Legal
Privacy Policy
Effective 2026-05-28. Short and direct.
1. Who we are
NovelistAlpha ("we," "us") operates novelistalpha.com, a paid manuscript-review service. This Privacy Policy explains what information we collect when you use the Service, how we use it, and what rights you have over it. It applies to everyone who visits the site or submits a manuscript.
2. What we collect
We collect only the information needed to deliver and bill your report.
| Data | Why we collect it |
|---|---|
| Email address | To send your confirmation, status updates, and finished report |
| Manuscript file | To produce your editorial report |
| Title, genre, optional author name | To configure the review (routing to the right reader panel) |
| Payment metadata (charge ID, amount, last 4 of card) | To process and record your payment. Full card details go directly to Stripe — we never see them. |
| Job state and timestamps | To run the pipeline, expose status to you, and honor refund SLAs |
| Technical logs (IP address, browser type, request timestamps) | To detect abuse, debug errors, and meet basic security obligations |
We do not collect a password (no user accounts), tracking cookies, advertising identifiers, or behavioral data. We do not run analytics services like Google Analytics on the upload, success, or status pages.
3. How we use it
We use the information you give us only to:
- Process your payment and deliver your editorial report.
- Email you confirmations, status updates, the finished report, and any service-related notices (refund issued, file rejected, etc.).
- Maintain logs we are legally required to keep (tax records, payment records, security logs).
- Investigate and respond to any abuse, security incident, or law enforcement request.
We do not use your information to:
- Train AI models or include your manuscript in any training corpus.
- Sell, rent, or share with data brokers, marketers, or advertisers.
- Profile you for marketing purposes.
- Send unsolicited promotional email beyond service-related notices.
4. Who we share with
We share data only with the third-party services we need to operate:
| Service | What they get | Why |
|---|---|---|
| Stripe | Your payment details + email | Process the payment |
| Resend | Your email address + the report | Deliver the email + attachments |
| Railway | Hosts our backend + job database + manuscript files | Compute + storage for the Service |
| Netlify | Hosts the website | Compute for novelistalpha.com |
| OpenRouter | Manuscript text in chunks during analysis | Routes our reader-panel analysis to the language models. We send with zero-data-retention / no-training settings enabled where the provider supports them. |
| DeepSeek | Manuscript text in chunks during analysis (via OpenRouter and/or directly) | Reader-panel and synthesis passes. We send with no-training settings where supported. |
| Anthropic (Claude) | Aggregated analysis plus quoted manuscript excerpts during the final verdict pass | Final editorial read of the report. Anthropic does not train on API inputs by default. |
| Voyage AI | Manuscript text in chunks | Generates embeddings used to compare passages and reader responses. |
We do not share your information with anyone else except (a) as required by law (subpoena, court order, mandatory reporting under applicable statutes), or (b) in connection with a sale or transfer of the business, in which case the acquirer agrees in writing to honor this Privacy Policy with respect to your data.
5. Where your data is stored
Our backend runs on Railway's US infrastructure (San Francisco region). Your manuscript and intermediate analysis files live in a Railway-attached persistent volume in that region. Backups and logs are retained on the same infrastructure. Transactional email is sent via Resend (US). The website is served by Netlify's global CDN (caches static HTML/CSS only, no personal data).
If you use the Service from outside the United States, you understand and consent to the transfer of your data to and storage of your data in the United States.
6. How long we keep it
- Manuscript file and intermediate analysis files: deleted 30 days after the finished report is emailed to you. You may request earlier deletion by writing to hello@novelistalpha.com — we will process within 7 business days.
- The finished editorial report: retained indefinitely on our side unless you request deletion. We keep this so we can re-send if your copy is lost. Request deletion at any time as above.
- Account record (email, title, payment receipt) and billing records: retained as required by US tax and accounting law — typically 7 years.
- Technical logs (IP, request timestamps): retained for 90 days, then rotated out.
7. Security
Everything in transit between your browser, our backend, and our service providers is encrypted with TLS. Our backend authenticates worker-side requests with a cryptographically random bearer token. Administrative access requires a hardware-key-protected account. Payment card details never touch our systems — they go directly to Stripe.
No system is perfectly secure. If we discover a data breach affecting your information, we will notify you by email within 72 hours of discovery, along with the scope of the breach and the steps we are taking.
8. Your rights
You can, at any time, by emailing hello@novelistalpha.com:
- Ask for a copy of the personal information we hold about you.
- Ask us to correct inaccurate information.
- Ask us to delete your manuscript and analysis files (we will process within 7 business days).
- Ask us to delete your account record (subject to retention obligations for billing records under #6 above).
- Ask us to export your data in a portable format.
We will not retaliate against you for exercising any of these rights.
9. California residents (CCPA/CPRA)
If you are a California resident, you have the rights described above under the California Consumer Privacy Act and the California Privacy Rights Act. Note that we do not "sell" personal information as that term is defined by California law, and we do not engage in cross-context behavioral advertising.
10. EU/UK residents (GDPR)
If you are in the European Union or the United Kingdom, you have the rights described above as a data subject under the GDPR/UK GDPR. The legal basis for processing your information is performance of a contract (delivering the editorial report you paid for) and, for logs and billing records, our legitimate interest in maintaining the Service and meeting legal obligations.
11. Children's privacy
The Service is for adults. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such information, write to hello@novelistalpha.com and we will delete it promptly.
12. Cookies
The website does not use tracking cookies or third-party analytics on the upload, success, or status pages. If any session cookie is set by Stripe Checkout during the payment step, it is set by Stripe and governed by Stripe's cookie policy, not ours.
13. Changes to this policy
We may update this Privacy Policy. Material changes will be flagged with an updated effective date at the top of this page. If a change meaningfully expands what we collect or who we share with, we will also notify previous users by email.
14. Contact
Questions about this policy, requests under the sections above, or data deletion requests: hello@novelistalpha.com.