypted at rest and encrypted in transit (TLS 1.2+).
• Database access is protected by Row Level Security (RLS) — you can only access your own data. Even our application code cannot read another user's listings.
• Authentication tokens are stored as secure, HTTP-only cookies.

We keep your data only as long as necessary:

• Manuscript text — deleted automatically based on your retention settings (configurable in Settings). The default retention period can be adjusted per your preference.
• Generation logs — automatically deleted after 180 days. These contain metadata about API calls (timing, token counts) but not your actual content.
• Errored analyses — automatically cleaned up after 30 days.
• Account deletion — when you delete your account, we remove everything: your profile, all listings, all manuscript data, generation history, and cancel any active Stripe subscription. This is permanent and irreversible.

We use a small number of trusted third-party services, each for a specific purpose:

We do not sell, rent, or share your personal data with any other third parties. We do not use advertising networks or data brokers.

We use minimal cookies:

• Authentication session cookie — required to keep you logged in. This is a secure, HTTP-only cookie that cannot be read by JavaScript.
• Analytics — if enabled, we use basic, privacy-respecting analytics. No cross-site tracking. No advertising cookies. No fingerprinting.

We do not use third-party tracking cookies, social media pixels, or retargeting scripts.

As our data is stored in the EU, you have the following rights under the General Data Protection Regulation:

• Access — request a copy of all personal data we hold about you.
• Rectification — correct any inaccurate data in your profile or listings.
• Erasure — request deletion of your account and all associated data. You can also do this yourself from the Profile page ("Delete Account").
• Data portability — export your listing data in standard formats (DOCX, CSV) at any time via the Export step.
• Objection — object to processing of your data for any purpose.
• Withdraw consent — you can withdraw consent for optional processing (like analytics) at any time via Settings.

To exercise any of these rights, email us at support@kdplistinggenerator.com. We will respond within 30 days.

KDP Listing Generator is not designed for or directed at anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it promptly.

If we make meaningful changes to this privacy policy, we will notify you via the email address associated with your account before the changes take effect. We will also update the "Last updated" date at the top of this page.

If you have any questions about this privacy policy or how we handle your data: