Legal

Privacy policy

Last updated October 15, 2026

Who we are

Inkvert (inkvert.com) is run by [Company legal name], [Postal address] (“we”, “us”). We are the controller of the personal data described here. Questions and requests: support@inkvert.com.

What we collect

• Documents and text you give us. The files you upload or the text you paste, the text we extract from them, the documents we generate, and your edits, styles, brand kit (name, logo, colours, fonts) and cover images.
• Account details. Your email address and, if you sign in with Google, your Google account’s name, email and profile picture. Every visitor also gets an anonymous session identifier, so a document can be saved before you create an account.
• Purchases. What you bought, when, the amount and your subscription status. Card and billing details go to Polar, our payment provider; we never see or store your card number.
• Usage and device data. Pages visited, buttons used, errors, the ad or link that brought you here (UTM tags, ad click IDs, referrer), browser and device type, your approximate country, and your IP address (used for security and rate limits). See Analytics for how this differs by region.
• Messages. What you send us when you ask for help or a refund.

How we use it, and why we’re allowed to

• To provide the service (contract): read your document, generate and render the formats you choose, store them in your account, produce downloads and flipbooks, sign you in, and deliver what you paid for.
• To take payments and keep records (contract and legal obligation): orders, receipts, refunds, tax and accounting.
• To keep Inkvert safe (legitimate interest): rate limits per IP address, abuse and fraud prevention, and debugging errors.
• To understand and improve Inkvert (legitimate interest; consent where the law requires it): product analytics, measuring which ads and pages lead to purchases.
• To send emails you asked for: sign-in links, receipts, and a copy of your preview link if you request one. We don’t send marketing email without your permission.

How your documents are processed

When you upload a file it is read on our servers to extract its text. Files larger than 4 MB are first uploaded to private storage on Vercel Blob and deleted as soon as they have been read. Scanned pages and photos of pages are sent to Mistral AI for text recognition (OCR); the file is deleted from Mistral as soon as it has been read.

The extracted text is then sent to an AI model, currently Anthropic’s Claude, through Vercel AI Gateway, which restructures and rewrites it for the formats you chose. These providers process your text only to return a result to us; under their terms for business API customers they don’t use it to train their models. Neither do we.

Generated documents are stored in your account (Google Firebase) so you can re-download, restyle and edit them. Before you check out, a draft is kept in your browser and, once you start checkout, under your anonymous session.

Flipbooks you publish

If you publish a document as a flipbook, a copy of it is hosted at an unlisted link (inkvert.com/read/…). Anyone with the link can read it, so only publish what you’re happy to share. Flipbooks are marked so search engines don’t index them, and you can remove one at any time from its download or project page, which takes the link offline.

Analytics and cookies

We use PostHog (hosted in the United States) for product analytics: page views, clicks, errors and the steps of the create-and-checkout flow. Analytics requests go through our own domain. What PostHog records depends on where you are, judged from your IP address’s country:

• EU/EEA, UK and Switzerland (and whenever your country can’t be determined): cookieless. Nothing is stored on your device for analytics or advertising, there are no session recordings, and visits aren’t linked to your account or to each other across days: visitors are counted with a hash that is re-salted daily. That’s why you don’t see a cookie banner.
• Everywhere else: PostHog stores an identifier in your browser (a cookie and local storage) to recognise repeat visits, links your activity to your account once you sign in, remembers which ad brought you here, and records session replays (a reconstruction of what happened on screen, with everything typed into form fields masked).

Inkvert also keeps your unfinished draft and chosen plan in your browser’s local storage, and Firebase keeps your sign-in session there. These are needed for the service to work and aren’t used for tracking. We don’t use advertising cookies or pixels today; if we add them, we’ll ask for consent where the law requires it and update this policy first. You can block or delete cookies and local storage in your browser at any time.

Who processes data for us

We share personal data only with providers that run parts of Inkvert for us, and only what each one needs:

• Google (Firebase Authentication and Cloud Firestore): accounts, sign-in (including sign-in emails), your documents and order records.
• Vercel: hosting, server functions, temporary file storage (Vercel Blob), country detection, and Vercel AI Gateway.
• Anthropic (via Vercel AI Gateway): AI generation from your document’s text.
• Mistral AI: text recognition for scanned pages and photos.
• Polar: checkout and payments. Polar is the merchant of record: it sells to you on our behalf, handles payment, sales tax/VAT, invoices and receipts, and processes your billing details as an independent controller under its own privacy policy.
• PostHog: product analytics and session replay, as described above.

We may also disclose data if the law requires it, to protect our rights or users’ safety, or to a buyer if the business is sold (this policy would continue to apply). We don’t sell or rent personal data, and we don’t share it for cross-context behavioural advertising.

International transfers

These providers are mostly based in the United States, so your data may be processed outside your country. Where data leaves the EU/EEA, UK or Switzerland, the transfer relies on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

How long we keep it

• Uploaded files: deleted once their text has been extracted (minutes).
• Your documents, brand kit and account: until you delete them or ask us to delete your account.
• Published flipbooks: until you remove them, or your account is deleted.
• Order and payment records: as long as tax and accounting law requires (typically up to 10 years).
• Rate-limit counters (IP-based): about a day.
• Analytics events and session replays: for PostHog’s retention period on our plan; replays are kept for a limited time and then deleted.

Your rights

Depending on where you live (including under the GDPR, UK GDPR and US state laws such as the CCPA), you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent you gave. Email support@inkvert.com from the address on your account and we’ll answer within 30 days. We won’t treat you differently for using these rights. If you’re in the EU/EEA, UK or Switzerland, you can also complain to your local data protection authority.

Security

Data is encrypted in transit (HTTPS) and at rest with our providers. Your documents are stored per account and readable only by you and our servers; upload links are private, single-purpose and expire after 10 minutes. No system is perfectly secure, and we’ll tell you without undue delay if a breach affects your data.

Children

Inkvert isn’t intended for children under 16, and we don’t knowingly collect their data. If you believe a child has given us personal data, contact us and we’ll delete it.

Changes to this policy

We’ll update this page when our practices or providers change and revise the date at the top. For material changes we’ll also let account holders know by email or in the app.

Contact

[Company legal name]
[Postal address]
support@inkvert.com

See also our terms of service.