{ "updated": "2026-09-10", "contact": "hello@infinitelibrary.ai", "company": { "name": "Infinite Library SAS", "hq": "Montrouge, just south of Paris, France", "legalNotice": "https://www.infinitelibrary.ai/legal-notice", "privacyPolicy": "https://www.infinitelibrary.ai/privacy", "terms": "https://www.infinitelibrary.ai/terms" }, "pages": { "trust": "https://bindery.infinitelibrary.ai/trust", "dpa": "https://bindery.infinitelibrary.ai/trust/dpa", "questionnaire": "https://bindery.infinitelibrary.ai/trust/questionnaire", "securityTxt": "https://bindery.infinitelibrary.ai/.well-known/security.txt", "subprocessorsJson": "https://bindery.infinitelibrary.ai/trust/subprocessors.json" }, "training": { "allClear": false, "never": [ { "id": "anthropic", "name": "Anthropic", "entity": "Anthropic, PBC — San Francisco, United States", "category": "ai", "purpose": "The writing and typesetting agent (Claude) — drafting, editing, translation, cover copy, the support concierge, the storybook director.", "receives": "Your prompts, manuscript, transcripts, notes and uploads, and the book as it is written; the account id as an opaque reference.", "region": "United States", "hostnames": [ "api.anthropic.com" ], "privacyUrl": "https://www.anthropic.com/legal/privacy", "dpaUrl": "https://www.anthropic.com/legal/data-processing-addendum", "envKey": "ANTHROPIC_API_KEY", "scope": "both", "since": "2026-06-01", "ai": { "training": "never", "trainingNote": "“By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.”", "evidenceUrl": "https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training", "retention": "Inputs and outputs deleted within 30 days (longer only for confirmed policy violations or where the law requires).", "zeroRetention": "available", "receivesForAi": "manuscript, transcripts, notes, prompts", "ourControls": [ "The agent's Claude Code subprocess runs with CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1: no telemetry, error reports or feedback surveys leave the container — only the model call does.", "Our own copy of each agent session is swept every 6 hours; only the current session per book is kept (transcriptRetention.ts)." ] } }, { "id": "openai", "name": "OpenAI", "entity": "OpenAI, L.L.C. — San Francisco, United States", "category": "ai", "purpose": "Cover art generation, a fallback illustrator, and speech-to-text for voice memos and recordings you upload.", "receives": "Cover briefs, illustration prompts and reference images, and the audio you ask to transcribe.", "region": "United States", "hostnames": [ "api.openai.com" ], "privacyUrl": "https://openai.com/policies/privacy-policy", "dpaUrl": "https://openai.com/policies/data-processing-addendum", "envKey": "OPENAI_API_KEY", "scope": "both", "since": "2026-06-01", "ai": { "training": "never", "trainingNote": "“Data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).”", "evidenceUrl": "https://developers.openai.com/api/docs/guides/your-data", "retention": "Abuse-monitoring logs up to 30 days; audio transcription requests are not retained.", "zeroRetention": "available", "receivesForAi": "cover and illustration briefs, uploaded recordings", "ourControls": [ "Every Responses API call is sent with store: false, so OpenAI keeps no retrievable copy beyond its 30-day abuse log (imageGen.ts).", "Recordings are transcribed and discarded; the text lands in your book, the audio stays in your workspace only." ] } }, { "id": "google-gemini", "name": "Google Gemini API", "entity": "Google LLC — Mountain View, United States", "category": "ai", "purpose": "Picture-book illustrations (the storybook engine) and watching YouTube videos you paste as source material.", "receives": "Illustration briefs (which may name the child a picture book is for), reference images, and the public video links you paste.", "region": "United States", "hostnames": [ "generativelanguage.googleapis.com" ], "privacyUrl": "https://policies.google.com/privacy", "dpaUrl": "https://cloud.google.com/terms/data-processing-addendum", "envKey": "GEMINI_API_KEY", "scope": "studio", "since": "2026-09-02", "ai": { "training": "never-paid-tier", "trainingNote": "Paid Services: “Google doesn't use your prompts or responses to improve our products, and will process your prompts and responses in accordance with the Data Processing Addendum.” Bindery runs on the paid tier.", "evidenceUrl": "https://ai.google.dev/gemini-api/terms", "retention": "Logged for a limited period solely to detect abuse (paid tier).", "zeroRetention": "not-offered", "receivesForAi": "picture-book briefs and reference images, pasted video links", "ourControls": [ "Stateless calls by default: server-side interaction storage is off unless BINDERY_ILLUSTRATOR_STORE=1 (illustrator.ts).", "A video is fetched by Google from its public URL — none of your files travel with it." ] } } ], "pending": [ { "id": "elevenlabs", "name": "ElevenLabs", "entity": "ElevenLabs, Inc. — New York, United States", "category": "ai", "purpose": "Audiobook narration, the optional clone of your own voice, and album music.", "receives": "The text of chapters you narrate, the voice sample you record for a clone, and song lyrics.", "region": "United States", "hostnames": [ "api.elevenlabs.io" ], "privacyUrl": "https://elevenlabs.io/privacy-policy", "dpaUrl": "https://elevenlabs.io/dpa", "envKey": "ELEVENLABS_API_KEY", "scope": "both", "since": "2026-06-01", "ai": { "training": "opt-out-pending", "trainingNote": "ElevenLabs may use submitted content to train its models unless the workspace opts out (“You may opt out of our use of your Personal Data for training at any time by navigating to the ‘Data use’ menu”); enterprise contracts exclude it.", "evidenceUrl": "https://elevenlabs.io/privacy-policy", "retention": "Request history is kept by default; zero-retention mode (enable_logging=false) is an enterprise-plan feature.", "zeroRetention": "enterprise-only", "receivesForAi": "narrated chapter text, voice samples, lyrics", "ourControls": [ "Your cloned voiceprint is deleted at the vendor the moment you delete the voice or your account (voice.ts).", "Zero-retention requests are armed with ELEVENLABS_ZERO_RETENTION=1 once the account is on an enterprise plan (voice.ts)." ] } }, { "id": "black-forest-labs", "name": "Black Forest Labs", "entity": "Black Forest Labs, Inc. — Freiburg, Germany / United States", "category": "ai", "purpose": "The author photo studio — professional portraits generated from a selfie you choose to upload.", "receives": "The selfie you upload and the portrait brief.", "region": "United States / European Union (regional endpoints)", "hostnames": [ "api.bfl.ai" ], "privacyUrl": "https://bfl.ai/legal/privacy-policy", "envKey": "BFL_API_KEY", "scope": "studio", "since": "2026-08-22", "ai": { "training": "opt-out-pending", "trainingNote": "Black Forest Labs may use prompts and uploaded images to improve its models unless the customer opts out (privacy@blackforestlabs.ai, “Training Opt Out”); enterprise contracts exclude it.", "evidenceUrl": "https://bfl.ai/legal/privacy-policy", "retention": "No fixed period published — “as long as is reasonably necessary”.", "zeroRetention": "not-offered", "receivesForAi": "a selfie and the portrait brief (only if you use the author photo studio)", "ourControls": [ "Entirely opt-in: nothing reaches this vendor unless you open the author photo studio and upload a photo.", "Generated portraits are stored on our side only; the vendor's download link expires within minutes." ] } } ] }, "regions": [ { "what": "The studio and the live book workspaces (manuscripts, sources, uploads, audio masters, chat history)", "where": "California, United States (us-west2)", "provider": "Railway" }, { "what": "Durable workspace snapshots and author portraits", "where": "Iowa, United States (us-central1)", "provider": "Google Cloud Storage" }, { "what": "Accounts, plans and credits, notifications, support conversations, the audit log", "where": "United States multi-region (nam5)", "provider": "Cloud Firestore" }, { "what": "The website (www.infinitelibrary.ai)", "where": "United States, served from a global edge", "provider": "Vercel" } ], "retention": [ { "data": "Your books — manuscript, sources, uploads, covers, audio masters, chat history", "kept": "For as long as your account exists", "then": "A book you delete is removed at once and its backup tombstoned; everything else is erased 14 days after you confirm account deletion (the undo window)", "code": "accountDeletion.ts · snapshot.ts" }, { "data": "Account profile — email, name, plan, credits, orders", "kept": "For as long as your account exists", "then": "14 days after confirmed deletion, replaced by a PII-free tombstone (amounts tax law requires stay, anonymised)", "code": "identity.ts · accountDeletion.ts" }, { "data": "The writing agent's session memory (its working transcript per book)", "kept": "Only the current session of each book", "then": "Superseded sessions swept every 6 hours; a session past 256 MB is rotated", "code": "transcriptRetention.ts" }, { "data": "Usage telemetry — pseudonymous product events", "kept": "190 days", "then": "Raw events deleted; only aggregate counters remain", "code": "telemetry.ts" }, { "data": "Audit log — operator actions, data exports, DPA signatures", "kept": "400 days", "then": "Deleted", "code": "auditLog.ts" }, { "data": "Sign-in codes and magic links", "kept": "10 minutes", "then": "Expire", "code": "emailAuth.ts" }, { "data": "Account-deletion confirmation links", "kept": "7 days", "then": "Expire", "code": "accountDeletion.ts" }, { "data": "Support conversations with the concierge", "kept": "For as long as your account exists", "then": "Deleted with the account", "code": "supportLog.ts · accountDeletion.ts" }, { "data": "Your cookie-consent choice", "kept": "365 days after a yes, 182 days after a no", "then": "You are asked again", "code": "client/consent.ts" } ], "controls": [ { "group": "Encryption", "items": [ "TLS 1.2 or newer on every connection, with HSTS for one year including subdomains.", "Encryption at rest for accounts, backups and portraits — Google-managed AES-256 on Cloud Firestore and Cloud Storage.", "Card numbers never touch our servers: Stripe holds them (PCI DSS Level 1); we keep only a customer reference." ] }, { "group": "Access control", "items": [ "A book is opened only by its owner and the collaborators the owner invites; every collaborator link is a signed, revocable token.", "Operator actions go through a token-authenticated admin API — short-lived HMAC tokens scoped to one action — and every call is written to an append-only audit log.", "Secrets live only in the hosting provider's variable store, never in the repository; each token class (print assets, listen links, unsubscribe, sessions, admin) has its own signing key.", "Production side effects — email, print jobs, purges — are refused on any machine that is not the production container, so a developer laptop with mirrored configuration cannot act on customers." ] }, { "group": "Application security", "items": [ "Origin checks on every state-changing request (CSRF) and rate limits on checkout, sign-in, publishing and import routes.", "Sign-up abuse rails: disposable-domain refusal, velocity caps, and device keys that never store a raw IP address.", "Account deletion needs a link clicked from the account's own inbox; a stolen session or a social-engineered support chat cannot erase a library.", "Uploaded files are served under a no-script content-security policy; public pages are server-rendered with no third-party script beyond consent-gated analytics.", "Dependencies are audited on every release; the last full security review (31 August 2026) found no critical or high-severity dependency issues." ] }, { "group": "Resilience", "items": [ "Every change to a book is snapshotted to Google Cloud Storage within seconds; a fresh server re-hydrates from those snapshots on boot.", "Health-checked deploys with automatic restarts; a disk-pressure watch reclaims space before a build can corrupt.", "Vendor spend ceilings and circuit breakers keep a runaway job from becoming an outage or a bill." ] }, { "group": "People and process", "items": [ "A founder-led team: production access is limited to the operator, and the operator's actions are logged.", "Every change ships through the same typecheck-and-test gate; privacy-critical settings (vendor data-retention flags, the sub-processor register) are pinned by tests that fail when code and policy diverge.", "Incident response: affected customers — and, where required, supervisory authorities — are notified within 72 hours of confirming a personal-data breach." ] } ], "compliance": [ { "id": "gdpr", "name": "GDPR", "status": "in-place", "headline": "EU controller, self-serve rights, online DPA", "detail": "Infinite Library SAS is a French company, so the GDPR applies to everything we do — not only to European customers. Access, portability and erasure are self-serve in the account dialog; a Data Processing Addendum with Standard Contractual Clauses can be accepted online in a minute." }, { "id": "ccpa", "name": "CCPA / CPRA", "status": "in-place", "headline": "No sale, no sharing for advertising, GPC honoured", "detail": "We do not sell or share personal information for cross-context advertising. The same export and deletion doors serve California requests, and the Global Privacy Control signal is treated as an opt-out." }, { "id": "transfers", "name": "International transfers", "status": "in-place", "headline": "SCCs and the EU-US Data Privacy Framework", "detail": "Processing happens in the United States. Transfers rest on the Standard Contractual Clauses (2021/914) incorporated in our DPA and, where a vendor is certified, the EU-US Data Privacy Framework. Each sub-processor's location is stated in the register below." }, { "id": "soc2", "name": "SOC 2 Type II", "status": "in-progress", "headline": "Controls in place and evidenced; the audit period has not started", "detail": "The controls on this page map to the Trust Services Criteria in a control map we share on request. A formal Type II report needs an observation period with an independent auditor; until it exists we answer security questionnaires by email, with the evidence linked here." }, { "id": "iso", "name": "ISO/IEC 27001", "status": "not-pursued", "headline": "Not certified", "detail": "We are not ISO 27001 certified and are not currently seeking certification; the SOC 2 track above is our compliance program." } ], "subprocessors": [ { "id": "anthropic", "name": "Anthropic", "entity": "Anthropic, PBC — San Francisco, United States", "category": "ai", "purpose": "The writing and typesetting agent (Claude) — drafting, editing, translation, cover copy, the support concierge, the storybook director.", "receives": "Your prompts, manuscript, transcripts, notes and uploads, and the book as it is written; the account id as an opaque reference.", "region": "United States", "hostnames": [ "api.anthropic.com" ], "privacyUrl": "https://www.anthropic.com/legal/privacy", "dpaUrl": "https://www.anthropic.com/legal/data-processing-addendum", "envKey": "ANTHROPIC_API_KEY", "scope": "both", "since": "2026-06-01", "ai": { "training": "never", "trainingNote": "“By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.”", "evidenceUrl": "https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training", "retention": "Inputs and outputs deleted within 30 days (longer only for confirmed policy violations or where the law requires).", "zeroRetention": "available", "receivesForAi": "manuscript, transcripts, notes, prompts", "ourControls": [ "The agent's Claude Code subprocess runs with CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1: no telemetry, error reports or feedback surveys leave the container — only the model call does.", "Our own copy of each agent session is swept every 6 hours; only the current session per book is kept (transcriptRetention.ts)." ] } }, { "id": "openai", "name": "OpenAI", "entity": "OpenAI, L.L.C. — San Francisco, United States", "category": "ai", "purpose": "Cover art generation, a fallback illustrator, and speech-to-text for voice memos and recordings you upload.", "receives": "Cover briefs, illustration prompts and reference images, and the audio you ask to transcribe.", "region": "United States", "hostnames": [ "api.openai.com" ], "privacyUrl": "https://openai.com/policies/privacy-policy", "dpaUrl": "https://openai.com/policies/data-processing-addendum", "envKey": "OPENAI_API_KEY", "scope": "both", "since": "2026-06-01", "ai": { "training": "never", "trainingNote": "“Data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).”", "evidenceUrl": "https://developers.openai.com/api/docs/guides/your-data", "retention": "Abuse-monitoring logs up to 30 days; audio transcription requests are not retained.", "zeroRetention": "available", "receivesForAi": "cover and illustration briefs, uploaded recordings", "ourControls": [ "Every Responses API call is sent with store: false, so OpenAI keeps no retrievable copy beyond its 30-day abuse log (imageGen.ts).", "Recordings are transcribed and discarded; the text lands in your book, the audio stays in your workspace only." ] } }, { "id": "google-gemini", "name": "Google Gemini API", "entity": "Google LLC — Mountain View, United States", "category": "ai", "purpose": "Picture-book illustrations (the storybook engine) and watching YouTube videos you paste as source material.", "receives": "Illustration briefs (which may name the child a picture book is for), reference images, and the public video links you paste.", "region": "United States", "hostnames": [ "generativelanguage.googleapis.com" ], "privacyUrl": "https://policies.google.com/privacy", "dpaUrl": "https://cloud.google.com/terms/data-processing-addendum", "envKey": "GEMINI_API_KEY", "scope": "studio", "since": "2026-09-02", "ai": { "training": "never-paid-tier", "trainingNote": "Paid Services: “Google doesn't use your prompts or responses to improve our products, and will process your prompts and responses in accordance with the Data Processing Addendum.” Bindery runs on the paid tier.", "evidenceUrl": "https://ai.google.dev/gemini-api/terms", "retention": "Logged for a limited period solely to detect abuse (paid tier).", "zeroRetention": "not-offered", "receivesForAi": "picture-book briefs and reference images, pasted video links", "ourControls": [ "Stateless calls by default: server-side interaction storage is off unless BINDERY_ILLUSTRATOR_STORE=1 (illustrator.ts).", "A video is fetched by Google from its public URL — none of your files travel with it." ] } }, { "id": "elevenlabs", "name": "ElevenLabs", "entity": "ElevenLabs, Inc. — New York, United States", "category": "ai", "purpose": "Audiobook narration, the optional clone of your own voice, and album music.", "receives": "The text of chapters you narrate, the voice sample you record for a clone, and song lyrics.", "region": "United States", "hostnames": [ "api.elevenlabs.io" ], "privacyUrl": "https://elevenlabs.io/privacy-policy", "dpaUrl": "https://elevenlabs.io/dpa", "envKey": "ELEVENLABS_API_KEY", "scope": "both", "since": "2026-06-01", "ai": { "training": "opt-out-pending", "trainingNote": "ElevenLabs may use submitted content to train its models unless the workspace opts out (“You may opt out of our use of your Personal Data for training at any time by navigating to the ‘Data use’ menu”); enterprise contracts exclude it.", "evidenceUrl": "https://elevenlabs.io/privacy-policy", "retention": "Request history is kept by default; zero-retention mode (enable_logging=false) is an enterprise-plan feature.", "zeroRetention": "enterprise-only", "receivesForAi": "narrated chapter text, voice samples, lyrics", "ourControls": [ "Your cloned voiceprint is deleted at the vendor the moment you delete the voice or your account (voice.ts).", "Zero-retention requests are armed with ELEVENLABS_ZERO_RETENTION=1 once the account is on an enterprise plan (voice.ts)." ] } }, { "id": "black-forest-labs", "name": "Black Forest Labs", "entity": "Black Forest Labs, Inc. — Freiburg, Germany / United States", "category": "ai", "purpose": "The author photo studio — professional portraits generated from a selfie you choose to upload.", "receives": "The selfie you upload and the portrait brief.", "region": "United States / European Union (regional endpoints)", "hostnames": [ "api.bfl.ai" ], "privacyUrl": "https://bfl.ai/legal/privacy-policy", "envKey": "BFL_API_KEY", "scope": "studio", "since": "2026-08-22", "ai": { "training": "opt-out-pending", "trainingNote": "Black Forest Labs may use prompts and uploaded images to improve its models unless the customer opts out (privacy@blackforestlabs.ai, “Training Opt Out”); enterprise contracts exclude it.", "evidenceUrl": "https://bfl.ai/legal/privacy-policy", "retention": "No fixed period published — “as long as is reasonably necessary”.", "zeroRetention": "not-offered", "receivesForAi": "a selfie and the portrait brief (only if you use the author photo studio)", "ourControls": [ "Entirely opt-in: nothing reaches this vendor unless you open the author photo studio and upload a photo.", "Generated portraits are stored on our side only; the vendor's download link expires within minutes." ] } }, { "id": "railway", "name": "Railway", "entity": "Railway Corp. — San Francisco, United States", "category": "hosting", "purpose": "Hosts the Bindery studio and the volume that holds book workspaces (manuscripts, sources, uploads, audio masters, chat history).", "receives": "Everything the studio processes, at rest on its volume and in transit through its edge.", "region": "United States (us-west2, California)", "hostnames": [], "privacyUrl": "https://railway.com/legal/privacy", "dpaUrl": "https://railway.com/legal/dpa", "scope": "studio", "since": "2026-06-01" }, { "id": "google-cloud", "name": "Google Cloud / Firebase", "entity": "Google LLC — Mountain View, United States (Google Ireland Ltd. for EU customers)", "category": "data", "purpose": "Accounts and sign-in (Firebase Auth), the shared account database (Cloud Firestore), durable workspace snapshots and author portraits (Cloud Storage), and the fallback email transport.", "receives": "Account profile, plan and credit records, notifications, support conversations, the audit log, book snapshots.", "region": "United States (Firestore nam5 multi-region; Cloud Storage us-central1, Iowa)", "hostnames": [ "firestore.googleapis.com", "storage.googleapis.com", "firebasestorage.googleapis.com", "identitytoolkit.googleapis.com" ], "privacyUrl": "https://policies.google.com/privacy", "dpaUrl": "https://cloud.google.com/terms/data-processing-addendum", "envKey": "FIREBASE_PROJECT_ID", "scope": "both", "since": "2026-06-01" }, { "id": "stripe", "name": "Stripe", "entity": "Stripe, Inc. — San Francisco, United States (Stripe Payments Europe Ltd. for EU customers)", "category": "payments", "purpose": "Payments, memberships, refunds, invoices, and author payouts (Stripe Connect). Card numbers never touch our servers.", "receives": "Email, name, billing country, purchase history, payout details for authors who sell.", "region": "United States / European Union", "hostnames": [ "api.stripe.com" ], "privacyUrl": "https://stripe.com/privacy", "dpaUrl": "https://stripe.com/legal/dpa", "envKey": "STRIPE_SECRET_KEY", "scope": "both", "since": "2026-06-01" }, { "id": "sendgrid", "name": "Twilio SendGrid", "entity": "Twilio Inc. — San Francisco, United States", "category": "email", "purpose": "Delivers transactional and lifecycle email (sign-in codes, order updates, release notes).", "receives": "Email address, name, the content of the messages we send you.", "region": "United States", "hostnames": [ "api.sendgrid.com" ], "privacyUrl": "https://www.twilio.com/en-us/legal/privacy", "dpaUrl": "https://www.twilio.com/en-us/legal/data-protection-addendum", "envKey": "SENDGRID_API_KEY", "scope": "both", "since": "2026-06-01" }, { "id": "lulu", "name": "Lulu Press", "entity": "Lulu Press, Inc. — Morrisville, North Carolina, United States", "category": "print", "purpose": "Prints and ships bound copies through its global print network.", "receives": "Recipient name, shipping address and phone, the print-ready files of the book you order.", "region": "United States, with printing near the destination", "hostnames": [ "api.lulu.com" ], "privacyUrl": "https://www.lulu.com/privacy-policy", "envKey": "LULU_CLIENT_KEY", "scope": "both", "since": "2026-06-01" }, { "id": "google-analytics", "name": "Google Analytics 4 & Google Ads", "entity": "Google LLC — Mountain View, United States", "category": "analytics", "purpose": "Product analytics and advertising measurement — asked first in Europe, the UK and Switzerland (Consent Mode v2); cookieless pings until you say yes.", "receives": "Pseudonymous identifiers and page events; conversions are reported server-side without card or content details.", "region": "United States", "hostnames": [ "www.google-analytics.com", "googleads.g.doubleclick.net" ], "privacyUrl": "https://policies.google.com/privacy", "scope": "both", "since": "2026-06-01" }, { "id": "ip-geolocation", "name": "ipwho.is / ipapi.co", "entity": "IP geolocation services (United States / European Union)", "category": "geo", "purpose": "Country lookup for pricing currency and regional rules — the IP address only, nothing else.", "receives": "IP address.", "region": "United States / European Union", "hostnames": [ "ipwho.is", "ipapi.co" ], "privacyUrl": "https://ipapi.co/privacy/", "scope": "studio", "since": "2026-06-01" }, { "id": "apple", "name": "Apple App Store", "entity": "Apple Inc. — Cupertino, United States", "category": "app", "purpose": "In-app purchases in the Infinite Library iOS app.", "receives": "Transaction identifiers (no name or email).", "region": "United States", "hostnames": [ "api.storekit.apple.com", "api.storekit-sandbox.apple.com" ], "privacyUrl": "https://www.apple.com/legal/privacy/", "envKey": "APPLE_IAP_KEY_ID", "scope": "studio", "since": "2026-08-20" }, { "id": "vercel", "name": "Vercel", "entity": "Vercel Inc. — San Francisco, United States", "category": "hosting", "purpose": "Hosts the Infinite Library website (www.infinitelibrary.ai), including its guides, reader and the proxied landing.", "receives": "Request logs; the website's own data as described in the Privacy Policy.", "region": "United States / global edge", "hostnames": [], "privacyUrl": "https://vercel.com/legal/privacy-policy", "dpaUrl": "https://vercel.com/legal/dpa", "scope": "website", "since": "2026-06-01" } ], "nonPersonalServices": [ { "name": "Unsplash", "purpose": "Stock photo search for covers and pages.", "receives": "Search terms only.", "hostnames": [ "api.unsplash.com" ] }, { "name": "youtube-transcript.io", "purpose": "Captions for public YouTube videos you paste.", "receives": "Public video ids only.", "hostnames": [ "youtube-transcript.io" ] }, { "name": "IndexNow", "purpose": "Tells search engines a published storefront changed.", "receives": "Our own public URLs.", "hostnames": [ "api.indexnow.org" ] }, { "name": "Frankfurter", "purpose": "Daily exchange rates, so prices show in your currency.", "receives": "Nothing — a public rates table.", "hostnames": [ "api.frankfurter.dev", "api.frankfurter.app" ] } ], "changelog": [ { "date": "2026-09-10", "note": "Trust Center published: sub-processor register, AI training posture per vendor, retention schedule, online DPA, data export, audit log, security.txt." } ] }