Privacy policy.

1. Who is the data controller

Ink & Chapter, Inc., a Delaware C-corporation at 535 Mission Street, 14th Floor, San Francisco, CA 94105. Data Protection Officer: privacy@inkandchapter.com. We have a named DPO, not an outsourced one.

2. What we collect

When you submit the lead form: name, email, phone (optional), genre, project stage, budget range, timeline, and the message you write. When you become a client: billing address, contract signatures, communication via email and project tools. When you visit the website: standard server logs (IP, referrer, user-agent) and analytics events if you have consented (see cookies below).

3. Why we collect it

Lead-form data is used to evaluate fit and respond. Client data is used to deliver the engagement and comply with US tax law. Server logs are used for security and debugging. Analytics is used to understand which pages help authors find what they need.

4. Legal basis (GDPR)

For EU and UK visitors: lead-form data is processed on the basis of pre-contract necessity (Article 6(1)(b)). Client data is processed on the basis of contract performance (Article 6(1)(b)) and legal obligation (Article 6(1)(c) — tax records). Analytics is processed only if you have given explicit consent via the cookie banner (Article 6(1)(a)).

5. Who sees your data

Inside the studio: only the people assigned to your project, plus the founder and the head of operations. Outside the studio: Stripe for payment processing, Resend (or similar) for transactional email, Cloudflare for DNS and security, and Google Analytics 4 if you consent to analytics. We do not sell your data, ever.

Your manuscript is never used to train an AI model. We do not paste manuscripts into ChatGPT, Claude, Gemini, or any model whose terms allow training on submissions.

6. How long we keep it

Lead-form submissions: 24 months from submission, then deleted. Client project files: 7 years from final delivery (US tax record minimum). Billing and contract records: 7 years. Server logs: 90 days. Analytics: 14 months. Cookies: see the cookie policy.

7. Your rights (GDPR + CCPA)

You can ask for a copy of your data, a correction, a deletion, a portable export, or a restriction on processing. Email privacy@inkandchapter.com. We reply within 30 days, usually within 5 business days.

California residents (CCPA): same rights, plus the right to opt out of "sale of personal information," which we do not do regardless. You may also designate an authorized agent to make requests on your behalf.

8. Cookies

The first time you visit, a banner asks for your consent to analytics and marketing cookies. Strictly necessary cookies (session, security, language preference) do not require consent. Detailed list on the cookie policy page.

9. SMS consent (TCPA / 10DLC)

If you opt in to SMS on the lead form, you may receive transactional messages about your enquiry. Message frequency varies (typically 1–3 per project). Reply STOP to opt out at any time. Carrier message and data rates may apply. Our 10DLC campaign ID is filed with The Campaign Registry; reach out to sms@inkandchapter.com for the ID.

10. Data security

Encryption in transit (TLS 1.3) and at rest (AES-256). Manuscripts are stored in an access-controlled folder accessible only to the project team. Two-factor authentication is required for all employees. We have not had a data breach since founding; if we did, we would notify affected clients within 72 hours per GDPR requirements.

11. International transfers

The studio operates from California. EU and UK personal data transferred to us is covered by Standard Contractual Clauses (SCCs) and our supplementary measures (encryption, access controls). If you want a copy of the SCCs, email privacy@inkandchapter.com.

12. Children

The studio does not knowingly collect data from children under 13 (US) or 16 (EU). We work with adult authors. If a child has used the form by mistake, contact us and we will delete the data immediately.

13. Changes to this policy

We will email clients on file at least 14 days before any material change takes effect. For non-material changes, we update the "last updated" date at the top of the page. Historical versions available on request.

14. Real staff names

Every person who works on your project is named, has a LinkedIn, and uses their real name. We do not assign pseudonyms to staff. This sentence is here because a number of competitors in our category openly state in their privacy policies that staff use "fictitious names" — and the audit our founder ran of those competitors flagged this as a trust failure. We disagree with the practice. Read the team page for the full list.