Privacy Policy
Last updated: 2026-09-23
1. Who is responsible
Publyo is operated by Paris Group. For any privacy request — access, correction, export, deletion, or a question about this policy — write to ops@parisgroup.ai. We answer within the deadlines set by the LGPD (Lei 13.709/2018) and, where it applies, the GDPR.
2. What we collect
- Account data — name, email address, hashed password, plan, locale and preferences. Accounts created through Google or GitHub also carry the identifiers those providers return.
- Your content — the books, chapters, briefs and covers you create, plus their revision history.
- Source material you provide — text you paste, documents you upload (
.pdf,.docx,.md,.txt) and audio you record or upload when you dictate a book. - Billing identifiers — the Stripe customer, subscription and payment identifiers tied to your account. We never see or store card numbers.
- Usage and diagnostics — server-side product events (for example: a book was created, a chapter was generated, a checkout was opened), request logs, and the per-account record of AI generations used, which is what enforces your plan's monthly allowance.
3. How we use it
To run the service: authenticating you, storing and rendering your books, generating and reviewing content with AI, transcribing audio you submit, producing covers, exporting EPUB files, processing payments, sending transactional email (password reset, magic link, receipts), enforcing plan limits, and understanding which parts of the product people actually finish. We do not sell your data and we do not use it for advertising.
4. Third parties that process your data
Publyo cannot work without sending parts of your data to the providers below. Each one processes it only to deliver its piece of the service.
| Provider | What we send | Why |
|---|---|---|
| Anthropic | Book context: your brief, source material and chapter text | Generating and reviewing chapters, briefs and listing copy |
| xAI | Cover prompt derived from your book's title, genre and brief | Generating illustrated covers (typographic covers stay on our servers) |
| OpenAI or Deepgram | The audio recording you submit | Speech-to-text, only when you use dictation |
| Stripe | Your email and billing identifiers; card data goes to Stripe directly | Subscriptions and one-time purchases |
| PostHog | Product events keyed to your account identifier | Product analytics (optional — disabled when unconfigured) |
| Email provider | Your email address and the message body | Transactional email only. No marketing without separate consent |
| Railway | Everything above, at rest and in transit | Application and database hosting |
We do not authorise any of these providers to train their models on your private book content. PDF, DOCX and plain-text files are parsed on our own servers; only the extracted text continues to the AI provider.
5. International transfers
The providers above operate outside Brazil, so using Publyo involves transferring your data internationally. Those transfers rely on the contractual safeguards each provider offers (LGPD art. 33; GDPR Chapter V where it applies).
6. Payments
Both the Pro subscription and the one-time per-book purchase are processed by Stripe. We store customer, subscription and entitlement identifiers — never card details. Stripe's own privacy policy governs how it handles payment data.
7. Retention
- Account, books and chapters — kept while your account is active. Deleting your account removes them, together with their revision history, and cancels any active subscription.
- Uploaded documents and audio — kept as the source material of the book they belong to, and deleted with it. Transcripts are stored as part of your book. Retention at the transcription provider is governed by that provider.
- Billing and AI-usage records — kept after account deletion only as long as tax, accounting and anti-fraud obligations require.
8. Your rights
Under the LGPD (and the GDPR where it applies) you may confirm that we process your data, access it, correct it, export it in a portable format, ask for deletion or anonymisation, learn with whom we share it, and withdraw consent where processing rests on consent. You may also complain to the ANPD. Delete your account from Settings at any time, or write to ops@parisgroup.ai.
9. Security
Passwords are hashed with bcrypt. Access to your books is restricted to your authenticated account, and API sessions can be revoked. Traffic is encrypted in transit. No system is perfectly secure; we will notify you and the ANPD of an incident that presents a relevant risk, as the LGPD requires.
10. Children
Publyo is not intended for children under 16, and we do not knowingly collect their data.
11. Changes to this policy
When this policy changes materially we update the date at the top and, for changes that affect your rights, notify you by email before they take effect.
12. Authoritative language
Publyo's interface is available in several languages. This policy is maintained only in English, and the English text is the authoritative version. Any translation offered is a courtesy and does not change the meaning of this text.
13. Contact
ops@parisgroup.ai — privacy requests and questions about this policy.