Privacy Policy

Overview

KDP Maker ("we", "us") helps creators generate coloring books and paperback diaries for Amazon KDP. The operator of KDP Maker is the controller for the personal data described in this policy. You can contact us at support@kdpmaker.app. This policy explains what we collect, why we use it, who processes it, how long we retain it, and your choices. Payments are processed by Paddle. Use of the Service is also governed by our Terms of Service and Refund Policy.

Information we collect

• Account details: email, name, and authentication data from our sign-in provider.
• Book content: titles, prompts, generated pages, covers, and export files you create in the studio.
• Billing data: subscription status, plan, invoices, and payment outcome processed by Paddle. We do not store full card numbers.
• Usage data: credit balances and generation activity needed to run the Service. Google Analytics 4 and DataFast analytics run automatically for all visitors and signed-in users to measure visits, selected product milestones, and checkout revenue attribution; no opt-in is requested and no analytics opt-out is provided.
• Technical data: IP address and browser information received by analytics providers, plus cookies used for login sessions and analytics attribution.

How we use information

• Provide and improve book creation, editing, and export.
• Process payments, subscriptions, credit balances, and (where applicable) in-app credit returns.
• Send transactional emails (account confirmation, password reset) via our auth provider.
• Prevent abuse, enforce usage limits, and maintain security.

We process account, book, and service data to perform our contract with you; billing and recordkeeping data to meet legal obligations; and limited security, reliability, and fraud-prevention data for our legitimate interests in operating a secure service. Analytics run automatically as described below and are subject to applicable law.

Service providers and recipients

We use service providers to operate the Service: Vercel for hosting and performance measurement; Google Analytics 4 and DataFast for analytics; Supabase for authentication and Postgres data; MongoDB Atlas and Supabase Storage for generated assets where configured; Paddle as merchant of record for payments, invoices, refunds, and chargebacks; Mailtrap and DeoMail for transactional email; and Google Gemini, Vercel AI Gateway, Replicate, or another configured AI provider to process generation requests. These providers process only the information needed to provide their services to us. We do not sell personal information.

AI processing

When you generate content, your prompts and book settings may be sent to third-party AI providers solely to produce your requested output. Do not submit sensitive personal data in prompts. AI output can be inaccurate, may resemble existing works, and must be reviewed by you before publication.

International transfers and security

Our providers may process data in countries other than yours. Where transfer rules apply, we use the provider's applicable contractual, technical, and organizational safeguards. We use access controls, encrypted transport, restricted production credentials, and separate environments to protect service data. No internet service can guarantee absolute security.

Cookies

We use essential cookies for sign-in and session security. Google Analytics 4 and DataFast load automatically for every visitor and may set analytics cookies and receive your IP address and browser information. We do not ask you to opt in, and the Service does not provide an analytics opt-out. With analytics on, we measure page visits, a landing page path, a referring domain and broad source category, and milestones such as sign-up, useful tool completion, checkout, payment, and export. DataFast's visitor and session IDs are passed with Paddle checkout metadata so completed transactions can be attributed to marketing sources. We do not send prompts, book content, uploaded-file names, book IDs, or transaction IDs to GA4. For signed-in users, we also store categorical product milestones in our database to understand the service funnel. Google may process its data outside your country. We do not use advertising cookies.

Data retention

We retain account and book data while your account is active. If you delete your account, we delete the related application records and request deletion of the linked authentication record where configured. We may retain limited transaction, security, and billing records for as long as needed for legal, tax, dispute, fraud-prevention, and Paddle recordkeeping purposes. Backups expire on their normal retention cycle. We use these retention criteria rather than retaining personal data indefinitely.

Your rights

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal data, and to withdraw consent where processing is based on consent. Use Settings → Privacy & data in your studio to download a JSON export or delete your account. To exercise another right, email us from the account email address with the request and enough information for us to verify your identity. We aim to respond within 30 days, or explain if a lawful extension is needed. EU/UK users may also lodge a complaint with their local data protection authority.

Children

The Service is not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

Changes to this policy

We may update this policy as the Service changes. We will post the revised policy here with a new effective date and, for material changes, provide additional notice in the Service or by email where appropriate.

Contact

Questions about this policy: support@kdpmaker.app