Sub-processors

1. What this page is for

1.1. To run the service we rely on outside companies: hosting, a database and sign-in, object storage, language models, machine translation, speech synthesis, email, analytics. Several receive data about you or text you read. Most of them are our sub-processors: they handle it on our instructions and only within the limits we set. Some are not — free tiers and a decentralised network that receive text under their own public terms; section 4 says which, and what that means.

1.2. The operator of books.dev and the controller of your personal data is NewGen Books LLC, a limited liability company of the State of Wyoming, United States, 30 N Gould St Ste N, Sheridan, WY 82801, USA. We are answerable for who gets access to your data.

1.3. This page is the full list. We keep it public so you can see who receives your data and where it is processed before deciding to use the service. How we handle data ourselves is in the /privacy; this page covers only outside recipients.

2. The list

2.1. Our own infrastructure — application, database, sign-in and object storage — runs in Frankfurt, inside the EEA. Most of the language-model vendors do not: see sections 4 and 5.

2.2. Both analytics tools receive reports of errors in the page, and they receive different things: Google Analytics gets only the name of the failure and a short description, with no location in the code; PostHog gets the full report with the stack, in its EU region and only if you allowed it. Server errors are logged by Google Cloud, our host. No separate error-monitoring vendor is connected. There are no third-party advertising or tracking cookies on the site.

2.3. Covers and narration audio are served from s.books.dev and books.dev, both on Google Cloud. Google, as our host, sees your IP address and the time of each of those requests, as it does for every page; no other storage operator is involved.

2.4. The two analytics vendors do not start at the same moment. Google Analytics loads with your first page view, before the cookie banner is answered. PostHog loads only after you press "Continue" on that banner, sends nothing before you do, and stops if you withdraw. The /cookies has the detail, and the /privacy gives the legal basis for each.

2.5. Not in the list above because they receive no personal data: Telegram, which carries alerts to the operator about failures; open.er-api.com, which supplies exchange rates for displayed prices; Higgsfield, which draws cover pictures from a short image description with no book text and nothing about you; Iconify, a public icon library queried with a single word by our server; and GitHub, which hosts our source code and runs deployments.

3. Payments: no payment provider yet

3.1. Paid plans are not on sale yet: the service is in beta, and no payment provider is connected. Nothing is charged, and no card or billing details are collected.

3.2. The checkout page takes only an email address, so that we can write to you when a plan opens. That address is kept in our own database (Supabase, above) and goes to no other vendor; see the /privacy.

3.3. The planned payment provider is Stripe, as merchant of record, which would make it an independent controller of the payment rather than our sub-processor. When paid plans open, this page will say so in full, with the notice described in section 6. The sale itself is described in the /terms.

4. Models, and what may be trained on

4.1. Earlier editions promised that your data goes only to vendors contractually barred from training on it. That is not how the service runs, so the promise is withdrawn and here is what actually happens.

4.2. Words and sentences you select are processed by language-model and translation vendors from the list above; which of them handles a given request can vary. Groq's free tier, DeepL API Free and Cloudflare's free Workers AI plan are free services, and GonkaRouter is a decentralised network whose nodes we do not choose. Their terms may allow them to retain the text they receive or use it, including to improve their models. The paid vendors handle it under their own terms.

4.3. This applies to words and sentences from public-domain books and equally to those from books you upload: a tapped word with its neighbours, a selected sentence, the passage being narrated, and a short extract of an uploaded book. What does not go is who you are — your name, email address, account identifier or IP address: our server makes the call.

4.4. We send no more text than the feature needs: a word with its neighbours, a sentence, or the passage being narrated. Catalogue editions are prepared separately, before publication, from public-domain text; no reader data goes into that work.

5. Transfers outside the EEA

5.1. The core infrastructure sits in Frankfurt, inside the EEA. Several vendors are nevertheless companies outside it, and data does leave the EEA.

5.2. The mechanism for each vendor is in the “Transfer mechanism” line of its entry: the Standard Contractual Clauses with supplementary measures and, where the vendor is certified, the EU-U.S. Data Privacy Framework. Where a vendor offers no data-processing agreement for the plan we use, the text it receives is governed by that vendor's own terms alone. NewGen Books LLC itself is not certified under the Data Privacy Framework and does not claim to be.

5.3. If you are in the European Economic Area or the United Kingdom, write to privacy@books.dev about any of this — the clauses covering a particular vendor, or a transfer you want explained — and you keep the right to complain to the supervisory authority of your own country.

6. Changes to this list

6.1. The list is not fixed. We may add a sub-processor, replace one with another, or drop one entirely.

6.2. Before we add a new sub-processor or replace an existing one, we give 30 days' notice by email to the address on your account.

6.3. If the change does not suit you, you have those 30 days to act: export your data, or delete the account before it takes effect. You can also object at privacy@books.dev.

6.4. We answer to you as controller for what our sub-processors do with your personal data. That is not a promise about the availability or quality of their services — see the liability section of the /terms.

7. Contacts

7.1. Questions about personal data, a data export, or the transfer mechanism for a particular vendor: privacy@books.dev. We answer within 30 days.

7.2. Legal questions: legal@books.dev. Copyright claims: copyright@books.dev. Support: support@books.dev. Security reports: security@books.dev.

7.3. Postal address for legal notices: NewGen Books LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.

This list was last updated on 17 October 2026.

Effective 17 October 2026