Privacy Policy

This Privacy Policy explains what personal data Graspium (“we”, “us”) collects when you use graspium.com, why we collect it, who we share it with, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for the processing of your personal data is the operator of graspium.com. Full contact details are listed in our Impressum. For any questions about this Privacy Policy or to exercise your rights under GDPR, please use the contact information provided there.

2. Data we collect

2.1 Account data (when you sign in)

• Your email address, name, and profile picture from your Google account (via Google OAuth)
• A unique account identifier
• Account creation date and last sign-in date

2.2 Content you upload or generate

• EPUB book files you upload
• Extracted book text and metadata (title, author, cover image)
• Chat messages you send to the AI assistant and the AI’s responses
• Highlights, favorites, and notes you create
• Voice recordings you submit for transcription (these are sent to OpenAI for transcription and not stored long-term by us)

2.3 Usage data

• Your reading progress (current page, words read) for each book
• Device and font preferences
• Daily quota usage (number of AI requests, uploads, transcriptions)
• Technical logs (timestamps, error events, request paths) used to diagnose issues

3. Why we use your data (legal basis)

• To provide the service — storing your books, answering your questions, and syncing reading progress (Art. 6(1)(b) GDPR — performance of a contract).
• To keep the service running — logging errors, enforcing rate limits, preventing abuse (Art. 6(1)(f) GDPR — legitimate interests).
• To tell you what changed in Graspium — occasional emails about new features and changes to the service you use, sent to your account’s email address from felix@graspium.com through our email provider goneo (Germany). The basis is our legitimate interest in informing existing users about our own service (Art. 6(1)(f) GDPR, together with § 7(3) of the German Unfair Competition Act, UWG); where the law requires your consent, we send these emails only with it (Art. 6(1)(a) GDPR). You can stop them at any time, free of charge apart from the usual transmission costs, with the unsubscribe link in every email or in Settings → Email (see Section 7). For this we store only whether product emails are on or off for your account and when that last changed.
• To sign you in via Google — based on your consent at the OAuth screen (Art. 6(1)(a) GDPR).

4. Who we share data with (processors)

We do not sell your data. We rely on the following service providers, each acting as a data processor on our behalf:

• Supabase (database, file storage, authentication) — data is hosted in the EU. See supabase.com/privacy.
• Google Cloud Run (application hosting in europe-west1) and Google AI / Gemini (for AI responses about your books). See Google’s privacy policy. Book passages relevant to your question are sent to Gemini to generate the answer.
• OpenAI (voice transcription via the gpt-4o-transcribe model). Your voice recording is sent to OpenAI’s API and processed under their data-processing terms. See openai.com/policies/privacy-policy.
• Langfuse (AI request tracing for performance monitoring). See langfuse.com/security.
• PostHog (product analytics and session replay) — hosted on PostHog Cloud EU in Frankfurt. See Section 6 for what is collected and posthog.com/privacy.
• goneo (DNS and email hosting for graspium.com since 13 October 2026, including the product emails described in Section 3) — a German provider based in Minden. Our former domain bookbuddy.me, which redirects to graspium.com, is still registered with STRATO; its DNS and email have also been at goneo since 11 September 2026. See goneo.de/datenschutz.

Some of these providers (Google, OpenAI) may process data outside the EU, primarily in the United States. Transfers are protected by Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

5. How long we keep your data

We keep your account data and content for as long as your account exists. Voice recordings are not retained after transcription. Technical logs are retained for up to 30 days. When you delete your account (see Section 7), we permanently delete your books, conversations, highlights, reading progress, and account record within 30 days.

6. Cookies and tracking

We use essential cookies required for authentication (session tokens issued by Supabase Auth). We do not use advertising cookies.

To understand how Graspium is used and to fix problems, we use PostHog, hosted in the EU (Frankfurt). Requests to PostHog go through our own domain, so no third-party domain is contacted directly.

• Visitors who are not signed in are measured without cookies or browser storage. PostHog derives a daily, non-reversible hash from your IP address and browser and discards the IP; we cannot recognise you across days.
• When you sign in, PostHog stores a first-party cookie so that your usage can be attributed to your account (user ID and email address), and it records your sessions: the pages you see, including the book text on screen, your chat messages and what you type, plus clicks, scrolling and errors. Passwords are always masked. We use these recordings only to understand how Graspium is used and to fix problems.

Analytics data is kept for one year and session recordings for 30 days. You can object to this processing at any time via the contact details in our Impressum; we will stop attributing usage to your account.

7. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing
• Receive a copy of your data in a portable format
• Object to processing based on legitimate interests
• Withdraw consent at any time (this does not affect lawful processing that occurred before withdrawal)
• Lodge a complaint with a supervisory authority — for users in Germany, this is your state data protection authority (Landesdatenschutzbeauftragter).

Product emails: to stop them, click Unsubscribe at the bottom of any product email (one click, no sign-in needed; your email app’s own unsubscribe button works too) or switch off Product updates by email in Settings → Email. Either takes effect immediately, and we send no further product emails to your account until you switch them back on. This costs you nothing apart from the usual transmission costs.

To exercise any of these rights, sign in and go to Settings → Danger zone for self-serve account deletion, or contact us using the details in our Impressum.

8. Security

We use industry-standard measures to protect your data, including TLS encryption in transit, encrypted storage, role-based database access controls (PostgreSQL Row-Level Security), and short-lived signed URLs for file access.

9. Children

Graspium is not directed at children under 16. If you become aware that a child has signed up without parental consent, please contact us and we will delete the account.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email. The “Last updated” date at the top of this page reflects the most recent revision.