Skip to content
Start free
Legal

Privacy policy

We collect what we need to make your books and run the service, and nothing to sell. Here is the detail.

Last updated

1. Who is responsible

The data controller is THE VIBECODING AGENCY, société à responsabilité limitée (SARL), RCS Paris 108 800 616, 5 rue de la Moselle, 75019 Paris, France, which operates kdpbook.io (see the legal notice). For anything about your personal data, write to contact@thevibecodingagency.fr.

2. What we collect

  • Account: your email address, the name and avatar you choose to show and, if you choose to answer, how you heard about kdpbook.io. If you sign in with Google, we receive your name, email address and profile photo from Google.
  • Your books: prompts, settings, imported manuscripts and images, the generated text, illustrations, covers, files and listing drafts, and your chat messages with the assistant, with the pictures you attach to them.
  • Billing: your plan, credit history, payment records and the billing address and tax ID you give at checkout. Card details are handled by Stripe; we never see or store your full card number.
  • Security and anti-abuse: at signup we record your email address, a device identifier stored in a cookie, hashed network information, your browser’s user agent and your country, to stop people from creating many free accounts. We don’t store raw IP addresses for this.
  • Usage: pages visited and basic technical data (browser, device type) through privacy-friendly analytics without cookies, and the first page and referrer you arrived from (and, when you arrive from one of our ads, which campaign, ad and search keyword, but not the reference of your click). Visits are also counted in aggregate, without any identifier: the site, search engine or AI assistant you came from (or the campaign, ad and keyword of our ad), the page and your country. To count unique views of community books, we store a keyed hash of your IP address and browser for two days. If My books asks you to review kdpbook.io, we note when the request was first shown and whether you closed it or opened a review site (and which), so that it stops after your choice or after a week.
  • Ad measurement (in the European Economic Area, the United Kingdom and Switzerland only if you accept it, elsewhere unless you turn it off: see section 7): OpenAI’s Measurement Pixel runs on our pages, and when you sign up or buy a plan or credits we tell OpenAI, through the pixel in your browser and from our server, so that OpenAI can tell us whether it followed a click on one of our ads in ChatGPT. This includes the reference of the ad you clicked and a random browser reference (both stored in OpenAI’s cookies below), your email address and account ID in hashed form (SHA-256, never in clear), your country, the plan or pack and its price, your IP address and your browser’s user agent. In the same way, Google’s tag (Google Ads) runs on our pages and, when you sign up, open the payment page or buy, tells Google, from your browser, so that Google can tell us whether it followed a click on one of our ads on Google. This includes the reference of the ad you clicked (stored in Google’s cookies below), the signup, checkout or order reference, the price of the plan or pack, your email address in hashed form (SHA-256, never in clear) when you are signed in, the page address, and your IP address and browser’s user agent, which Google receives with each request. Likewise, Meta’s pixel (Facebook and Instagram ads) runs on our pages and tells Meta which of our pages you view, and when you sign up, open the payment page or buy we tell Meta, through the pixel in your browser and from our server, so that Meta can tell us whether it followed a click on one of our ads on Facebook or Instagram. This includes the reference of the ad you clicked and a random browser reference (both stored in Meta’s cookies below), the page address, the signup, checkout or order reference, the plan or pack and its price, your email address and account ID in hashed form (SHA-256, never in clear) when you sign up or are signed in, your country, and your IP address and browser’s user agent. Meta may link these page views and events to your Facebook or Instagram account through its own cookies, and uses them to choose who sees our ads (see section 3). The signup reference sent to OpenAI, Google and Meta is a code computed from your account that doesn’t reveal it. None of these tags runs on a page opened with a private link (such as the link to an unlisted book), and Meta is never told about such a page.
  • Reports: if you report a community book, your account, the reason and the details you give.
  • Emails: your email preferences, whether our emails were delivered, and the country you signed up from (the one recorded at signup, above), so that our emails reach you at a reasonable hour where you live.

3. Why we use it, and on what legal basis

  • To provide the service you signed up for: generate, store, display and export your books, keep your credit balance, and send service emails (account, book ready, billing). Basis: our contract with you (the terms of service).
  • To bill paid plans and credit packs, and keep invoices and accounting records. Basis: the contract, and our legal obligations (tax and accounting law).
  • To prevent fraud and abuse and keep the service secure. Basis: our legitimate interest in protecting the service and the free credits.
  • To understand which pages and features are useful, in aggregate, and to send occasional product emails (tips, digests) about the service you use. Basis: our legitimate interest; you can turn product emails off in your settings or with the unsubscribe link in every email.
  • To measure our ads in ChatGPT, on Google, Facebook and Instagram: count the signups, started checkouts (the payment page opened) and purchases that follow a click on one of our ads (and, for Meta, the pages viewed). Basis: your consent in the European Economic Area, the United Kingdom and Switzerland (and wherever we can’t tell where you are); elsewhere, our legitimate interest in knowing whether our ads work, which you can refuse at any time in the cookie settings.
  • To help Meta show our ads on Facebook and Instagram to people likely to sign up or buy (ad delivery optimization): Meta uses the pages you view here and the signups, started checkouts and purchases we report, and may link them to your Facebook or Instagram account, under its own terms. Basis: your consent in the European Economic Area, the United Kingdom and Switzerland (and wherever we can’t tell where you are); elsewhere, our legitimate interest in reaching people our service is useful to, which you can refuse at any time in the cookie settings.

We don’t sell your data or use your books to train AI models. The only advertising uses of your data are the two above (page views, signups, started checkouts and purchases reported for ad measurement, and Meta’s ad delivery): we don’t give it to advertisers or use it to target you ourselves (we keep Google’s ad personalization off and build no Meta audience from our visitors, so visiting kdpbook.io doesn’t add you to an advertising audience of ours).

4. Who processes it

We use a small number of providers (processors) that handle personal data on our behalf, each only for its job:

  • Supabase: database, file storage and sign-in.
  • Vercel: website hosting, and Vercel Web Analytics for anonymous, cookie-free page statistics.
  • Railway: the servers that generate, lay out and export your books.
  • OpenAI: writing text, drawing images, the planning chat and the Book assistant. It receives the prompts and content needed to generate and edit your book, including the pictures you attach to a message to the assistant, under its API terms (API data isn’t used to train its models).
  • Google (Gemini API): page layout planning and describing the pictures you upload, under its API terms. Google is also the sign-in provider if you choose “Continue with Google”.
  • Stripe: payments, invoices and sales tax. When ad measurement is allowed, the checkout also keeps with the payment the ad references needed to report the purchase: the references of the ad you clicked and of your browser (OpenAI’s and Meta’s cookies below), your country and your browser’s user agent.
  • OpenAI (ChatGPT ads): measurement of our ads, according to your cookie choice (see section 7).
  • Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC in the United States): measurement of our ads on Google, according to your cookie choice (see section 7), under Google’s ads data protection terms.
  • Meta (Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland, and Meta Platforms, Inc. in the United States): measurement of our ads on Facebook and Instagram and, under Meta’s own terms, their delivery (see section 3), according to your cookie choice (see section 7), under Meta’s Business Tools Terms; for this measurement Meta and kdpbook are joint controllers (Meta’s Controller Addendum), and Meta answers requests about the data it holds (Meta’s privacy policy).
  • Resend: sending our emails.

Some of these providers are based in the United States or process data there. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission’s standard contractual clauses otherwise. Ask us for a copy of the safeguards.

Your browser also contacts Google Fonts when the book editor or one of our emails loads a font from Google’s servers, and Google’s image servers for the profile photos of people who signed in with Google. Google receives your IP address for these requests.

5. What is public

Books published in the community (all free-plan books, and paid-plan books you make public) are visible to anyone, with their title, cover, pages, the name you show and, if you choose, the prompt behind them. Private books and your account details are never public.

6. The kdpbook Publisher browser extension

kdpbook Publisher is our optional Chrome and Edge extension that fills your Amazon KDP draft with a book you made on kdpbook.io, when you ask it to from the book's Export page. You review the draft and publish it yourself.

  • What it reads on kdp.amazon.com: in the tab it opened for that job, and only while it works there: the pages of the draft it is filling (the form fields it sets and checks, what KDP saved, and KDP's messages), and your Bookshelf, where it looks up this book's titles and their status (to find the draft, and never to create a second one). The rest of your Bookshelf (your other titles) stays in your browser. It doesn't act in your other tabs.
  • What it sends to kdpbook: your KDP draft ID, which step it is on, KDP's messages, the page's address with the draft ID removed, the extension's version, and what KDP saved for this draft: the ISBN KDP assigned, the categories placed, the prices, the file names, and whether the draft is in review or live. To choose the categories, it also sends KDP's category list for your marketplace; kdpbook sends that list with a summary of your book (title, type, audience, description, keywords) to its AI provider (OpenAI) to pick the closest matches. We use all of this to show you the progress and what was filled, to resume where it stopped, and to fix the extension when KDP changes a page.
  • What it never touches: your Amazon password, sign-in and verification pages, cookies, payments, tax and bank details, and every other page you visit.
  • What it fills into KDP: your book's listing, files and the settings you confirmed (author name, prices, ISBN choice, AI-content answers). They come from your kdpbook account and go to your own KDP account; what kdpbook gets back is only what the previous point lists, kept with the book (the link to the KDP draft stays with it).
  • In your browser: the job's progress and a short-lived kdpbook session for that job (6 hours, revocable from your settings), never a password.
  • Your choice: the extension asks for your consent before its first job and sends nothing without it. You can withdraw it in the extension, disconnect it from your settings, or remove it at any time.

The use of information received from the kdpbook Publisher extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. Cookies

  • Sign-in cookies (sb-…, up to 400 days, renewed while you use kdpbook) keep you logged in.
  • Device cookie (kb_did, one year, set on your first visit): a random identifier used against multi-account abuse.
  • Account cookie (kb_acct, one year, set when you sign in or sign up): only says that this browser has signed in to an account before, so the sign-in screen opens on “Welcome back” instead of “Create account”. It holds nothing about you.
  • Attribution cookie (kb_attr, one year, set on your first visit): the campaign, referrer and landing page of your first visit, and of your latest visit from one of our ads (which ad, not the reference of your click), so we know how people find us. It stays on kdpbook.io and is never shared with advertisers.
  • Country cookie (kb_geo, 7 days): the country your connection comes from, as our host detects it, so we know whether to ask before measuring our ads.
  • Cookie choice (kb_consent, 6 months): whether you accepted or refused ad measurement.
  • OpenAI ad measurement cookies, set on kdpbook.io by OpenAI’s Measurement Pixel, only when ad measurement is allowed: __oppref (30 days) holds the reference of the ChatGPT ad you clicked, and __obref (365 days) a random reference for your browser. With them, a short-lived kb_signup cookie (10 minutes) tells the page after a signup to report it, and your browser remembers which signups, started checkouts and purchases it already reported, so none is counted twice.
  • Google Ads measurement cookies, set on kdpbook.io by Google’s tag, only when ad measurement is allowed: _gcl_au (90 days) links your visits for conversion measurement, and _gcl_aw, _gcl_gb and the other _gcl_ cookies (90 days) hold the reference of the Google ad you clicked. Google may also read or set its own cookies on its domains (for example IDE on doubleclick.net: 13 months in the EEA, the UK and Switzerland, 24 months elsewhere), under Google’s own cookie policy.
  • Meta ad measurement cookies, set on kdpbook.io by Meta’s pixel, only when ad measurement is allowed: _fbp (90 days) a random reference for your browser, and _fbc (90 days) the reference of the link you clicked in Facebook or Instagram (an ad, or a post). Meta may also read its own cookies on facebook.com if you are logged in there (for example fr, 90 days), under Meta’s own cookie policy.

Your choice. One choice covers OpenAI, Google and Meta. In the European Economic Area, the United Kingdom and Switzerland, or when we can’t tell where you are, ad measurement stays off until you accept it: none of OpenAI’s, Google’s and Meta’s scripts is even loaded before that (Google’s consent mode, basic setup). Elsewhere it is on unless you turn it off. You can change your choice at any time with “Cookie settings” at the bottom of every page (or in your account menu once signed in); refusing stops the measurement and deletes OpenAI’s, Google’s and Meta’s cookies on kdpbook.io. We ask again after 6 months.

Apart from this ad measurement, we don’t use advertising or cross-site tracking cookies, and our analytics don’t use cookies at all.

8. How long we keep data

  • Account and books: while your account exists. When you delete a book, it disappears from your library and the community.
  • When you delete your account (from your settings): your profile is anonymized, your books leave your library and the community, and your avatar, uploaded reference pictures and the pictures you attached to messages to the assistant are erased. Ask us if you also want the remaining book data erased permanently.
  • Invoices, payment records and the credit history: 10 years, as French accounting law requires.
  • Ad references saved with a checkout (only when ad measurement is allowed: see Stripe in section 4): with the payment record at Stripe.
  • Anti-abuse signals (the signup record with your email address, device identifier, hashed network information, browser and country): as long as needed to stop repeated free accounts, including after the account is deleted, so the free credits can’t be claimed again.
  • Community view hashes: two days.
  • kdpbook Publisher: the extension's step and error events, 90 days; its job sessions, 30 days after they end. The KDP draft linked to a book stays with the book until you unlink it.
  • Reports: as long as needed to handle them and keep a record of the decision.
  • Cookies: up to 400 days, as listed above.

9. Your rights

Under the GDPR you can ask to access, correct, delete or export your personal data, to restrict its use, or object to uses based on our legitimate interest (including product emails, at any time). Write to contact@thevibecodingagency.fr from the email address of your account and we will answer within a month. You can also give instructions about what happens to your data after your death, as French law allows.

If you think we don’t respect your rights, you can complain to the French data protection authority, the CNIL (cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France), or to the authority of the country where you live.

10. Children

kdpbook is not meant for children: you must be old enough to enter into a contract to create an account. Books for children are made by adults.

11. Changes

If we change this policy in a way that matters, we will tell you before the change applies. The date at the top shows the latest version.