Privacy Policy

Last updated: 26 June 2026

1. Who we are

REBEL AF Books is operated by JoJo Miracle Patience, a sole trader based in the United Kingdom, trading as REBEL AF Books ("we", "us", "our"). For any privacy-related question you can reach us at jojo@rebelafretreats.com.

We are the data controller for the personal data described in this policy. This policy is written to meet the requirements of UK GDPR and the Data Protection Act 2018.

2. What data we collect

  • Account data: name, email address and authentication details when you sign in (including via Google).
  • Writing samples: notes and text you upload or type while building your book.
  • Project content: themes, outlines, chapter drafts, edits and version history you create in the platform.
  • Usage data: basic technical logs (e.g. timestamps, errors, IP address) needed to run and secure the service.

3. How we use your data

  • To provide the service: capture your voice, extract themes, build outlines and draft chapters in your voice.
  • To keep your account secure and authenticate you.
  • To send service emails (e.g. "your draft is ready") and, if you opted in, occasional product updates.
  • To improve the product, by reviewing aggregated or anonymised usage. Our AI subprocessors process your content only to deliver the service (for example, drafting and editing). We do not sell your content. We are committed to ensuring your content is not used to train third-party AI models and are putting the technical and contractual controls in place to guarantee this before public launch.

4. Legal basis

We rely on (a) contract to deliver the service you signed up for, (b) consent for marketing emails and for processing voice recordings used to build your Voice DNA profile, and (c) legitimate interests for security, fraud prevention and product analytics. You can withdraw consent at any time by emailing us.

5. Voice data

REBEL AF Books does not currently record, store or process voice recordings. The Voice DNA feature is in development and will only be enabled once we have the technical and contractual controls in place to guarantee voice recordings are never used to train third-party AI models. When that feature launches, this policy will be updated with the specifics of how voice data is stored, used and deleted, and your explicit consent will be required before any recording takes place.

6. Sharing and subprocessors

We use a small number of trusted providers to run the service:

  • Supabase - database, authentication and file storage.
  • Lovable - application hosting and AI gateway.
  • Google - sign-in (only if you choose Google login).
  • Stripe - payments, when paid plans are enabled.

We do not sell your personal data. We share it only with the providers above, and only to the extent needed to run the service.

7. How we protect your data

Your data is stored on infrastructure provided by Supabase, our backend provider. Based on Supabase's published platform practices:

  • Data is encrypted at rest using AES-256.
  • All connections to the database and APIs use TLS 1.2 or higher in transit.
  • Database backups are encrypted before they are stored.

On top of this, we follow least-privilege access controls, use row-level security so each account can only reach its own content, and keep service secrets out of client code. No system is ever 100% secure, so we also commit to telling affected users without undue delay if we ever become aware of a personal-data breach.

Your voice recordings and transcripts are stored securely via our backend provider, encrypted at rest using AES-256 and in transit via TLS. They are never used to train AI models and can be deleted on request.

8. Retention

We keep your account, voice data and book content for as long as your account is active. If you delete your account, we delete your content within 30 days, except where we must keep limited records for legal or accounting reasons.

9. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or port your personal data, to object to certain processing, and to withdraw consent. To exercise any of these rights, email jojo@rebelafretreats.com. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

10. International transfers

Some of our providers process data outside the UK. Where they do, we rely on the UK International Data Transfer Addendum or equivalent safeguards to protect your data.

11. Changes

If we make material changes to this policy we will notify you by email or in the app before they take effect.