Key Principle
Your Manuscripts Stay Private
We never sell your personal data or private manuscripts, never run third-party ad networks inside the studio, and never use your books to train public AI models.
Privacy & GDPR Data Protection · Effective November 13, 2026
Arte Soft EOOD · EU / GDPR
Privacy Policy & GDPR Data Protection Notice
Arte Soft EOOD ("Arte Soft", "we", "us", or "our") respects the confidentiality of your unpublished manuscripts and personal data. This Privacy Policy explains clearly what data ArteBook Studio (https://artebook.arte-soft.com/) collects, why we process it under the EU General Data Protection Regulation (GDPR), where it is hosted in the European Union, how long it is kept, and how you exercise full control over your information.
Key Principle
EU Core Hosting & AES-256 Exports
Core workspaces and private 30-day book export archives are hosted on encrypted infrastructure in Germany (EU), protected by TLS in transit and strict access controls.
Key Principle
On-Demand AI & Voice Processing
Prompts, uploaded reference files, and microphone audio are transmitted only when you explicitly click an AI, voice, or citation button—never passively in the background.
Key Principle
Zero Card Storage (Stripe PCI-DSS)
Subscriptions and credit purchases are handled directly by Stripe. Arte Soft EOOD never receives or stores your full credit card number or CVV security code.
Data Processing Register, GDPR Legal Bases & Retention Periods
| Data Category | Purpose of Processing | GDPR Legal Basis (Art. 6) | Retention Period |
|---|---|---|---|
| Account Profile & Auth (email, pen name, salted password hash, verification status) | Account sign-in, 6-digit email verification, collaborator attribution, and credit ledger tracking | Art. 6(1)(b) Contract performance & Art. 6(1)(f) Security | Retained while account is active; deleted within 30 days of verified account deletion request. |
| Manuscripts, Comments, Track Changes & Uploaded Reference Files (PDF, DOCX, XML, images) | Providing your book workspace, live co-author editing, version history, and cover/book exports | Art. 6(1)(b) Contract performance | Retained until you delete the book or close your account; guest drafts may be purged periodically. |
| AI Prompts, Selected Text & Voice Dictation Audio | Executing user-requested chapter drafting, editing, translation, cover generation, or transcription | Art. 6(1)(b) Contract & Art. 6(1)(a) Browser mic consent | Processed ephemerally to return your result; not used to train foundation models. |
| Compiled Book Exports (PDF, EPUB 3.0, DOCX, XML) in Private EU Cloud Storage | Delivering instant browser downloads and 30-day emailed download links | Art. 6(1)(b) Contract performance | Automatically and permanently deleted after 30 days via cloud lifecycle rules. |
| Stripe Billing Identifiers & Tax Invoices | Subscription management, VAT/tax calculation, fraud prevention, and statutory accounting | Art. 6(1)(b) Contract & Art. 6(1)(c) Legal obligation | Retained for statutory tax and accounting periods required under Bulgarian and EU law. |
| Edge Security Logs & Anonymized Analytics (IP security headers, GA4 anonymize_ip) | DDoS/WAF protection, rate limiting, abuse prevention, and aggregate page performance | Art. 6(1)(f) Legitimate interest | Transient security logs rotate within 7–30 days; aggregate analytics contain no manuscript text. |
1. Data Controller & Privacy Contact
For purposes of Regulation (EU) 2016/679 (General Data Protection Regulation — "GDPR") and applicable national data protection laws, the Data Controller of personal information processed through ArteBook Studio is Arte Soft EOOD, registered in the Republic of Bulgaria, European Union (website: https://arte-soft.com/).
You can reach our privacy and data protection team directly at any time—in English or Bulgarian—by emailing [email protected] with the subject line "Privacy / GDPR Request".
2. Information We Collect & Information We Never Collect
Account & Session Information: When you register an account, we collect your display/pen name, email address, and a cryptographically salted hash of your password (we never store plaintext passwords). We use a strictly necessary HttpOnly, Secure session cookie to keep you signed in and protect against cross-site request forgery.
Manuscripts, Assets & Collaboration Data: We store the books, sections, comments, tracked revisions, version snapshots, cover images, and reference files (such as PDFs, Word documents, XML files, or illustrations) that you create or upload, along with email addresses of collaborators whom you invite to a book.
Microphone & Voice Features: ArteBook Studio requests browser microphone permission only when you click the Voice Dictation or Live Voice Co-Author controls. Audio is streamed solely while the recording indicator is active in order to transcribe or respond to your spoken instructions; the platform never records audio in the background.
Payment Information: Checkout and subscription management are operated by Stripe. We receive confirmation of your plan tier, Stripe customer/subscription reference IDs, billing country for tax compliance, and payment status, but never your full card number, bank credentials, or CVV.
3. How AI Features, Uploaded Documents & Citation Searches Handle Your Data
User-Initiated Processing Only: Nothing from your manuscript is sent to an external AI model or citation database unless you actively trigger an AI command, voice session, cover generation, or citation search.
Zero Public Model Training: When you run an AI writing, editing, translation, voice, or cover operation, only the relevant prompt, selected section context, or attached file excerpt is transmitted over encrypted TLS 1.3 to our enterprise AI API sub-processors under commercial Data Processing Agreements (DPAs) where API inputs and outputs are excluded from training public foundation models.
Scholarly Citation Lookups: When you search for academic references in the Citation Finder, only your search keywords or DOI identifiers are sent to public scholarly bibliographic registries (such as Crossref, OpenAlex, PubMed, Europe PMC, and Semantic Scholar) to retrieve bibliographic metadata—your private manuscript chapters are not shared with those registries.
4. EU Infrastructure, Sub-Processors & International Data Safeguards
Arte Soft EOOD selects reputable infrastructure partners with strong European data protection commitments to operate ArteBook Studio:
• Hetzner Online GmbH (Germany, European Union): Primary application hosting and encrypted manuscript database storage within ISO 27001-certified German data centers.
• Amazon Web Services EMEA SARL (eu-central-1, Frankfurt, Germany, EU): Private AES-256 encrypted S3 storage bucket (with all public access blocked and automatic 30-day object expiration) and isolated serverless document compilation for PDF, citation, and XML exports.
• Cloudflare, Inc. (Global Edge / EU PoPs): DNS routing, TLS 1.3 encryption, Web Application Firewall (WAF), DDoS mitigation, and authenticated download gateway routing.
• Stripe Payments Europe, Limited (Ireland / Global): PCI-DSS Level 1 payment processing, invoicing, and subscription portal.
• Enterprise AI API Providers (OpenAI Ireland Ltd. / US affiliates): Zero-training API inference for user-triggered text, cover image, and voice dictation operations.
• Google Ireland Limited (Google Analytics 4 with IP anonymization): Aggregate traffic measurement on public marketing and guide pages only—never inside private manuscript text.
Where a sub-processor processes limited technical or user-initiated API data outside the European Economic Area (EEA), transfers are safeguarded by European Commission Standard Contractual Clauses (SCCs, Decision (EU) 2021/914) and/or certification under the EU–U.S. Data Privacy Framework.
6. Security Architecture & 30-Day Export Auto-Deletion
We protect your account and manuscripts through layered technical and organizational safeguards: TLS 1.3 encryption across all web, collaborative, and API connections; salted cryptographic password hashing; least-privilege cloud IAM credentials scoped strictly to a single private EU export bucket; short-lived signed download tokens; per-book and per-chapter collaborator permissions; and automated rate limiting against brute-force abuse.
Exported book files (PDF, EPUB 3.0, Word DOCX, and XML) stored for instant download or 30-day email links reside in a private Frankfurt S3 bucket with public access completely blocked and are automatically purged after 30 days. When you delete a manuscript inside your Dashboard, its chapters and structure are removed from active workspaces.
7. Your Rights Under GDPR, UK GDPR & Global Privacy Laws
Regardless of where you live—and specifically if you reside in the European Economic Area (EEA), the United Kingdom, Switzerland, or California/United States—you have the following enforceable privacy rights:
• Right of Access & Data Portability (GDPR Art. 15 & 20): Export any of your books directly from the studio at any time in standard open formats (EPUB 3.0, Word DOCX, Markdown, PDF, or XML) and request a copy of your account profile and credit ledger.
• Right to Rectification & Erasure ("Right to be Forgotten", Art. 16 & 17): Edit or delete individual books directly from your Dashboard, or email [email protected] from your registered email address to request permanent deletion of your account and associated personal data (subject only to mandatory tax/invoice retention under law).
• Right to Restriction, Objection & Consent Withdrawal (Art. 18, 21 & 7(3)): Revoke browser microphone permissions at any time in your browser settings, remove collaborators from your books, or object to processing based on legitimate interests.
• Supervisory Authority Complaint Right (Art. 77): If you believe your data protection rights have not been respected, we invite you to contact [email protected] first so we can resolve your concern promptly. EU/EEA residents also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP — https://www.kzld.bg/) or the supervisory authority in their Member State of residence. California residents are further informed that Arte Soft EOOD does not "sell" or "share" personal information as defined under the CCPA/CPRA.
8. Children's Privacy & Policy Updates
ArteBook Studio is a professional and creative authoring platform not directed to children under the age of sixteen (16). We do not knowingly collect personal data from children under 16 without verifiable parental consent; if you believe a minor has submitted personal information without authorization, contact [email protected] and we will promptly delete it.
We may update this Privacy Policy from time to time to reflect infrastructure improvements or legal developments. Any material changes will be published at https://artebook.arte-soft.com/privacy/ with an updated effective date.