Privacy Notice

01Information held by the service

• Account information: your name, email address and password hash, together with session and sign-in security records. Account records store a password hash rather than a plaintext password.
• Creative work: projects, manuscripts, chapter versions, AI proposals, approval decisions, rights and licensing metadata, and generated book editions.
• Source material: files, recordings, images, submitted URLs, filenames and other file metadata, extracted text chunks, reviewed excerpts, source hashes and provenance records.
• Workflow records: administrator-issued coupons, stage redemptions, reversals and audit events. Historic service records may remain alongside the current workflow.
• Optional Google connection information: authorization state, an encrypted refresh token used to maintain the connection you request, and identifiers of files you select in Google’s Picker. Selected file identifiers can be stored before you import a file.

02Why this information is used

The service uses this information to provide accounts, store and process your chosen sources, support manuscript review, record permissions and human approvals, produce book exports, administer coupons, and investigate service or security issues. Audit records trace important account and workflow actions.

The current application has no advertising or marketing analytics features. Bakul Ilmu does not sell personal data or train models using your content.

03Storage and access

Cloudflare provides the hosting infrastructure. Structured application records are stored in Cloudflare D1; source files, extracted text files and generated exports are stored in Cloudflare R2. These providers process information needed to deliver and operate the service. This notice does not promise storage in a particular country.

Private project and file requests in the application require the owner’s account session. Administrator screens provide access to account, coupon, stage and audit records. The operator administers the service and its stored data. These controls do not amount to a guarantee that loss, misuse or unauthorized access can never occur.

04Connecting Google Drive

Google connection is optional. File selection takes place through Google’s hosted Picker after you authorize the connection. The drive.file permission can allow viewing, editing, creating and deleting files selected or opened with the app.

Bakul Ilmu itself uses the connection to read file metadata and import copies of the files you select. The current application does not modify or delete files in your Google Drive.

Refresh tokens are stored encrypted. Disconnecting removes the stored connection token and attempts to revoke the Google authorization. Copies already imported, extracted text, reviewed excerpts, drafts, exports and audit records remain in Bakul Ilmu after disconnection. Request deletion separately through the contact address below.

Bakul Ilmu’s use and transfer of Google API information will follow the Google API Services User Data Policy, including Limited Use requirements.

05Optional AI processing

AI actions send selected content to OpenAI only after consent for that action. Editing sends the chosen chapter and editing instructions. Draft generation sends the selected approved excerpts and author brief. OCR sends a selected image or rendered PDF page. Transcription sends the selected recording.

Returned text and proposals are stored for human review. Uploading or importing a source does not by itself request AI processing. You may decline an AI action and continue with manual work where the workflow supports it. OpenAI’s processing is governed by its own service terms and privacy practices; this notice does not make a provider-wide training or retention promise.

06Private work and public editions

Final publication is private by default. A final edition is listed publicly only when you explicitly choose public visibility during Publish. The public catalogue and downloads then expose that selected edition and its published information. Original source files and private project records are not automatically added to the public catalogue.

An administrator can reverse a publication and stop its availability through the application. Copies already downloaded or shared outside the service cannot be recalled. Contact osman@siaraya.com if you need a public listing reviewed or removed.

07Cookies and local browser data

The app uses essential session cookies to keep you signed in and a temporary connection cookie when you link Google. These cookies support account and connection security; they are not advertising cookies.

The app also keeps upload-resume metadata in your browser’s local storage: the project and source identifiers, filename, file size and last-modified value. This helps match an interrupted upload to the same original file. The resume record is removed after successful completion. The app does not store uploaded file contents or Google tokens in browser local storage.

08Retention and your requests

The current application has no self-service account or content deletion and no published fixed retention period. Disconnecting Google, closing your browser or reversing a stage does not automatically delete stored content or its audit history.

You can download available book exports from your workspace. For access to other account data, correction, a data export or deletion, contact osman@siaraya.com and identify the relevant account or project. We may need to verify account ownership and review related operational and audit records before deciding what can be changed or removed. No automatic deletion deadline is promised here.

09Contact and updates

Privacy contact: osman@siaraya.com. Operator: Osman AlHaddad.

Updates to this Privacy Notice will appear on this page with an updated effective date.