Privacy Policy

1. The short version

Ordinary Standard text conversion can be used without an account. Scan recovery, OCR, Pro conversion, and translation use an account and prepaid credits. We don't run analytics, use advertising cookies, or have advertising partners. Your uploaded file is processed to produce your book. Files for signed-in users may be retained with the completed EPUB in the library for repeat downloads for up to 30 days. Account and billing records are kept separately; card details go directly to Stripe and are never stored by us.

2. Who this is

The Service is operated by Tutku Tashkan, who is the data controller for the purposes of UK GDPR. Contact: tashkanbusiness@gmail.com.

3. Your file

When you upload a file, it's written to storage on our server and used only to produce the converted EPUB. It is not routinely reviewed by a person. Ordinary conversions run on our hosting infrastructure. When technical-document recognition is enabled, the PDF may also be sent to Mathpix so formulas, tables, code, images, and reading order can be recovered. The service requests deletion of that remote job after receiving the result. If you choose translation, the book's extractable text is sent to OpenAI for translation into your chosen language. Images and other EPUB assets remain on our server. Translation is optional and requires an account.

Uploaded files and generated books are deleted automatically:

• for anonymous conversions, after download or within 30 minutes of the job finishing;
• for signed-in conversions, after up to 30 days of library availability.

4. Payment data

Payments are handled entirely by Stripe. When you pay, you're taken to Stripe's own checkout, we never receive or store your card number. Stripe passes back the payment and customer references needed to add purchased credits to your account and handle a refund if something goes wrong. See our Terms for when that applies. Stripe's own handling of your payment data is governed by Stripe's Privacy Policy, and Stripe may use your email address to manage checkout and send receipts.

5. Accounts, cookies, and browser storage

If you create or use an account, we store your name, email address, a password hash, essential session records, conversion metadata such as the filename and page counts, and any Stripe customer references. A credit ledger records the one-time welcome grant, purchases, reservations, usage, and returned credits so the balance remains accurate. We do not store your password itself. This data is held in PostgreSQL until the account is deleted or the record is no longer needed for legal, billing, security, or dispute purposes.

A signed-in session uses an essential, secure HTTP-only cookie. It is used for authentication, not tracking or advertising. The browser also stores:

• your light/dark theme preference, so it's remembered on your next visit;
• while you are buying credits for a waiting conversion, the waiting job identifier and its conversion choices, so the job can resume after Stripe returns you to the site. This is removed when that job starts.

Those local items stay in your browser and are separate from the account session cookie.

6. IP address

Like any web server, ours sees the IP address a request comes from. We use it only to apply a rate limit (capping how many conversions one address can start in a 15-minute window, to stop the service being overloaded), held in memory and reset automatically, we don't log or store it beyond that. Our hosting provider may separately retain standard connection logs for security and reliability, under its own policies.

7. Where data goes

The Service runs on infrastructure that may be located outside your own country. Railway hosts the application, PostgreSQL stores account records, Stripe processes credit-pack payments, Mathpix may process technical PDFs, and OpenAI processes text when you choose translation, as described above. These providers may process data internationally under their own data-protection terms.

8. Your rights

Under UK GDPR you can ask what personal data we hold about you, ask us to correct or delete it, or object to how it's used. To exercise those rights or request account deletion, contact tashkanbusiness@gmail.com from the account email address. For a billing question, include the payment reference from your receipt. You can also complain to the Information Commissioner's Office (ico.org.uk) if you think we've got something wrong.

9. Children

The Service isn't directed at children and we don't knowingly collect account data from children.

10. Changes to this policy

If this policy changes, the date at the top will change with it. Material changes will be made obvious on the site itself.

11. Contact

Questions about this policy: tashkanbusiness@gmail.com.