Privacy Policy

1. Who we are

The data controller responsible for your personal data is Publishinghub LLC, a company registered in the United States. You can contact us about privacy or data protection at:

• Email: support@breakthroughpub.com
• Postal address: available on request via the email above.

Because we offer services to individuals in the United Kingdom and the European Economic Area, UK and EU data protection law applies to our processing of your personal data even though we are established in the United States.

2. What personal data we collect

Depending on how you use the Service, we may collect:

• Account data: your name, email address, and profile photo (if you sign in with Google). Passwords are stored only as a bcrypt hash — never in plain text.
• Identity & auth data: Google ID (for Google Sign-In users), password-reset tokens.
• Subscription & billing data: your subscription plan, Stripe customer ID, and Stripe subscription ID. We do not store full card numbers — card details are handled directly by Stripe.
• Audiobook activity: Audible profile URLs you provide (US and/or UK), review URLs you submit, claimed promo codes, and AI-generated review drafts we produce for you.
• Affiliate data: your affiliate ID, if you participate in a referral programme.
• Support & feedback: messages you send us, feedback submissions (which may include screenshots), and the page you were on.
• Technical data: IP address, browser and device information, limited activity logs, and the sanitized Automation extension diagnostics described in Section 6.

3. Why we use it and our lawful bases

Purpose	Lawful basis (UK/EU GDPR)
Creating and managing your account; delivering the Service and features you request	Performance of a contract
Processing payments and managing subscriptions	Performance of a contract / legal obligation
Sending transactional emails (verification, receipts, service updates)	Performance of a contract
Generating AI-drafted review text from your Audible profile	Performance of a contract
Security, fraud prevention, debugging, and error monitoring	Legitimate interests
Responding to support requests and feedback	Legitimate interests

4. How long we keep it

We keep your account data for as long as your account is active and as needed to provide the Service. After account closure, we retain limited records where required for legal, accounting, or fraud-prevention purposes (typically up to 6 years for billing records), then delete or anonymise the rest. Individual Automation extension diagnostic events are kept for 90 days. De-identified lifetime counts grouped by issue signature are kept indefinitely so we can measure whether reliability improves or regresses.

You can delete your account at any time (see Section 10). Account deletion anonymises your personal fields (name, email, profile photo, Audible URLs, Google ID) while preserving anonymised activity records needed for platform integrity.

5. Cookies and similar technologies

• Strictly necessary: a secure session / auth token cookie that keeps you logged in. This is required for the Service to function and is exempt from consent under PECR.
• Third-party functional: Google Sign-In and Google Fonts may receive your IP address when those features load. Stripe may set its own cookies when you access the checkout or subscription management pages.

We do not use advertising or third-party analytics tracking cookies. You can control cookies through your browser settings.

6. Automation extension diagnostics

The invited Chrome beta automatically sends sanitized operational events in the background. This is mandatory for the beta and lets us diagnose failed claims, redemptions, player launches, review forms, account checks, and Code Sync steps without asking testers to submit logs.

Events may include the action, stage, US or UK marketplace, outcome, run identifier, AudioSwap claim or book numeric ID, extension/browser/operating-system version, API endpoint template and status, and short allowlisted selector outcomes such as preview_button:missing.

Extension diagnostics do not include Audible or AudioSwap passwords, authentication tokens, promo-code values, review text, listener account IDs, full page URLs, browsing history, or arbitrary page content. Detailed events are restricted to AudioSwap administrators. You can stop collection by disabling or uninstalling the extension; there is no separate diagnostics switch because automatic diagnostics are a condition of the invited beta.

7. AI processing of your content

AudioSwap uses Google Gemini to draft review text based on your public Audible profile. When you request a draft, your Audible profile URL and publicly available review/book information are sent to Google to produce your draft. We do not sell this content. Where available, we ask providers not to use your inputs to train their models.

Note: we read public Audible pages to gather context for your draft — we do not send your personal data (name, email, etc.) to Amazon or Audible.

8. Who we share your data with (sub-processors)

We share personal data with trusted service providers who process it on our behalf, only as needed to deliver the Service:

Provider	Purpose	Location
Hetzner	Hosting & database (where your data is stored)	Germany (EU)
Stripe	Payment processing & subscription management	USA
Google (Sign-In & Gemini AI)	Authentication; AI review-draft generation	USA
Google Fonts	Web font delivery	USA / global
Transactional email provider	Sending verification and notification emails	USA
Amazon / Audible	We read public Audible pages to verify reviews — we do not send your personal data to them	USA / global

We require these providers to protect your data and to process it only on our instructions. We do not sell your personal data to anyone.

9. International transfers

Your core account data is stored within the European Union (Germany, via Hetzner). Some of the providers above are located in the United States, so using the Service involves transferring some personal data internationally. Where we make such transfers, we rely on appropriate safeguards, including providers’ Standard Contractual Clauses and, where applicable, EU-US / UK-US Data Privacy Framework participation.

10. Your rights

Under UK and EU data protection law you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Have your data erased (“right to be forgotten”) — you can delete your account directly from your profile page; this anonymises your personal fields immediately;
• Restrict or object to our processing;
• Receive your data in a portable format;
• Withdraw consent at any time (where we rely on consent).

To exercise any of these rights (other than account deletion, which you can do yourself), email support@breakthroughpub.com. We will respond within one month. No fee applies unless your request is clearly unfounded or excessive.

11. Complaints

If you are in the UK and are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk. If you are in the EEA, you may complain to your local data protection authority. We would, however, appreciate the chance to address your concerns first.

12. Data security

We protect your data with encrypted connections (HTTPS/TLS), bcrypt-hashed passwords, server-side access controls, a firewalled VPS, and daily database backups. No system is completely secure, but we will notify you and the relevant authority if a breach affecting your rights occurs.

13. Children

The Service is intended for adults and is not directed at children under 16. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy from time to time. The “last updated” date above shows the latest version. Material changes will be communicated through the Service or by email.

15. Contact

Questions about this policy or your data? Email support@breakthroughpub.com.