Last updated: June 3, 2026
This Privacy Policy explains how Anthra (“Anthra”, “we”, “us”) processes personal data when you create an account, write books, narrate chapters, publish them, or otherwise interact with our service at anthra.com (the “Service”). It is written to satisfy the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR.
Anthra is the data controller for personal data processed through the Service. Questions about this policy, data-subject requests, and complaints can be sent to will.schulz@aw3.tech. Security disclosures can be sent to will.schulz@aw3.tech.
Legal basis: performance of the contract you enter into by creating an account (Art. 6(1)(b) GDPR).
Legal basis: performance of the contract; you control whether each book is private, unlisted, or public.
Legal basis: our legitimate interest in operating a secure, reliable service (Art. 6(1)(f) GDPR). We retain these records for 90 days and then delete them.
When a visitor opens a published book or plays a chapter we log a coarse, pseudonymous identifier derived by HMAC from the visitor’s IP address, user agent, and a daily server-side key that we do not retain. We use this only to count unique readers and identify drop-off points. We do not link this to any individual reader.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can object — see Section 9.
We use cookies that are strictly necessary to keep you signed in and to protect the Service from CSRF attacks. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details and controls.
We use carefully selected service providers (“sub-processors”) under Article 28 GDPR data-processing agreements. The current list:
A current, dated sub-processor list is maintained in our public repository and is available on request. We notify you at least 14 days before adding a new sub-processor that handles personal data.
Most of our sub-processors are based in the United States. Where personal data is transferred outside the EEA / UK we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU–US Data Privacy Framework. A copy of the relevant SCCs and a description of supplementary measures can be obtained from will.schulz@aw3.tech.
We protect personal data with industry-standard controls: TLS in transit; encrypted storage at the sub-processor layer; Argon2id password hashing; per-tenant access scoping; rate limiting; CSRF defenses; isolated secret storage; and least-privilege access for engineers. We disclose confirmed personal-data breaches to the competent supervisory authority within 72 hours where required and notify affected users without undue delay.
Prompts, premises, and chapter prose are sent to Anthropic, Perplexity, and ElevenLabs to produce the requested output. We call these providers via the Vercel AI Gateway under a zero-data-retention configuration where supported. We do not consent to providers using your content to train models.
Anthra is not directed to children under 16, and we do not knowingly collect personal data from anyone under that age. If you become aware that a child has provided us with personal data, contact will.schulz@aw3.tech and we will delete it.
Under the GDPR and UK GDPR you have the right to:
We send transactional email (verification, password reset, billing receipts) on the legal basis of contract performance and cannot opt out of these while you have an account. We send marketing email only if you explicitly opted in at signup; you can unsubscribe at any time using the link in any marketing email.
If we make material changes we will notify signed-in users by email and in-product, at least 14 days before the change takes effect. Material changes will require renewed acceptance. The effective date at the top of this page is the date of the current version.