Privacy Policy

1. Controller

Alexander Pauls
Walnussweg 4
32339 Espelkamp
Germany
E-mail: kontakt@book-drop.de
Contact form: https://book-drop.de/kontakt

A data protection officer is not required to be appointed by law.

2. Server Log Files

When the website is accessed, the hosting provider Vercel automatically processes technically necessary data in server log files (IP address, date and time of the request, requested URL, referrer, user agent). The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in ensuring stable operation and in defending against attacks. Storage period: usually 30 days.

3. Abuse Prevention

To detect and prevent abusive use, for example through automated bulk requests or excessive repeated use of free preview features, we store a cryptographic hash value of the IP address and, where provided, a hash value of the e-mail address on our servers when certain free analysis and preview features are used. The hash values are generated with a secret component, so that reconstructing the original IP address or e-mail address is practically impossible. No cookies are set and no information is stored on your device in this process. The hash values are automatically deleted after 7 days at the latest. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring fair access to free services and in defending against attacks and attempted fraud.

4. Data Processed and Purposes

When you order the A+ Generator, we process the following personal data:

E-mail address, the cover image uploaded by the customer, the book title, the product description entered and, if the optional interior showcase feature is selected, the book interior uploaded as a PDF and an optional note about the interior design. The purpose of the processing is the performance of the contractually owed service and the delivery of the results by e-mail. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

When the interior showcase is enabled, the PDF is automatically rasterised and visually analysed by AI models to select three especially suitable pages and use them as references for a collage in banner 2. The source PDF and the page rasters created from it are not included in the delivery ZIP.

As part of the payment process, payment data is processed exclusively by the payment service provider Stripe. We do not store complete payment instrument details.

Application via the Book Service. If you use the free application form at book-drop.de/buchservice, we process the data you provide (name, e-mail address, subject area, goal of the book, target audience and optional remarks). The purpose is the review of your application and contacting you by e-mail regarding your request. The data is stored in our database; in addition, we receive an internal notification about the incoming application. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures). The application is free of charge and non-binding; no obligation to pay arises. We store the application data until your request has been finally processed and delete it afterwards, unless statutory retention obligations require otherwise.

4b. Feedback on Your Order

After the first download of your delivery, we may send you a one-time feedback request by e-mail. This e-mail is sent no earlier than 24 hours after your download.

Purpose of the processing. Product improvement and quality assurance of our digital services.

Categories of data. Star rating (1-5), optional free text, order reference (internal job identifier), time of the rating.

Legal bases. The storage and processing of the submitted feedback is based on Art. 6 (1) (f) GDPR (legitimate interest in improving our products). The sending of the feedback request by e-mail is based on Section 7 (3) of the German Act Against Unfair Competition (UWG) (customer satisfaction survey following the purchase of our own similar services), provided you were informed about this at the time of purchase and did not object.

Storage period. Feedback entries are stored for as long as they are relevant for product development, at most 3 years from submission.

Right to object. You can object to receiving feedback requests at any time by using the unsubscribe link in the respective e-mail or by sending an informal message to kontakt@book-drop.de.

Processors. The feedback e-mail is sent via Resend, Inc. (USA); the feedback is stored in the Supabase database. Both service providers are already listed in section 5 (Recipients and Processors).

5. Recipients and Processors

To provide the service, we use the following service providers, with whom data processing agreements pursuant to Art. 28 GDPR are in place:

Vercel Inc. (USA): hosting of the website.

Supabase Inc. (EU region): database and object storage, including private storage of the cover and optional interior PDF.

Railway Corp. (USA): hosting of the automated generator services.

Stripe Payments Europe Ltd. (Ireland/USA): payment processing.

Resend, Inc. (USA): sending of delivery e-mails.

Telegram Messenger Inc.: internal order and enquiry notifications to the provider. Name, e-mail address and enquiry content may be processed in this context. The legal basis is Art. 6 (1) (b) and (f) GDPR (contract processing, efficient order handling).

Strato AG (Germany): hosting of the contact mailbox (kontakt@book-drop.de) and domain registration.

Usercentrics A/S (Denmark, EU): operation of the consent management service "Cookiebot". An anonymised IP address, the consent status and a consent identifier are processed as proof of consent pursuant to Art. 7 (1) GDPR. Data processing takes place within the EU.

OpenAI, L.L.C. (USA): image generation. The cover, associated image prompts and, when the interior showcase is enabled, the three selected rasterised PDF pages are transmitted as image references. Under the OpenAI API terms of use, transmitted API data is not used to train the models and is retained for a maximum of 30 days for abuse monitoring. Third-country transfers take place on the basis of the EU-US Data Privacy Framework and, in addition, on the basis of EU Standard Contractual Clauses.

Anthropic, PBC (USA): text analysis and prompt creation. The book title and product description are transmitted. Under the Anthropic API terms of use, transmitted API data is not used to train the models; operational logs are deleted after a short period. Third-country transfers take place on the basis of EU Standard Contractual Clauses.

OpenRouter, Inc. (USA): brokering platform for additional AI models, including GLM by Zhipu AI and Gemini by Google, for structure and image analysis during order creation. For the optional interior showcase, rasterised contact sheets derived from the PDF and, where provided, the optional note are transmitted to Gemini for visual page selection; the complete PDF is not sent to the model. Otherwise, only the project content required for generation is transmitted. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). Third-country transfers take place on the basis of EU Standard Contractual Clauses. Forwarding to the respective model operators takes place under sub-processor arrangements.

Transfers to third countries (USA) take place on the basis of Standard Contractual Clauses pursuant to Art. 46 (2) GDPR and, where the respective provider is certified, additionally on the basis of the adequacy decision on the EU-US Data Privacy Framework.

6. Storage Period

Covers, texts and generated files are automatically deleted 30 days after completion of the order. An optional interior PDF is automatically deleted from object storage no later than 30 days after upload. Data relevant for accounting purposes is stored within the statutory retention periods (in particular Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)).

7. Rights of the Data Subject

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and to object to processing (Art. 21 GDPR). Please direct requests to kontakt@book-drop.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Germany.

We grant the rights described in this section — in particular access, rectification and erasure — to all users worldwide, irrespective of their location and irrespective of whether the GDPR formally applies to them.

8. Audience Measurement and Advertising (Only With Consent)

On this website, we use the services listed below exclusively after consent has been given in the cookie banner (Art. 6 (1) (a) GDPR, Section 25 (1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). Before consent is given, no cookies are set, no personal data is transmitted to the providers and no tracking scripts are active. Consent can be revoked at any time with effect for the future via the "Cookie Settings" link in the footer (Art. 7 (3) GDPR).

Google Tag Manager: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a pure management interface for deploying the tags listed below. It does not itself collect personal data for tracking purposes, but only loads the respective third-party scripts after you have approved the corresponding category in the cookie banner (Consent Mode v2).

Google Analytics 4: The provider is Google Ireland Limited. With active consent (category "Statistics"), Google Analytics sets cookies (in particular _ga, _ga_*, storage period up to 14 months) and transmits pseudonymised usage data (shortened IP address, device and browser information, referrer, visited URLs, events such as uploading a cover, clicking the payment button and completing an order) to Google servers in the EU and the USA. The evaluation serves to analyse user behaviour and optimise the offering. The legal basis is Art. 6 (1) (a) GDPR. We have activated IP anonymisation and concluded a data processing agreement with Google.

Google Ads – Conversion Tracking and Conversion Linker: The provider is Google Ireland Limited. With active consent (category "Marketing"), up to two cookies are set as soon as you reach our site via a Google Ads advertisement: _gcl_au (first-party cookie of the Conversion Linker for storing click information, storage period up to 90 days) and _gcl_aw (contains the Google Click Identifier GCLID for later conversion attribution, storage period up to 90 days). If you subsequently complete an order, Google Ads is informed that the order took place, together with the order value, the currency and a pseudonymous order identifier. This data serves exclusively to measure the success of our advertisements and to optimise them. The legal basis is Art. 6 (1) (a) GDPR.

Google Ads – Enhanced Conversions: As part of conversion tracking, we use the "Enhanced Conversions" feature. The provider and recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The e-mail address you provide in the order form is irreversibly encrypted before leaving the browser using a cryptographic one-way hash procedure (SHA-256) and is transmitted to Google Ads exclusively in this hashed form. The unencrypted e-mail address never leaves your browser for this purpose. Google uses the hash value exclusively to attribute a conversion of your order to a previous ad interaction, provided a matching hash value also exists at Google. No identification of your person by us or by Google beyond the hash value takes place. The legal basis is Art. 6 (1) (a) GDPR via the cookie consent tool; you can stop this processing at any time via the cookie settings by revoking the marketing consent.

The transfer of data to Google in the USA takes place on the basis of the adequacy decision on the EU-US Data Privacy Framework and on the basis of Standard Contractual Clauses pursuant to Art. 46 (2) GDPR. Further information can be found in Google's privacy policy (policies.google.com/privacy). Storage period of the data processed at Google: up to 14 months for Analytics events and up to 540 days for conversion data.

9. Cookies and Consent Management

Technically strictly necessary cookies (in particular for session and order handling and for consent management itself) are used without consent (Section 25 (2) no. 2 TDDDG). All other cookies and comparable technologies for audience measurement, marketing or tracking purposes (see section 8) are set exclusively after consent has been given in the cookie banner (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

As part of the payment process, our payment service provider Stripe sets technically necessary cookies (in particular __stripe_mid and __stripe_sid) for session management and fraud prevention. These cookies are required for secure payment processing (Section 25 (2) no. 2 TDDDG). Further information can be found in Stripe's privacy policy.

For the legally compliant management of consents, we use the consent management tool "Cookiebot" by Usercentrics A/S (Denmark, EU). Cookiebot stores your selection in the consent banner and a consent identifier as proof of consent in a technically necessary cookie CookieConsent(Art. 7 (1) GDPR, Section 25 (2) no. 2 TDDDG). The storage period is 12 months. You can revoke or adjust your consent at any time via the "Cookie Settings" link in the footer.

Overview of All Cookies Used

The following list is automatically maintained by our consent management tool Cookiebot and contains all cookies used on this website, including provider, purpose and storage period: