Novel Gen1
← All legal documents

Privacy Policy

Last updated: 2026-06-12

DRAFT — pending legal review. Items in [brackets] must be completed before production launch, including the contact address and the EU representative question (Art. 27 GDPR).

1. Controller

Mitbolas GmbH, Asylstrasse 26, 8800 Thalwil, Switzerland, is the controller for personal data processed on this platform.

  • Contact: [legal@mitbolas.com]
  • EU representative (Art. 27 GDPR): [to be appointed / under review — required if no EU establishment exists and services are offered to EU users]

We process personal data under the Swiss Federal Act on Data Protection (FADP). For users in the European Economic Area and the United Kingdom, the GDPR (and UK GDPR) apply in addition.

2. What we process, and why

We deliberately collect little. There is no password, no advertising tracking and no analytics profile.

  • Account data — email address, display name, role (creator/reader). Needed to operate your account and sign you in. Legal basis: performance of contract.
  • Sign-in data — single-use magic-link tokens (deleted or expired within about 15 minutes) and session records (expire within 24 hours). Legal basis: performance of contract.
  • Subscription and billing data — your subscription status and references to Stripe objects. Payment card details go directly to Stripe and never reach our systems. Legal basis: performance of contract; legal obligation (accounting).
  • Usage counters — per-month counts of generation runs, used to enforce plan allowances. Legal basis: performance of contract.
  • Attribution data — your email on projects you own, feedback you write and document versions you edit. Legal basis: performance of contract; legitimate interest in a coherent editorial record.
  • Creator and book content — universe documents, chapters and related material are stored by project, not by person, and are governed by the Terms of Service and Creator Agreement.

Our application is designed not to write email addresses to server logs.

3. AI processing

Generating book content sends project content and prompts to the AI model providers listed on the Subprocessors page. We do not send your account profile to model providers, and we do not use your content to train models ourselves; the providers process API content under their respective API terms. See the AI Transparency Declaration.

4. Recipients and international transfers

We use a small set of service providers (hosting, email delivery, payments, AI models), listed with locations on the Subprocessors page. Our infrastructure runs on AWS in the EU (Frankfurt, eu-central-1).

Where personal data is transferred outside Switzerland or the EEA — in particular to AI model providers in the United States — we rely on recognised transfer safeguards [transfer mechanism per provider to be confirmed in legal review: EU–US Data Privacy Framework and/or standard contractual clauses]. Switzerland and the EU recognise each other's data protection as adequate.

5. Retention

  • Magic-link tokens: about 15 minutes.
  • Sessions: up to 24 hours.
  • Account, subscription and usage data: for the life of your account, then deleted or anonymised as described below.
  • Invoicing and accounting records: about 10 years (Art. 958f Swiss Code of Obligations). Stripe retains invoices under its own legal obligations.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, within the limits of the FADP and GDPR. The platform implements the two big ones as self-service:

  • Export — your account can produce a complete machine-readable export (profile, subscription, owned projects with documents and chapter texts, authored feedback) via the account export function (GET /account/export).
  • Deletion — you can delete your account (confirmation required) via the account deletion function (POST /account/delete). This removes your account, subscription and usage records, ends your session, and requests deletion of your Stripe customer object. Records we must keep (e.g. accounting) are anonymised instead: your email is replaced everywhere with an irreversible token, so the records no longer identify you.

For anything else, contact [legal@mitbolas.com]. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EEA, with your local supervisory authority.

7. Cookies and local storage

The platform uses only what is technically necessary: your browser's local storage holds your session token so you stay signed in. There are no advertising or analytics cookies and no third-party tracking — which is why there is no cookie banner.

8. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to authorised staff. Chapter content delivered to readers carries per-reader watermarks to deter redistribution.

9. Changes

We will update this policy as the platform evolves and show the date above. Material changes will be announced on the platform.