Privacy policy

Data controller#

The controller is QR COMMUNICATION, a French simplified joint-stock company, 23 rue de Richelieu, 75001 Paris, France (RCS Paris 940 163 496).

No data protection officer has been appointed. For any question or request about your data, write to contact@library-manager.com.

Processing, purposes, legal bases and retention#

Each processing activity is described below. “Contract” refers to article 6(1)(b) GDPR (performance of the contract between you and us: the terms of use and, where applicable, the terms of sale); “legitimate interest” to point (f); “legal obligation” to point (c). No processing currently relies on your consent.

Data we do not receive from you#

Some data does not come from the person concerned (article 14 GDPR):

• the email address of a person invited to read a space, or of the recipient of a shared book, is given to us by the person who shares; the email that person receives informs them of the invitation and of who sent it; this policy is reachable from every public page of the site;
• the data contained in imported books and files (authors, content) is provided by the user who imports them;
• public bibliographic metadata may be found on the Internet, by the AI provider you chose or by Brave Search with your own key, when a book is enriched.

Recipients and processors#

Your data is neither sold nor rented. Only authorised staff of the publisher can access it, as well as the following providers within the limits of their task:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosting of the application and its database, as a processor, under the article 28 GDPR data processing agreement it offers its customers (Hetzner’s data protection page);
• IDrive Inc. (Calabasas, California, United States), IDrive e2 service: storage of files (books, versions, covers, exports of your data, backups) in its Paris (eu-west-4) and Ireland regions, each one backing up the other, as a processor (data processing addendum);
• Plus Five Five, Inc., operating the Resend service (San Francisco, United States): sending of transactional emails, as a processor (data processing addendum);
• Stripe Payments Europe, Limited (Dublin, Ireland): payment and subscription management, as a processor for part of the processing and as a controller for the processing whose purposes it sets itself, in particular under its own legal obligations (data processing addendum).

The publisher uses no Internet search or bibliographic catalogue service of its own: search and the completion of metadata are done by the AI provider you chose or, if you saved your own Brave Search key, by Brave Search with that key.

AI providers (OpenAI, Anthropic, Mistral, Z.ai, Kimi, MiniMax) are not our processors: you choose them, you enter into a contract with them yourself and you use your own key; we pass your requests to them at your initiative, and they process the data you submit under their own terms.

Nor is Brave Software, Inc. (United States), which provides Brave Search, our processor: you open an account with Brave yourself, you accept its terms and you use your own key; we pass your search queries to it with that key, at your initiative, and Brave processes them under its own terms (Brave Search API privacy notice).

Finally, we may disclose data to the authorities where the law requires it.

Transfers outside the European Union#

The application and its database are hosted in Germany, and files are stored in the Paris and Ireland regions: this data stays in the European Union. Several providers are nevertheless companies established in the United States, or transfer data there. For each one, here is the safeguard of chapter V GDPR as we read it on 13 October 2026 on its official pages and on the official list of the EU–US Data Privacy Framework, kept by the U.S. Department of Commerce and found adequate by the European Commission for the companies on it:

• Hetzner Online GmbH (Germany): hosting in the European Union; according to the information the provider publishes, no transfer outside the Union is planned for this service (Hetzner’s page).
• IDrive Inc. (United States): files stay stored in the European Union, but the company is established in the United States and access from that country cannot be ruled out. It is on the Data Privacy Framework List with an active status (entry on the official list); its data processing addendum provides for the standard contractual clauses of the European Commission where that framework does not apply.
• Stripe: data processed by Stripe Payments Europe, Limited (Ireland) may be transferred to Stripe, LLC (United States), which is on the Data Privacy Framework List with an active status (entry on the official list). Stripe’s data transfers addendum applies that framework first and, failing it, the standard contractual clauses of the European Commission.
• Resend: Plus Five Five, Inc. processes data mainly in the United States. It is on the Data Privacy Framework List with the status “active, re-certification under review” (entry on the official list); its data processing addendum also includes the standard contractual clauses of the European Commission.

You can obtain a copy of these safeguards by writing to contact@library-manager.com.

AI providers receive your requests because you chose them and entered into a contract with them yourself; we pass the requests to them at your request, with your key. The data you submit to them (your messages, metadata and extracts of books) then goes where they process it:

• OpenAI: for a customer established in the European Economic Area, data is processed by OpenAI Ireland Ltd (Ireland); according to the information the provider publishes, its transfers outside the European Economic Area, in particular to the United States, rely on the standard contractual clauses or on an adequacy decision (data processing addendum). OpenAI is not on the Data Privacy Framework List.
• Anthropic: its services are provided in the European Union by Anthropic Ireland, Limited (Ireland), as a processor of its customer; its data processing addendum governs transfers by the standard contractual clauses of European Commission decision (EU) 2021/914. Anthropic is not on the Data Privacy Framework List.
• Mistral AI: a company established in Paris; its data processing addendum allows a transfer outside the European Union only to a country found adequate or under the standard contractual clauses, in particular to its own sub-processors.
• Z.ai: international service of the Chinese Zhipu group, provided by JINGSHENG HENGXING TECHNOLOGY PTE. LTD. (Singapore), which states that data is “generally” processed in Singapore and may be transferred outside that country under mechanisms it does not specify (Z.ai privacy policy).
• Kimi: service of Moonshot AI Pte. Ltd. (Singapore), a company of the Chinese Moonshot AI group, which states that it stores data on servers located in Singapore and applies, for transfers, safeguards it does not specify (Kimi privacy policy).
• MiniMax: service of Nanonoble Pte. Ltd. (Singapore), a company of the Chinese MiniMax group, which states that it stores data in a data centre located in the United States; it is not on the Data Privacy Framework List and does not mention the standard contractual clauses (MiniMax privacy policy).

Neither China nor Singapore benefits from an adequacy decision of the European Commission, nor do the United States for a company that is not on the Data Privacy Framework List. If you choose Z.ai, Kimi or MiniMax, your requests and the book extracts they contain are sent outside the European Union, to companies of groups established in China, without a transfer safeguard we could verify, and access from China cannot be ruled out. The choice is yours: you can use another provider or delete your key at any time.

The queries sent with your Brave Search key go to the United States, to Brave Software, Inc. According to its Brave Search API privacy notice, read on 16 October 2026, Brave keeps a record of the queries made with a key for 90 days at most, for billing and troubleshooting, considers that these queries are not personal data and excludes them from its data processing addendum. Brave Software, Inc. was not, on that date, on the Data Privacy Framework List. We have therefore verified no transfer safeguard for these queries: do not include personal data in them. You can revoke your Brave Search key at any time.

Backups#

Encrypted backups of the database and files are made and stored with IDrive Inc.. Data erased from the service remains in earlier backups until they are replaced in the backup rotation cycle; a backup is only used to restore the service, and an erasure already handled is applied again before the service is put back online.

Your rights#

You have the following rights over your data:

• right of access (article 15 GDPR) and right to rectification (article 16);
• right to erasure (article 17), except for the data the law requires us to keep, such as accounting records;
• right to restriction of processing (article 18);
• right to portability of the data you provided, in a structured, machine-readable format (article 20);
• right to object, on grounds relating to your particular situation, to processing based on legitimate interest (article 21);
• right to set instructions about what happens to your data after your death (article 85 of the French “Informatique et Libertés” law);
• right to withdraw your consent at any time, should a processing come to rely on it: none does today.

You can already change your name, preferences, AI keys and Brave Search key, revoke a device, leave a space, return a shared book and remove a reader from the application.

You object to the measurement of activity in the settings, section “Measurement of activity”: the objection is recorded at once and also covers your events already recorded, deleted as soon as their day is counted for the last time (three days at most); withdrawing it acts only for what follows.

You exercise your right of access and your right to data portability yourself, from the settings, section “My data”, button “Request my data”. The request prepares, for each space you are an active member of, a file donnees.json, in JSON, structured and machine-readable:

• your account (name, address, verification, accepted terms), your role in the space and your preferences;
• your reading progress, annotations, favourites, notes and saved views, your collections and your metadata selections;
• your AI keys and your Brave Search key (provider, state and dates only, never the key itself) and your conversations with the assistant;
• your devices (without login identifier or secret), their progress, deliveries, sessions and removal requests;
• your invitations and your shares, given and received, and your progress on the books you received, without the address or the account of anybody else;
• the log of your actions, without detail;
• your measured activity (kind, date and details of each event) and, if you objected to it, the date of your objection and the days you were active;
• your account’s subscriptions and the billing operations you started, gathered in one file of the request, including when their original space has been closed;
• for a space you own: the catalogue of the books you imported into it, and a second file, fichiers.zip, holding those books (originals and versions as they stand, with the metadata written into them, and covers, trash included) with an index of their digests, including the digest of the file as imported when it has been rewritten.

No data of another member is in these files. An email tells you when they are ready; you download them from the page of the request, signed in, through links valid for five minutes. They are kept for 14 days by our storage provider, then deleted automatically. A new request is possible 24 hours after the previous one, or earlier if an export of that one failed. Each request, each ready export and each download is written to the audit log, without detail.

You can delete your account yourself, from the section “Delete my account” of the settings. Before you confirm, you see what the deletion takes away: each space you are a member of, what becomes of it, and your shares given and received, in numbers, without the name of any other member. You confirm with your password (five tries at most in fifteen minutes, then a wait that doubles with each further failure up to one hour), by typing the address of your account again and by ticking an acknowledgement. The deletion is refused while a subscription of your account has not ended with our payment provider, including during a scheduled cancellation and even when its original space has been closed, or while a billing operation you started is not resolved. Closing a space from its settings does not cancel your subscription: it remains accessible from your account’s other spaces.

As soon as you confirm, you are signed out everywhere, your device accesses, your AI keys and your Brave Search key are revoked, and an email gives you the effective date, 14 days later. Until that date you can sign in again to cancel, to see your data and to export it; nothing else can be changed, and a cancellation restores neither your devices, nor your AI keys, nor your Brave Search key. A new request is possible only 24 hours after a cancellation. The recipients of the books you shared are told that the share will end on that date (title of the book and date, never your name or address), then, if you cancel after they were told, that the share is kept.

On that date your data is erased space by space, as the previous section describes: a space you are the only owner of is closed and purged, and its readers lose access and are told; a space another owner keeps stays with them. The shares you gave and received end (their recipients are told), and the invitations sent to your address are deleted. If an erasure is held (a billing operation to resolve, a file under review), the page of the deletion and an email give the reason; the deletion can then no longer be cancelled. Once everything is erased, a last email confirms it, then your identity is reduced to an identifier with no address and no name: your sessions, your password, your verification and reset links and the trace of your emails are deleted, and your address can be used for a new sign-up.

What remains, with no address and no name: the identifier of your account, its creation date, the version and date of the terms you accepted (the proof of the contract behind the accounting records kept for ten years), the accounting records themselves, and the audit log, pseudonymous. You can also send your request, like any other, to contact@library-manager.com; the publisher handles it.

We answer within one month of receiving the request. This period may be extended by two months given the complexity or number of requests; we then tell you so within the first month. We may ask you to confirm your identity, for example by writing from the address of your account.

Complaint to the CNIL#

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the authority of the EU country where you live.

Cookies and local storage#

The application only uses cookies that are strictly necessary for it to work or to remember choices you make. They are exempt from consent (article 82 of the French “Informatique et Libertés” law), which is why no consent banner is shown. No audience measurement, advertising or social network cookie is set. Pages load no script, font or content from a third-party service; only the files of your books and their covers may be read directly from our storage service, through temporary links. One exception: when your bank asks you to authenticate the payment of a purchase of reader seats, the Billing page, and it alone, loads Stripe’s script (Stripe.js) for that authentication; Stripe may then set its own fraud-prevention cookies (__stripe_mid, __stripe_sid), strictly necessary for the security of the payment and exempt from consent.

better-auth.session_token

sign-in session cookie (named __Secure-better-auth.session_token over a secure connection). It authenticates you. Lifetime: 7 days, extended while you use the service; deleted when you sign out. Not readable by page scripts.

activeTenant

remembers the library space you opened. Lifetime: one year. Not readable by page scripts.

locale

remembers the language you chose. Lifetime: one year.

theme

remembers the theme you chose (light, dark or the system one). Lifetime: one year.

lm_admin_reauth

set only for an administrator of the platform who has just typed their password again: it opens the anonymous usage statistics, for this session only. Lifetime: 15 minutes. Not accessible to the scripts of the page.

Your browser’s local storage also keeps, on your device only: the appearance settings of the reader (without any book or reading position), markers of ongoing imports so they can be resumed, and, for devices connected through the browser, the access authorisation to the chosen folder and the comparison log. This data is not sent to third parties; device data is removed when you sign out. You can delete cookies and local storage from your browser settings; sign-in and import resumption will then stop working until you sign in again.

Security#

• exchanges with the application use HTTPS; passwords are hashed; AI keys, Brave Search keys and device secrets are encrypted;
• each space is isolated from the others in the database, and access is checked on every request according to your role;
• backups are encrypted, and their key is kept separately;
• the number of sign-in attempts and of emails sent is limited.

The wireless Calibre protocol is not encrypted: anyone observing the network between your e-reader and our servers can see the metadata, the inventory and the content of the books sent, but never the device secret. The application says so and offers OPDS and KOReader, which use HTTPS.

In the event of a personal data breach that puts your rights at risk, we notify the CNIL under article 33 GDPR and, where the risk is high, we inform you.

Minors#

The service is not intended for children under 15. A minor under 15 may only create an account with the agreement of the holder of parental authority (article 45 of the French “Informatique et Libertés” law). If you find that a child has given us data without that agreement, write to contact@library-manager.com: we will erase it.

Changes to this policy#

This policy may change with the service or the regulations. The version and update date are shown at the top of the page. In the event of a significant change, we inform you by email or in the application before it takes effect. The other applicable documents are the legal notice, the terms of use and the terms of sale.