Coffeescribe is operated by 7sumcreations LLC, a Wyoming limited liability company with registered address at 1309 Coffeen Ave, Suite 1200, Sheridan, Wyoming 82801, USA ("Company", "we", "our", "us"), which is the data controller for personal information collected through the Service. "Coffeescribe" is a trade name (DBA) of 7sumcreations LLC. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered book creation platform. Please read this policy carefully to understand our practices regarding your personal data.
We never sell your personal data. We never share personal data with third parties for their own marketing purposes.
We use your information for the following purposes:
We do not train AI models on your content.Your prompts, your books, your research notes, and your uploaded documents are never used to train our own models or any third-party model on our behalf. If we ever decide to offer an opt-in option to use de-identified content for training future versions of our own models, we will give active users advance notice and an explicit opt-in — nothing changes without your consent.
Separately, when you send a prompt to an AI model via Coffeescribe, the prompt is forwarded to our AI provider (OpenRouter) for processing. OpenRouter and the underlying model provider may, depending on the model and tier you select, use prompts for their own training — see the OpenRouter section below for details. This is independent of Coffeescribe and governed by their privacy policy.
We use the following third-party services to operate Coffeescribe:
Database hosting, authentication, and file storage. Your account data, books, and preferences are stored securely on Supabase infrastructure.
Supabase Privacy Policy →AI model routing and inference. Your prompts and book content are processed through OpenRouter to generate AI content. Free tier prompts may be used for model training by underlying providers. Paid tier prompts are not shared for training. When you enable Web Search for a scribe, OpenRouter's web search plugin queries third-party search providers and returns source URLs and titles, which Coffeescribe stores as citations. Clicking a citation opens the third-party URL in a new tab — we do not proxy or auto-fetch these URLs on your behalf.
OpenRouter Privacy Policy →Payment processing for subscriptions and one-time purchases. When you subscribe, Paddle receives your name, email address, and payment information to process transactions. Paddle acts as Merchant of Record — we never receive or store your payment card details.
Paddle Privacy Policy →Optical character recognition for scanned PDFs uploaded via Scribe Conversion. When you upload a PDF that contains no embedded text (a scan or image-only PDF), we send the page images to Mistral's OCR API to extract the text. Mistral receives only the file bytes of your upload — no account information, no email, and nothing else. The OCR cost is billed to your token allowance and is shown in the cost preview before you commit. We do not send Mistral any content from your already-created scribes, your research, your notes, or any other part of your account.
Mistral Privacy Policy →Web scraping and data extraction for Research Mode. When you extract YouTube transcripts or scrape web pages in a Cafe, the URL is sent to Apify for content extraction. No personal data is shared — only the URL you provide.
Apify Privacy Policy →Academic paper search for Research Mode. When you search for academic papers in a Cafe, your search query is sent to the selected academic database. We support three sources — all free and open:
No personal data is shared with any of these services.
Your uploaded documents, notebook imports, and curated Serving Tray notes are stored only on our servers — the original files and notes themselves are never sent to external services. Text extraction (PDF, DOCX) and embedding vector generation both run entirely on our servers using an open-source model. However, when you actively use a feature that needs an external AI service, the following limited extracts are sent out:
Transactional email delivery (SMTP relay). Resend is the email provider behind Supabase Auth — it sends signup verification codes, password reset codes, and any future transactional emails (e.g. account notifications) to your inbox. When Coffeescribe needs to email you a 6-digit code, your email address and the code itself are passed to Resend so it can route the message to your mail server. We do not use Resend for marketing or product newsletters. Resend retains delivery logs (sender, recipient, subject, timestamp, delivery status) for approximately 30 days for deliverability and abuse-prevention purposes; message bodies are not retained beyond what is needed to deliver the message.
Resend Privacy Policy →Web hosting and serverless functions. Our application is hosted on Vercel's infrastructure, which may collect access logs and analytics.
Vercel Privacy Policy →We retain your data for as long as necessary to provide our services:
| Data Type | Retention Period |
|---|---|
| Account Data | Until you delete your account |
| Book Content (private) | Until you delete the book or account |
| Book Content (public) | Retained in library on account deletion, re-attributed to "Deleted User" |
| Deleted Book Snapshots | Up to 90 days, then automatically and permanently purged |
| AI Generation Logs | Indefinite (billing audit trail) |
| Token Transactions | Indefinite (billing audit trail) |
| Audiobook Playback Position | Until you delete the scribe or account |
| Imported Source Files (Scribe Conversion) | Deleted after successful conversion (or after 7 days for abandoned uploads) |
| Publish-Consent Timestamps (Imports) | Retained for as long as the imported scribe is published, plus 90 days after take-down (audit trail) |
| Email Delivery Logs (Resend) | ~30 days (sender, recipient, subject, timestamp, delivery status — message bodies not retained beyond delivery) |
| Hosting Logs | Per Vercel/Supabase policies |
Account Data
Until you delete your account
Book Content (private)
Until you delete the book or account
Book Content (public)
Retained in library on account deletion, re-attributed to "Deleted User"
Deleted Book Snapshots
Up to 90 days, then automatically and permanently purged
AI Generation Logs
Indefinite (billing audit trail)
Token Transactions
Indefinite (billing audit trail)
Audiobook Playback Position
Until you delete the scribe or account
Imported Source Files (Scribe Conversion)
Deleted after successful conversion (or after 7 days for abandoned uploads)
Publish-Consent Timestamps (Imports)
Retained for as long as the imported scribe is published, plus 90 days after take-down (audit trail)
Email Delivery Logs (Resend)
~30 days (sender, recipient, subject, timestamp, delivery status — message bodies not retained beyond delivery)
Hosting Logs
Per Vercel/Supabase policies
After account deletion, we may retain anonymised, aggregated usage statistics for analytics purposes.
Depending on your location, you may have the following rights regarding your personal data:
We implement appropriate security measures to protect your data:
While we take security seriously, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.
Coffeescribe is not intended for children under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children under these ages. If you believe we have collected information from a child, please contact us immediately at billing@coffeescribe.ai so we can delete the data.
Your data may be processed in countries outside your residence, including the United States and other countries where our service providers operate. These countries may have different data protection laws. By using our service, you consent to the transfer of your data to these countries. We ensure appropriate safeguards are in place with our service providers.
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we may notify you via email or a prominent notice on our platform. Continued use of the service after changes constitutes acceptance of the updated policy.
For privacy-related inquiries, data requests, or to exercise your rights:
For data protection inquiries in the EU, you may also contact your local data protection authority.
This Privacy Policy should be read alongside our Terms of Service and AI Content Policy.