Privacy Policy

1. Who We Are

The data controller for the Service is:

Crasome OÜ

• Registry code: 12650861
• Address: Harju maakond, Tallinn, Lasnamäe linnaosa, Pae tn 25-47, 11414
• General: info@crasome.com
• Privacy: privacy@inkcompanion.com

2. Data We Collect

We may collect and process the following categories of personal data:

2.1 Account Data

• Email address
• Password, stored in hashed form (Bcrypt)
• The Terms version accepted for the account and the acceptance time
• Account preferences (text alignment and interface preferences)

We do not collect a display name as part of the account.

Creating an account requires an email address and acceptance of the Terms. While registration is invite-only, a valid invitation code is also required. Without the required registration information, we cannot create an account. Uploading books, using AI features, changing preferences, and sending optional ratings or notes are your choice; those features need the relevant information to work.

2.2 User Content and AI Outputs

Content you provide and results we generate for you include:

• books or files you upload (EPUB, PDF, FB2);
• text excerpts and chapter content processed by the Service;
• prompts and AI chat messages (your conversations with the AI companion);
• generated outputs associated with your account (AI summaries, and the entity/relationship data the X-Ray feature extracts — characters, places, and their relationships);
• your reading position in each book;
• reading session preferences (analysis depth and spoiler handling) and per-book spoiler settings.

User Content and AI Outputs may contain personal data, including information about other people. Please avoid submitting sensitive personal data unless necessary and lawful.

2.3 Technical and Usage Data

• IP address
• Browser type and version
• Device information
• Operating system
• Log data
• Error reports
• Performance and security metrics, including account-linked usage and rate-limit counters;
• Ratings, reports, and optional feedback notes on assistant responses, associated with your account, reading session, and response;
• Website usage analytics from our self-hosted Umami service, including normalized page categories, generic page titles, referrer origins, browser and device details, and selected content-free events, including landing-page registration-link clicks, registration record creation, upload and processing outcomes, reading-session creation, and assistant response outcomes. A registration event doesn't mean email confirmation is complete. We don't send account identifiers, email addresses, book titles or text, search terms, chapter identifiers, or private chat content to analytics.

2.4 Support Data

There is no dedicated in-app support channel. Support requests reach us via the contact addresses in Section 15; any messages you send there are “support data.”

3. Purposes and Legal Bases

We process personal data for the following purposes:

3.1 To Provide the Service

Legal basis: Performance of a contract, GDPR Article 6(1)(b).

This includes:

• creating and managing your account;
• hosting and processing uploaded files;
• providing AI reading insights (discussion, summaries, X-Ray entity tracking);
• saving your reading progress and preferences;
• answering requests related to your account and the Service;
• recording which Terms version you accepted and when.

3.2 To Maintain Security and Prevent Abuse

Legal basis: Legitimate interest, GDPR Article 6(1)(f).

Our legitimate interest is to protect the Service, users, and infrastructure from fraud, illegal content, spam, security incidents, and technical abuse.

For this purpose we maintain rate-limiting and abuse-detection counters (such as request counts and quota states associated with your account), as described in our Terms of Service.

3.3 To Comply with Legal Obligations

Legal basis: Compliance with legal obligations, GDPR Article 6(1)(c).

This includes accounting and legal-request obligations under Estonian law.

3.4 To Improve the Service Using Non-Content Data

Legal basis: Legitimate interest, GDPR Article 6(1)(f).

We use our self-hosted Umami analytics service, served from this website's own domain, to understand page visits and selected product interactions, including landing-page registration clicks, successful registration-record creation, book upload and processing outcomes, reading-session creation, and assistant-response outcomes. Registration creation is measured before email confirmation. The browser sends normalized page categories, generic page titles, referrer origins, browser and device details, and content-free event properties such as CTA placement. We don't send account identifiers, email addresses, book titles or text, search terms, chapter identifiers, or private chat content to analytics. We don't use marketing tracking. We do not use the full text of your uploaded books or your private AI chat messages to train our own AI models.

4. AI Providers and Data Processing

The Service uses third-party AI to generate summaries, character/entity insights, and chat responses.

How it works: The Service routes AI requests through a model-routing proxy to one or more third-party AI providers. Providers may change with the Service's model configuration; contact privacy@inkcompanion.com to ask which providers process your data.

When you use AI features, relevant text excerpts and prompts may be transmitted to these providers (through the proxy).

4.1 Model Training

We do not use your books or private chats to train our own AI models. A provider's use of inputs and outputs is governed by its applicable terms and configuration; we cannot make a blanket no-training promise on behalf of every provider. Contact privacy@inkcompanion.com for the current providers and their applicable terms.

4.2 Retention by AI Providers

Our workflow logs and traces use a 60-day retention window, as described in Section 7.3. This window applies to our workflow records, not copies held by AI providers. Third-party providers retain inputs and outputs according to their applicable policies, terms, and service configurations. Their deletion practices may differ from ours and may not be affected by deletion in InkCompanion. Contact privacy@inkcompanion.com for information about provider-held data or an erasure request.

4.3 Data Minimization

To reduce the amount of data transmitted to AI providers, we apply the following technical measures:

• We send only relevant text excerpts (chapters/chunks) to the AI, not entire books where avoidable;
• We do not include your email address or account identifier in AI prompts;
• We limit personal data sent to AI providers to what is needed for the requested feature where possible.

Please do not include unnecessary personal data, special category data, or confidential information in prompts or uploaded content if not required.

5. Data Sharing

We do not sell your personal data.

We may share personal data with:

• cloud hosting providers;
• database providers;
• AI routing and inference providers (as described in Section 4);
• email delivery providers (for transactional email such as account confirmation);
• professional advisors, where necessary;
• authorities, where required by law.

We share data only as needed to provide and secure the Service, handle support or legal requests, obtain professional advice, or comply with applicable law.

6. International Transfers

Service providers may process personal data outside the European Economic Area, including in the United States. Processing locations and transfer arrangements depend on the providers and service configuration in use. We handle such transfers under applicable data-protection requirements, using transfer mechanisms and safeguards where required. Contact privacy@inkcompanion.com for information about current arrangements.

7. Data Retention

Retention depends on the type of data, its purpose, operational and security needs, legal requirements, and dispute resolution. Information removed from active Service records may remain in backups, logs, workflow traces, browser caches, or provider systems and may follow separate cleanup schedules.

7.1 User-Initiated Deletion

You can delete a book or reading session in the Service. Deleting a book starts removal of its associated sessions, active records, uploaded file, and processing workspace; deleting a session starts removal of its active record and associated workspace. You can also delete your account from Settings. Account deletion removes the active account and starts cleanup of associated Service data. If you cannot access your account, contact privacy@inkcompanion.com. The Terms version and acceptance time may be retained where required by law. Copies in backups, logs, workflow traces, browser caches, or third-party systems may follow separate cleanup schedules.

7.2 Backups

Database backup sets are subject to a rolling 30-day cleanup process. Deleting data from the active Service may not immediately remove copies held in those backups.

7.3 Other Records

Workflow logs and traces, which can contain excerpts, prompts, and AI outputs, use a 60-day retention window with daily cleanup. Finished workflow records become eligible for cleanup 60 days after their recorded finish time; inactive workflow records without a finish entry become eligible 60 days after their last workflow-log entry. Trace files become eligible 60 days after their last modification. Running workflows and their on-disk trace files are protected from age-based cleanup.

Security logs, support messages, and records needed to comply with law or defend legal claims are separate from workflow records. Their retention depends on resolving the relevant incident or request, applicable legal requirements, and limitation periods for legal claims. The 60-day workflow window does not apply to active account content, database backups, browser caches, or provider-held copies.

7.4 Third-Party AI Providers

AI providers may retain transmitted data under their own policies. For questions about provider-held data or an erasure request, contact privacy@inkcompanion.com; we will assess what action is possible and required under applicable law.

8. Security

We implement commercially reasonable technical and organizational measures to protect personal data, including:

• access controls;
• encrypted connections (TLS/HTTPS);
• hashed passwords (Bcrypt);
• limited internal access;
• monitoring for security incidents.

However, no internet-based service can guarantee absolute security.

9. Your Rights

Depending on applicable law, you may have the following rights:

• Right to access (Article 15 GDPR): Request a copy of the personal data we hold about you.
• Right to rectification (Article 16 GDPR): Correct inaccurate data.
• Right to erasure (Article 17 GDPR): Request deletion of your account and uploaded files.
• Right to restrict processing (Article 18 GDPR): Request limitation of processing in certain circumstances.
• Right to data portability (Article 20 GDPR): Receive your personal data in a structured, machine-readable format.
• Right to object (Article 21 GDPR): Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
• Right to lodge a complaint: With your local supervisory authority or the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

To exercise your rights, contact privacy@inkcompanion.com.

We may need to verify your identity before responding. We will respond within the timeframe required by applicable law, generally one month, which may be extended by up to two further months for complex or numerous requests.

10. Sensitive Data Warning

Please do not upload or submit special category personal data unless strictly necessary and lawful. Special category data may include information revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or sexual orientation.

If you include such data in content you submit, we may process it along with that content, and relevant excerpts may be sent to AI providers when you use AI features, as described in Section 4. Contact privacy@inkcompanion.com to exercise your rights or ask about content you have submitted.

11. Children

The Service is for people aged 16 or older. Users under 18 must have parental or guardian consent as stated in our Terms. If you believe a child under 16 has created an account, contact privacy@inkcompanion.com so we can investigate.

12. Cookies and Similar Technologies

We use:

• a session cookie to keep you signed in;
• a “remember me” cookie to keep you signed in across sessions (if you choose);
• reader-settings and theme cookies to apply display preferences. These cookies are sent with applicable requests;
• localStorage for selected interface settings;
• a Service Worker cache that may store chapter pages and related images in your browser for offline reading. Cached copies may remain until application cleanup or browser storage eviction. Deleting account data from the Service may not immediately clear browser caches; you can manage site data in your browser settings.

Analytics is described in Sections 2.3 and 3.4. We do not use marketing tracking. Browser settings can control cookies and other storage; disabling them may affect sign-in, display preferences, or offline reading.

13. AI Feature Disclosure

The Service uses AI to produce reading insights and chat responses. The discussion interface identifies the reading assistant as AI. AI-generated results can be inaccurate and should be checked against the source book.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the Service or by email, where appropriate.

Your use of the Service is also governed by our Terms of Service.

15. Contact

For privacy questions or requests, contact:

Crasome OÜ

• General: info@crasome.com
• Privacy: privacy@inkcompanion.com
• Address: Harju maakond, Tallinn, Lasnamäe linnaosa, Pae tn 25-47, 11414
• Registry code: 12650861