Privacy Policy
v1.0 · sha256 7bb73b080271
Version 1.0 · Effective [待填：生效日期]
1. Who we are
This policy explains how [待填：法定主体名称] (ABN [待填：ABN]) (we, us) handles personal information when you use Everyone Reader (the Service). We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where they apply to you, the EU and UK General Data Protection Regulations. For the GDPR we are the controller of your personal data. Contact: privacy@everyonereader.com.
2. What we collect
Account information: email address, display name, country (optional), and a one-way hash of your password (we never store your password itself).
Content: the text you upload, the book and chapter titles you enter, and the audio, projects and subtitles we generate. Your text may itself contain personal information, for example about real people. You must only upload such information lawfully.
Billing information: top-up amounts, currency, dates, payment status and the reference numbers our payment provider (Creem) gives us, plus your billing name, email and country if the provider shares them. We do not receive or store your full card or bank details.
Legal records: each time you accept our Terms or Policies, and each time you make a rights declaration for an upload, we record the document version, the time, your IP address, your browser's user-agent string and (for uploads) a cryptographic fingerprint of the text.
Copyright complaints: if you send a takedown notice or counter-notice, the name, contact details, statements and signature in it.
Technical and security data: IP address, browser and device type, pages requested, sign-in times, failed sign-in attempts and error logs.
Communications: emails and messages you send us.
We do not knowingly collect information from anyone under 18.
3. How we use it, and our legal bases
| Purpose | GDPR legal basis |
|---|---|
| Create and run your account; produce and deliver your chapters | Performance of our contract with you |
| Process top-ups, holds, charges and refunds; keep tax and accounting records | Contract; legal obligation |
| Record your acceptance of the Terms and your rights declarations; handle copyright complaints; prevent and investigate infringement and abuse | Legitimate interests (protecting rights holders and our business); legal obligation |
| Keep the Service secure, detect fraud and fix errors | Legitimate interests |
| Send service emails (verification, password reset, production finished, policy changes) | Contract; legitimate interests |
| Send product news | Your consent, which you can withdraw at any time |
| Comply with law and respond to lawful requests | Legal obligation |
We do not sell or rent personal information. We do not use advertising trackers. We do not use your text or audio to train our own AI models.
4. AI processing and service providers
To produce your audio we send your text, or parts of it, to:
- Anthropic, PBC (United States): analyses the text to identify speakers, write performance directions and check pronunciation;
- ElevenLabs (United States / European Union): generates speech, transcribes the generated speech back to text for quality checks, and generates sound effects and music.
Other service providers we use:
- Cloudflare, Inc.: hosting, databases, file storage and security, on a global network;
- Creem: payment processing and, where applicable, acting as merchant of record;
- an email delivery provider, for service emails.
These providers process information on our behalf, or under their own terms where they act independently (such as payment providers). We choose providers that commit not to use API data to train their models, and we use the most protective data settings available to us.
We may also disclose information:
- to a rights holder, court or authority in connection with an infringement complaint or legal proceedings, as described in our Terms and Copyright & Takedown Policy;
- to professional advisers; or
- to a buyer of our business, who must protect it under this policy.
5. Overseas disclosure
Most of our providers store or process information outside Australia, principally in the United States, the European Union and other countries where Cloudflare operates data centres. We take reasonable steps, including contractual commitments, to ensure overseas recipients protect your information in a way consistent with the Australian Privacy Principles. For transfers out of the EEA or UK, we rely on adequacy decisions or standard contractual clauses.
6. Cookies
We use one essential cookie to keep you signed in. It is set when you sign in and expires after 30 days or when you sign out. We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner. Fonts are loaded from Google Fonts, which receives your IP address when your browser requests them.
7. How long we keep information
| Information | Kept for |
|---|---|
| Your text, audio, projects and subtitles | Until you delete them or your account; removed from live systems within 30 days and from backups within a further 30 days |
| Account information | While your account is open; deleted or anonymised within 30 days of account deletion |
| Payment, credit and ledger records | At least 5 years after the transaction, as required by Australian tax law |
| Acceptance records, rights declarations, takedown notices and related evidence | Up to 7 years, to establish or defend legal claims |
| Security logs | Up to 12 months |
Material removed after a valid infringement complaint may be kept in restricted storage as evidence for the same period.
8. Security
Passwords are stored as salted, slow one-way hashes. All traffic is encrypted in transit; data is encrypted at rest by our hosting provider. Access to production systems is limited to people who need it. No system is perfectly secure. If a data breach is likely to result in serious harm, we will notify you and the regulator as the law requires.
9. Your rights
You can:
- access and correct your information in your account settings, or by emailing us;
- export your account data from your account settings;
- delete your account in your account settings. This erases your content and personal information, subject to the retention periods in section 7;
- withdraw consent to marketing at any time;
- if the GDPR applies, also object to or restrict processing based on legitimate interests and port your data.
We respond within 30 days. We may need to verify your identity first.
10. Complaints
Please contact privacy@everyonereader.com first; we will respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EEA or UK, to your local data-protection authority.
11. Changes
We will post updates here and notify you of material changes by email or on the Service.
12. Contact
[待填：法定主体名称] · [待填：营业地址] · privacy@everyonereader.com