Join the waitlist

Privacy Policy

Effective date: 26 July 2026

Pubblish ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our publishing platform service.

Pubblish is operated by Pubblish Limited, a company registered in England and Wales under company number 17089255. Pubblish Limited is the data controller for personal data about our direct customers (the people who hold Pubblish accounts) and for visitors to pubblish.com, and can be contacted at [email protected].

Where you upload personal data about other people — authors, contributors, and other individuals connected to your titles — you are the data controller for that data and Pubblish acts as a data processor on your behalf. This relationship is set out in Section 7 of our Terms of Service.

1. Information We Collect

Account Information. When you create an account, we collect:

  • Email address
  • Name
  • Password (stored hashed, never in plain text)
  • Publisher/company name

Content Data. We store the content you create and upload, including:

  • Book and publication metadata
  • Author and contributor information
  • Cover images and assets
  • Workflow and task data

Usage Information. We automatically collect certain information when you use our service, including:

  • Log data (IP address, browser type, pages visited)
  • Device information
  • Usage patterns and feature interactions

Support correspondence. Anything you send to us by email or other support channels.

2. How We Use Your Information

We use your information to:

  • Provide and maintain our service
  • Process your transactions and manage your subscription
  • Send you important service updates and notifications
  • Respond to your inquiries and provide customer support
  • Provide AI-assisted content suggestions where you choose to use those features
  • Improve and optimize our platform
  • Detect and prevent fraud or abuse

3. Our Lawful Basis for Processing

Under UK data protection law we must have a lawful basis for processing your personal data. We rely on the following:

  • Performance of a contract — we process your account information and the content you upload in order to provide the Pubblish service you have signed up for.
  • Legitimate interests — we process usage and log data to keep the service secure, prevent fraud and abuse, and improve the platform. We balance these interests against your rights and freedoms.
  • Legal obligation — we process and retain certain data where the law requires it, for example for tax and accounting purposes.
  • Consent — where we rely on your consent, such as for optional marketing emails, you may withdraw it at any time.

We do not make any automated decisions that produce legal or similarly significant effects about you. AI features only generate suggestions for you to accept, edit, or discard.

4. AI-Assisted Features

Some Pubblish features use a third-party large language model to generate text suggestions. The current provider is Anthropic. When you use these features:

  • Only the text or metadata you submit for that specific feature is sent to the provider.
  • The provider retains inputs and outputs for up to 30 days for abuse detection purposes, and does not use them to train its models.
  • These features are opt-in. If you do not use them, no data is sent to the AI provider.

If we change AI provider or materially change how AI features work, we will update this policy and notify active users.

5. Data Storage and Security

Your data is stored securely. Measures include:

  • TLS encryption for all data in transit
  • Encryption at rest for the database and stored assets
  • Strict tenant isolation: each publisher's data lives in a separate PostgreSQL schema
  • Hashed passwords using current best-practice algorithms
  • Role-based access controls within each customer account
  • Regular dependency updates and security patching
  • Restricted, audited administrative access

No system is perfectly secure. If we discover a personal data breach, we will notify the Information Commissioner's Office within 72 hours where required by law, and notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

6. How We Share Your Information

We do not sell your personal information and we do not share it for advertising. We share it only in the following circumstances:

  • Payment processing — payments are handled by Paddle.com, who act as the merchant of record for Pubblish subscriptions. Paddle processes your payment data as an independent controller under its own privacy notice. Pubblish never sees or stores your card details.
  • Service providers — we use a small number of trusted third parties to operate the platform, under contracts that require them to protect your data and use it only on our instructions:
    • Render — cloud hosting and database infrastructure
    • Cloudflare — DNS, asset storage (R2), email routing, and custom domain proxying for the platform
    • Postmark — delivery of transactional and account emails
    • Sentry — error monitoring, so we can detect and fix faults; configured not to send account details, though an error report can include fragments of the data being processed when a fault occurs
    • Anthropic — when you choose to use our AI-assisted content features (see Section 4)
  • Legal compliance — where we are required to share data to comply with the law, or to protect our rights and prevent fraud.
  • With your consent — in any other case, only with your agreement.

7. International Data Transfers

Some of our service providers are based outside the United Kingdom, including in the United States. Where your personal data is transferred outside the UK, we ensure it is protected by appropriate safeguards — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU-US Data Privacy Framework.

8. Your Rights

Under UK data protection law you have the right to:

  • Access the personal data we hold about you
  • Ask us to correct inaccurate or incomplete data
  • Ask us to delete your data
  • Receive your data in a portable format
  • Object to processing based on our legitimate interests
  • Ask us to restrict processing of your data
  • Withdraw consent for any processing based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

  • Active account and content data — while your account is active.
  • Account and content data after closure or abandonment — your workspace is retained in a read-only state for 90 days, during which you can still log in to read and export your data. After that it is permanently deleted from our production systems. A single export snapshot is then held in secure off-platform storage for a further 90 days, after which it too is permanently deleted.
  • Inactive or abandoned workspaces — if your trial ends without a subscription, or a paid subscription lapses, we move the workspace to the read-only state described above. It is retained for the 90-day grace period — during which you can still log in to read and export your data — and is then deleted if you have not reactivated it.
  • Billing and tax records — 6 years from the end of the relevant financial year, as required by UK tax law.
  • Server and application logs — up to 14 days (provided by our hosting infrastructure).
  • Disaster-recovery backups — full-database backups are held in secure off-platform storage on a rolling basis of around 30 days for disaster-recovery purposes. A deleted workspace may persist in these routine backups until they age out of the rotation.
  • Support correspondence — for the duration of your account plus a reasonable period afterwards.

10. Cookies

We use essential cookies to enable core functionality such as authentication and session management. We do not use tracking cookies or third-party advertising cookies. Paddle's checkout and Cloudflare's bot protection may set their own essential cookies during specific actions; these are governed by their respective privacy notices.

11. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the effective date.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

[email protected]