This is a translation for your convenience. Only the German version is legally binding.
This policy describes which personal data we process when you visit our website or use the Authorial suite, and why. It is structured according to the areas of the product: website, user account, your content, payment, email sending, Newsletter module, AI functions and the modules that establish connections to third-party providers.
Two roles need to be distinguished here. We are responsible for your user account and your content. For the data that you yourself process in Authorial, such as your newsletter subscribers or your blogger contacts, you are responsible, and we act on your behalf (see section 9).
Stefan Achter
Weichselbaum 8, 82234 Weßling
Email: mail@authorial.eu
For data protection matters, you can reach us at legal@authorial.eu. No data protection officer has been appointed; the requirements of § 38 BDSG are not currently met.
We process personal data on the basis of Art. 6(1)(b) GDPR (performance of the contract of use), Art. 6(1)(c) GDPR (legal obligations, such as tax retention), Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning and economically operated service) and Art. 6(1)(a) GDPR (consent, in particular for audience measurement). Where consent is the basis, we say so explicitly at the relevant point.
We store personal data for as long as your account exists and the respective purpose continues to apply. We then delete it unless a statutory retention period prevents this (in particular six or ten years under § 257 HGB and § 147 AO for invoices and accounting records). We state any deviating periods for the respective processing operations.
The website and the suite are delivered exclusively via HTTPS. We never store passwords in plain text, but as a bcrypt hash. We store access tokens for connected advertising accounts in encrypted form (AES-256-GCM).
Some of the service providers we use are based in the USA. Transfers are based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where the respective provider is certified, the EU-US Data Privacy Framework (adequacy decision of 10 July 2023). Section 13 lists which services are affected.
When you access our pages, the hosting provider automatically collects information transmitted by your browser: browser type and version, operating system, referrer URL, host name, time of the request and IP address. This data is necessary for delivering the pages and defending against attacks (Art. 6(1)(f) GDPR). It is not combined with other data sources.
Without your consent, we only set technically necessary cookies (§ 25(2) no. 2 TDDDG):
authorial_consent and authorial_consent_v2: store your cookie decision (overall and per category), lifetime 180 days, so that we don't ask you again on every visit.auth_token: your login token in the logged-in area, lifetime 7 days, sent exclusively via HTTPS and not readable by JavaScript.aa_aktiv and aa_abmeldung: the time of your last activity and the time you have chosen until automatic logout. We use these to log you out of all open tabs after a longer period of inactivity; the cookies contain no other information.lese_zugang_…: only set when you open a password-protected reading link, and remembers for that one link that you have already entered the password.zertifikat_…: access to a writing process certificate (see section 6).We only use optional cookies and connections (audience measurement, external images and icons) with your consent under § 25(1) TDDDG. We ask you for this on your first visit to the website and on the login and registration pages; "Reject all" and "Accept all" are given equal weight. You can change or withdraw your choice at any time: via the Cookie settings link in the footer of the website and the login page, and in the suite under Einstellungen → Cookies & Datenschutz (Settings → Cookies & privacy).
We store some settings in your browser's local storage (localStorage) so that the interface stays the way you set it up, such as a collapsed sidebar, the selected view, column widths, language or the mode of the writing module. This information does not leave your browser.
To protect against text loss, the manuscript editor also first saves every change locally in your browser (key sw:entwurf:…) until it has safely reached our server, for example if your internet connection drops briefly. As soon as the server has confirmed the version, the local draft is deleted again. On shared devices you should therefore log out and not leave any unsaved changes behind.
The legal basis is § 25(2) no. 2 TDDDG (strictly necessary for the service you have requested) and Art. 6(1)(b) GDPR.
We serve all fonts from our own servers: on the website, in the logged-in area, on newsletter landing pages and in embedded sign-up forms. Your browser does not connect to Google Fonts or any other third-party provider for this, and no IP address is transmitted to third parties. The fonts offered are licensed under the SIL Open Font License and are stored as copies on our servers.
If you email us or send us feedback via the built-in feedback function, we process your details in order to handle your request (Art. 6(1)(b) or (f) GDPR).
Contact form. Via the contact form you send us your name, your email address, the subject you have chosen and your message. We use this information exclusively to answer your enquiry (Art. 6(1)(b) GDPR where it concerns a contract or its initiation, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries). The message is not stored in our database but is forwarded by email via Scaleway Transactional Email (Scaleway SAS, France; processing in the EU, see section 8) to our mailbox; you receive a short confirmation of receipt without a copy of your message. We keep the correspondence there for as long as necessary to handle it and answer any follow-up questions, and then delete it unless there is a statutory retention obligation. To protect against misuse, we count enquiries per IP address and email address for a maximum of one hour; beyond that, the IP address is not stored.
Waiting list (Early Access). For the waiting list we only need your email address. We use the double opt-in procedure: after you sign up, we send you an email with a confirmation link that is valid for seven days. Only once you confirm your sign-up there are you on the waiting list. We store your email address, the time of sign-up and confirmation, and the place on the website where you signed up. If you do not confirm within seven days, we automatically delete the unconfirmed entry. We do not store your IP address or browser identifier; to protect against misuse, we merely count sign-ups per IP address (one hour) and per email address (24 hours) for a short time. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure at your request) or Art. 6(1)(f) GDPR (proof that the sign-up came from you). We delete your entry as soon as you unsubscribe (a short message to mail@authorial.eu is enough) or Early Access has ended.
On the website we use Google Analytics 4 (Google Ireland Limited), but only after you have given your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Before that, no Google script is loaded and no request is sent to Google. After consent, Google Analytics sets cookies (including _ga, _ga_<ID>) and processes the pages viewed, time spent, approximate location, device type and the truncated IP address.
We use Google Consent Mode v2 with the default setting "denied"; advertising features (Google Signals, remarketing) are permanently deactivated. A transfer to Google LLC in the USA cannot be ruled out; this is based on the standard contractual clauses and Google LLC's certification under the EU-US Data Privacy Framework. If you withdraw consent via the Cookie settings, we delete the Analytics cookies already set. You can find more information in Google's privacy policy.
In the logged-in area the same applies: we only measure if you have given your consent. Your decision applies to the website and the suite together. If you have not yet decided, we ask you on the login or registration page; until then, no measurement takes place. Agreeing to this privacy policy or to the terms and conditions does not constitute consent to measurement. You can withdraw your consent at any time in the suite under Einstellungen → Cookies & Datenschutz (Settings → Cookies & privacy) or via the Cookie settings in the footer.
For your account we process: first name and surname, email address, password hash, account type (author or blogger), booked plan, role, time of registration and last login and, where you provide them, pen name, telephone number, website and social media profiles. The legal basis is Art. 6(1)(b) GDPR.
To prove your consent to the terms and conditions and privacy policy, we store the time and the version of the legal texts (Art. 5(2), Art. 7(1) GDPR).
You can change your email address in the settings. To do so, we send a confirmation link to the new address and a notice to the previous one. Only after confirmation do you log in with the new address. The original address remains stored internally as an identifier for your account so that your projects and data stay assigned to it; we no longer use it for logging in or for messages to you. It is also deleted when your account is deleted.
If you activate two-factor login, we store the secret required for this in your account record. To protect against automated password guessing, we temporarily store the number of failed login attempts per account and per IP address; these counters expire after 15 minutes (Art. 6(1)(f) GDPR, Art. 32 GDPR).
As long as you do not upload your own profile picture, we display an automatically generated default avatar from the DiceBear service. Your browser retrieves it directly from dicebear.com and transmits your IP address in the process. To ensure the image is always the same, we only pass on a hash value from which your email address cannot be derived. If you also want to avoid the connection, upload your own profile picture.
We process what you create in Authorial in order to provide the service (Art. 6(1)(b) GDPR): book projects, chapters and manuscript texts, notes, characters, annotations and frozen versions; storyboard content; book lists and ranking histories; posts in the Community forum and comments; social media drafts and schedules; blogger and contact lists.
Manuscript texts only go to third parties if you trigger a function for this. The ongoing spelling and style check while you write takes place on a server we operate ourselves in the EU (section 12). If you expressly commission AI proofreading, AI editing or an AI translation, we transmit the chapters concerned section by section to our AI service provider Anthropic (USA). Details can be found in section 10. Without such a request, your manuscripts do not leave our infrastructure.
If you share a chapter via a reading link, anyone with this link can read the shared text without logging in. You can revoke reading links at any time.
Posts in the Community forum are visible to other logged-in users and are linked to your name or pen name. If you delete your account, the posts are retained but anonymised.
So that you can show publishers, agencies or platforms how your manuscript came about, Authorial keeps a log of your writing process in the manuscript editor. It records only metrics, never your text: how many characters you typed, deleted or corrected, the number and length of insertions (distinguished between "from your own manuscript" and "from outside"), keystrokes per minute, active writing time and timestamps. For the naturalness check, characteristics of typing behaviour are added, likewise only as counts: the intervals between keystrokes (summarised as a distribution, not which key was pressed), thinking pauses, immediately corrected typos, jumps to other places in the text, switching to another window while writing, characters without a preceding keystroke and keyboard events flagged by the browser as not genuine. On the server side, we also record imports, project copies, submissions for proofreading and editing (by AI or to service providers), accepted suggestions together with their origin, and AI translations. The entries are chained with checksums and cannot subsequently be changed by you or by us.
If you issue a certificate, we additionally freeze the current version of your manuscript and store checksums of its paragraphs. The certificate receives an unguessable verification code and is protected by access credentials that you set when issuing it: the recipient's email address (e.g. the publisher's) and a password. We store this email address and the password only as a hash, exclusively for checking access. Anyone who logs in at authorial.eu/nachweis/<verification-code> with these access credentials sees the certificate with the title, your name or pen name and the evaluation of the writing process and can download the frozen manuscript, as long as you do not switch off the download. After login, we set a technically necessary cookie (zertifikat_…, valid for 7 days) that only stores this access. Anyone who uploads a manuscript file to compare it with the certificate transmits it only for a one-off check; we do not store it. You can switch off the manuscript download for each certificate at any time.
The legal basis is Art. 6(1)(b) GDPR; the log is part of the "Certificate" function that you use in the writing module. We use the data exclusively for this proof, not for monitoring performance or behaviour and not for advertising. Logs and certificates are stored for as long as your account exists, so that certificates already passed on remain verifiable; when your account is deleted, they are deleted completely, and verification links already issued no longer work. The certificate is an indication of a working process in Authorial, not proof of authorship.
We store uploaded files (profile pictures, covers, attachments) in our hosting provider's object storage. They can be accessed via an unguessable address; anyone who knows this address can open the file. So don't upload any content there that must under no circumstances fall into the wrong hands.
We bill paid plans via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, for users in the EEA; parent company Stripe, Inc., USA). You enter your payment details, such as card details, directly with Stripe; we neither see nor store them. We only hold your Stripe customer and subscription ID, the booked plan and its term.
The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR for the tax retention obligations. Invoice and payment data are therefore retained for the statutory periods even after an account is deleted. You can find more information in Stripe's privacy notice.
Once the affiliate programme has launched, the following applies to participation and referrals:
As a partner: For activation, billing and payout, we process your account data, your country of residence or registered office, an optionally specified advertising channel, proof of your consent to the terms of participation (time and version), your billing address, tax details (e.g. tax number, VAT ID, VAT status) and your bank details. We store the IBAN in encrypted form and only display the last four digits. For the payout, we transmit your name and IBAN to our bank Qonto (Qonto SA, France), which, as required by law, checks before every transfer whether the name and account match (verification of payee). The legal basis is Art. 6(1)(b) GDPR; we keep billing records, commission entries and payouts for up to ten years in accordance with Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB, even after an account is deleted.
As a referred person: If you open a referral link, we store a random click code, the time and the associated partner, but no IP address and no device fingerprint. We only set the cookie authorial_ref, which keeps the click in your browser for up to 60 days, with your consent in the "Referrals" category (Art. 6(1)(a) GDPR, § 25(1) TDDDG); without consent, the website only passes the code on to sign-up or the waiting list within the current visit, or you enter the referral code yourself. When the account is created, we store the attribution to the partner in order to grant you the new-customer discount and calculate the commission (Art. 6(1)(b) GDPR). To prevent misuse, we compare an irreversible check value of your payment method, generated with a secret key, with the partners' bank details (Art. 6(1)(f) GDPR). The partner learns neither your name nor your email address; they only see an anonymous identifier and the commission amount. We delete click codes after the 60 days have expired.
We send all messages relating to your account (invitation, password reset, confirmation of a new email address, waiting list confirmation links, replies and confirmations of receipt for the contact form, cancellation confirmations, notifications from the writing module and the anti-piracy module) via Scaleway Transactional Email (Scaleway SAS, France; processing in the EU). Your email address and the content of the respective message are transmitted, not your manuscript texts. The legal basis is Art. 6(1)(b) GDPR.
For sending newsletters from the Newsletter module, we use Scaleway Transactional Email or your own SMTP access that you have stored. For sender domains that were connected before the switch to Scaleway, Resend (Resend, Inc., USA) may still be used temporarily; transfers to the USA are then based on the standard contractual clauses.
If you use the Newsletter module, you remain the controller for your recipients' data. We process this data exclusively in accordance with your instructions as a processor within the meaning of Art. 28 GDPR. We will provide you with a data processing agreement on request at legal@authorial.eu.
On your behalf we process: email addresses and names of your subscribers, custom fields you define, subscription status and time of double opt-in confirmation, unsubscribes, and open and click statistics for your campaigns. The unsubscribe, confirmation and statistics links in your emails are cryptographically signed so that they cannot be forged by third parties.
If you import an existing recipient list, we fetch it on your instruction from the provider you have chosen; currently possible are Mailchimp, Brevo, CleverReach, MailerLite, GetResponse, KlickTipp, Mailjet, rapidmail/emailsys and HubSpot. You are responsible for the lawfulness of the import and for valid consent from the imported persons.
For the following functions, you are supported by an AI language model from Anthropic (Anthropic PBC, San Francisco, USA). They are labelled as AI functions in the suite and only run when you trigger them yourself:
In each case, only the content needed for the function is transmitted, not your name, your email address or any other account data. We use Anthropic's commercial application programming interface (API); under its contractual terms, the transmitted content is not used to train AI models and is only stored temporarily, in particular for detecting misuse. We ourselves do not use your content to train AI models either.
The legal basis is Art. 6(1)(b) GDPR for the function you trigger. Anthropic is based in the USA; transfers are based on the European Commission's standard contractual clauses. Please do not enter any particularly sensitive information in the help chat or text suggestions. If your manuscript contains information about real people, you are responsible for ensuring that you are permitted to process this content.
There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR. AI suggestions are suggestions; the decision remains yours.
Several modules retrieve data from third parties or transfer data to them at your request. These connections only exist if you use the respective module or connect an account.
While you write in the manuscript editor, Authorial checks your text for spelling, grammar, punctuation and style. To do this, after a short pause in typing, the paragraphs of the currently open chapter are transmitted to a LanguageTool server that we operate ourselves, running on an instance of Scaleway SAS in the European Union. The server processes the text exclusively in memory to generate notes and correction suggestions; it does not store or log any content. Only the text itself is transmitted, not your name, your email address or details of your account. The transmission is encrypted and protected by an access secret. If the server cannot be reached or you have switched off the check in the editor settings, the spell check takes place entirely in your browser without any text being transmitted. The legal basis is Art. 6(1)(b) GDPR; the check is part of the writing function you use.
If you book a review by a person instead of by the built-in text check, the professional handling it gets access to the version of your manuscript you submitted, limited to the scope you have chosen and for the duration of the work. These persons are contractually bound to confidentiality and to compliance with data protection. The legal basis is Art. 6(1)(b) GDPR.
We use the following service providers. Where they process personal data on our behalf, we have data processing agreements with them in accordance with Art. 28 GDPR:
eu-central-1). As it is a US company, access from the USA cannot be ruled out; this is based on the standard contractual clauses.In addition, the platforms named in section 11 receive data if you use the respective modules; in this respect, these providers process the data under their own responsibility. Your data is not passed on for advertising purposes, and we do not sell any data.
In your account settings under "Daten & Konto" (data & account) you will find two functions that you can use yourself at any time:
You can also contact legal@authorial.eu informally with your request.
You are entitled at any time to:
To exercise these rights, an informal message to legal@authorial.eu is sufficient.
We take technical and organisational measures in accordance with Art. 32 GDPR. These include, among others: end-to-end transport encryption, password hashing using a recognised method, optional two-factor login, encryption of sensitive access tokens, strict separation of the data of different accounts, protection against automated password guessing, server-side sanitisation of content against malicious code, and logging of security-relevant events. We review and adapt these measures regularly.
We adapt this privacy policy when the product or the legal situation changes. The version published on this page at any given time is authoritative; the date at the top shows when it was last updated.