Privacy Policy

1. Who we are

REBEL AF Books is a UK-based business owned and operated by JoJo Miracle Patience ("we", "us", "our"), trading as a sole trader registered for tax in the United Kingdom.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller of the personal data described in this Privacy Policy.

Contact: jojo@rebelafbooks.com. A postal address for data-protection correspondence is available on request by email.

2. Personal data we collect

• Account information: name, email address, authentication details and login information (including Google Sign-In if you choose to use it).
• Writing content: notes, writing samples, uploaded text, themes, book outlines, chapter drafts, edits, version history and any other content you create or upload.
• Voice data: if you use Voice DNA, your speech is streamed for transcription. We store the resulting transcript and the Voice DNA writing profile. We do not store the audio recording itself in our database or file storage.
• Technical information: IP address, device and browser information, error logs, usage statistics, AI request audit logs, and security and authentication logs.
• Payment information: payments are processed securely by Stripe. We do not receive or store your full payment card details.

3. How we use your personal data

• Create and manage your account and authenticate your identity.
• Deliver the writing tools and AI features you request, including themes, outlines, drafts and Voice DNA profiles.
• Process payments, subscriptions and refunds.
• Respond to support requests and complaints.
• Maintain platform security and prevent fraud and misuse.
• Improve the performance and reliability of our services using aggregated or anonymised information.
• Send service communications, and marketing emails where you have consented.

We do not sell your personal data.

4. Our lawful basis for processing

Where we rely on legitimate interests, those interests are: keeping accounts and manuscripts secure against unauthorised access; detecting, investigating and preventing fraud, abuse and non-payment; keeping a record of AI requests so we can investigate incidents and answer questions about how your content was processed; diagnosing errors and keeping the service running reliably; and understanding aggregate feature usage so we can improve the product. We have considered your rights and interests and use the minimum data needed for each purpose.

Where processing relies on consent, you may withdraw that consent at any time.

5. AI processing

Our platform uses artificial intelligence to generate themes, outlines, drafts, polish checks and Voice DNA profiles. Content is processed through our application infrastructure and routed to AI providers, currently Google (Gemini) and OpenAI models.

We do not use your manuscript content, transcripts or personal data to train AI models, and we do not sell or licence it for AI training. We keep a technical audit log of AI requests (purpose, provider, model and timestamp) — not the content of the request or the output.

More detail is set out in our AI Transparency & Acceptable Use Policy.

6. Voice DNA

If you choose to use Voice DNA, your answers are recorded in your browser and streamed for transcription so we can build a profile of your writing voice. The audio is not saved to our database or file storage; we keep only the transcript and the resulting profile.

Transcripts and profiles are stored in your private account and used solely to generate content for your own projects. You can delete them at any time using "Delete my Voice DNA" in the app, or by deleting your account.

7. Sharing your personal data

• Lovable Cloud — database hosting, authentication and secure storage.
• Lovable — application hosting, infrastructure and AI gateway.
• Google — sign-in (only if you use Google login) and Gemini AI models.
• OpenAI — speech transcription and AI models.
• Stripe — payment processing.
• Resend — sending service and marketing emails.

These providers process personal data only as necessary to provide their services to us. We may also disclose data where required by law. We do not sell your personal data.

8. International transfers

Some of our service providers process personal data outside the United Kingdom. Where personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries covered by UK adequacy regulations.

9. Keeping your information secure

We use technical and organisational measures designed to protect your personal data, including:

• encryption of data in transit using TLS 1.2 or higher;
• encryption of stored data at rest;
• row-level database security, so each account can only reach its own content;
• role-based access controls and least-privilege access;
• secure server-side management of system credentials;
• monitoring of platform security and audit logging.

No method of electronic storage or transmission can be guaranteed completely secure. Where a personal data breach meets the threshold set out in UK GDPR, we will notify the Information Commissioner's Office and, where required, affected individuals without undue delay.

10. Data retention

• Account information: retained while your account is active, then deleted or anonymised within 30 days of account closure.
• Book content, transcripts and Voice DNA profiles: retained until you delete them or close your account, then removed within 30 days.
• AI audit logs: retained for 12 months, then deleted.
• Security and authentication logs: retained for up to 12 months.
• Marketing preferences and unsubscribe records: retained until you withdraw consent, plus a suppression record kept so we do not email you again.
• Financial and transaction records: retained for 6 years to meet UK tax and accounting obligations.

11. Your rights

Under UK GDPR you have the right to:

• access your personal data;
• request correction of inaccurate information;
• request deletion of your personal data;
• restrict or object to certain processing;
• receive a copy of your data in a portable format where applicable;
• withdraw consent at any time where processing relies on consent.

To exercise any right, email jojo@rebelafbooks.com. We will acknowledge your request and respond within one month. If your request is complex or you have made several requests, we may extend this by up to two further months and will tell you why within the first month.

If you are unhappy with how we handle your personal data you can complain to the Information Commissioner's Office (ico.org.uk).

12. Automated decision-making

We do not carry out solely automated decision-making or profiling that produces legal effects, or similarly significant effects, on individuals.

13. Cookies

We use cookies and similar technologies to provide essential functionality, maintain secure sessions and improve our services. Where required by law, we will ask for your consent before placing non-essential cookies. See our Cookie Policy.

14. Children's privacy

Our services are intended for users aged 18 or over. We do not knowingly collect personal data from children. If we become aware that we hold personal data relating to a child, we will delete it as soon as reasonably practicable.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify users by email or in the app before they take effect. The latest version will always be available here.