Privacy Policy

NovelistAI is operated by AI4Projects OÜ, a private limited company registered in Estonia under registry code 17445999, with its registered office at Lõõtsa tn 5, Lasnamäe linnaosa, 11415 Tallinn, Estonia. We are the data controller for the personal data described here.

For any question about this policy, or to exercise any of the rights set out below, write to [email protected].

Account data — your email address, username, password (stored only as a cryptographic hash, never in readable form), and the display details you choose to add such as an author name or description. We need this to create and run your account, so the legal basis is performance of our contract with you.

Content you create — the books, chapters and pages you write, the prompts you give the AI, the cover images and illustrations you generate, and any audio narration you produce. This is stored so you can return to your work, and is processed to provide the service you asked for. Books stay private unless you choose to publish them to the public library.

Voice samples — if you create a custom narrator, we store the audio sample you upload and the voice model derived from it. We use it only to generate narration for you. Only upload a recording of your own voice, or one you have clear permission to use. You can delete a custom voice at any time from your account.

Payment data — your plan, invoices and transaction history. We never see or store your card details; payments are handled entirely by Stripe, and we keep only the identifiers Stripe returns to us. The legal basis is our contract with you, and for the invoices themselves a legal obligation under Estonian accounting law.

Usage and technical data — basic request information needed to operate and secure the site. The legal basis is our legitimate interest in keeping the service working and preventing abuse.

Analytics — only if you accept analytics cookies. See the cookies section below.

Generating text, images or audio means sending your prompt, and the relevant part of your book, to the AI provider you chose for that generation. These providers act as our processors and are contractually bound to use the data only to return the result:

• OpenAI — text generation and speech synthesis.
• xAI — text generation (Grok models).
• fal.ai — image generation and editing, and speech synthesis. For the models grouped as "Other", fal.ai routes the request onward through OpenRouter to the provider of the model you selected.
• Replicate — custom voice cloning and narration with your own voice.
• Stripe — payment processing.
• Cloudflare — content delivery and protection for our website.
• Google — website analytics, only where you have accepted analytics cookies.

Our own servers are in the European Union. Several of the providers above are established in the United States, so using those features involves an international transfer of your content. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the Commission's Standard Contractual Clauses.

Strictly necessary cookies keep you signed in and keep your session secure. They are required for the site to work, so they are set without asking.

Analytics cookies (Google Analytics) help us understand which pages are used and where people get stuck. These are only set if you accept them. If you decline, the analytics scripts are never loaded at all.

Referral cookie — if you arrive through an affiliate link, we store the referral code for 90 days so the person who referred you is credited. This is also only set once you have accepted cookies.

You can change your mind at any time by deleting the cookie_consent cookie in your browser settings, which brings the choice back on your next visit.

• Account, books, images, audio and custom voices — for as long as your account is open. If you ask us to delete your account, we erase them within 30 days.
• Invoices and payment records — 7 years, as Estonian accounting law requires. This is the one category we cannot delete on request.
• Analytics — 14 months, after which Google Analytics deletes it automatically.
• Server logs — rotated and deleted daily.

Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what we did beforehand.

Write to [email protected] and we will respond within one month. There is no charge.

If you think we have handled your data badly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or to the supervisory authority in the EU country where you live.

NovelistAI is not intended for children under 13, and if you are under 18 you need your parent or guardian's permission to use it. If you believe a child has given us personal data, contact us and we will remove it.

The site is served over HTTPS, passwords are stored only as hashes, and payment details never reach our servers. No system is perfectly secure, but if a breach ever affects your rights we will notify you and the Estonian Data Protection Inspectorate as the GDPR requires.

If we change how we handle your data we will update this page and change the date at the top. Significant changes will be announced in the product.

This policy should be read together with our Terms of Service.