Privacy
Kort in het Nederlands Trentelman AI Solutions, KvK 91686210, btw NL004908763B50 is verantwoordelijk voor Speedreader. Mail: [email protected]. Tekst die je alleen leest, blijft in je browser. Tekst die je laat samenvatten, gaat via onze server en OpenRouter naar het AI-model Google Gemini. Die tekst bewaren we niet. OpenRouter en Google houden hun eigen logs bij onder hun eigen voorwaarden. Er is geen account. Je tegoed hangt aan een pseudonieme wallet-id, gekoppeld aan Stripe-betalingen. In de database (Cloud Firestore in productie, SQLite lokaal) staan wallet-id, saldo, tijdstippen, Stripe-sessie, payment intent, charge-id, bedrag en terugbetaalde bedragen. Een terugboeking of geschil dat binnenkomt vóór de claim staat in een aparte tabel (charge-id, payment intent, terugbetaald bedrag, geschilbedrag en status). Tegen misbruik verwerken we IP-adressen: een limiet die alleen in het geheugen staat (minuten, weg bij een herstart), en een gezouten HMAC van het IP met een geheim dat alleen op de server staat. Die hash bewaren we hooguit 24 uur. Wallets met alleen gratis credits en geen activiteit verwijderen we na 180 dagen. Een wallet met een betaling houden we zolang het saldo boven nul is of er activiteit is. Na 3 jaar zonder activiteit verwijderen we die wallet alleen als het saldo 0 is en elke claim ouder is dan 180 dagen, zodat een betaling die nog betwist kan worden blijft staan. Een wallet met saldo boven 0 verwijderen we niet. Claims, betalingsgegevens en die terugboekingstabel bewaren we 7 jaar voor de belasting. Daarna blijft alleen een tombstone over: het Stripe-sessie-id en dat de betaling is geclaimd, zonder wallet-id of bedragen. Een Stripe-sessie-id is pseudonieme data, omdat Stripe die kan koppelen aan de kaarthouder. Die tombstone bewaren we onbeperkt, zodat dezelfde betaling niet twee keer credits kan krijgen. De wallet-id komt nooit in een URL. Serverlogs bevatten hooguit een korte hash van een wallet-id, niet het volledige id. Hostinglogs bewaren we hooguit 30 dagen. Ontvangers zijn OpenRouter, Google Gemini, Stripe, Google Cloud (hosting) en Cloudflare (netwerk en CDN). Gegevens kunnen in de Verenigde Staten terechtkomen. Heb je vóór deze update credits gekocht die nu weg zijn, mail ons met je Stripe-bon, dan zetten we ze terug. Je kunt je privacyrechten uitoefenen via het e-mailadres hierboven, of een klacht indienen bij de Autoriteit Persoonsgegevens.
Who is responsible
Trentelman AI Solutions, KvK 91686210, btw NL004908763B50 is the controller for Speedreader. You can reach us at [email protected].
What we use personal data for
Reading. Text you only read stays in your browser. We do not receive that document or pasted text, so we do not process it.
AI summary. Text you send for a summary goes through our server and OpenRouter (OpenRouter, Inc., USA) to the Google Gemini model. We do not store that text. OpenRouter and Google keep their own logs under their own terms. We send at most the first 35,000 characters, so we can give you the summary you asked for. The legal basis is performing that service (article 6(1)(b) GDPR).
Payments. If you buy credits, the payment is handled by Stripe, so we can carry out the purchase. The wallet id is pseudonymous and is linked to the Stripe payment. The legal basis is the contract (article 6(1)(b) GDPR). Payment records are also kept because Dutch tax law requires it. The legal basis for that is a legal obligation (article 6(1)(c) GDPR). If you bought credits before this update and they are missing, email [email protected] with your Stripe receipt and we will restore them. Older balances saved only in the browser were never checked against a payment, so we do not copy them over.
Fraud prevention. Stripe may use payment data to prevent fraud. The legal basis is legitimate interest (article 6(1)(f) GDPR).
Abuse prevention. To stop people collecting the free credits over and over, we process IP addresses. Rate-limit entries live only in memory for minutes and are cleared when the process restarts. We also keep a salted HMAC of the IP, made with a secret salt that stays on the server, for at most 24 hours, and only for that free-credit cap. IPv6 addresses are grouped by their network (/64) before hashing. The legal basis is legitimate interest (article 6(1)(f) GDPR).
Who receives data
The text you submit for a summary passes through our server to OpenRouter (OpenRouter, Inc., USA), which forwards it to the Google Gemini model. We do not keep the document text. Stripe receives the payment when you buy credits. The site is hosted on Google Cloud. Cloudflare provides the network and CDN in front of the site. We do not sell personal data.
Transfers outside the EEA
OpenRouter, Google (Gemini and Google Cloud), Stripe, and Cloudflare may process personal data in the United States. Where they do, that transfer is covered by the EU-US Data Privacy Framework and/or standard contractual clauses. See Google’s privacy policy, Stripe’s privacy policy, and Cloudflare’s privacy policy.
How long data is kept
Summary text is not stored. In the database (Cloud Firestore in production, SQLite for local development) we store the wallet id, the credit balance, the created and last-activity timestamps, and for a purchase the Stripe session id, payment intent, charge id, amount, currency, and refunded amounts (including a dispute amount and how many credits that removed). A refund or dispute that arrives before the purchase is claimed is stored in an adjustments table: charge id, payment intent, refunded amount, dispute amount, and dispute status. Claims, payment records, and those adjustment rows are kept for 7 years for tax, and then pruned. After a claim is pruned we keep a tombstone with the Stripe session id and a flag that it was claimed, and no wallet id or amounts. A Stripe session id is pseudonymous data, because Stripe can link it to the cardholder. That tombstone is kept indefinitely so the same payment cannot be credited again. A wallet that only ever held free credits, and that has had no activity for 180 days, is removed. A wallet that has had a payment is kept while its balance is above zero or while it is active. It is deleted after 3 years without activity only when the remaining balance is 0 and every claim is older than 180 days, so a purchase that can still be disputed is kept. A wallet with a balance above 0 is not deleted. A checkout session can be claimed for 30 days after Stripe creates it. The salted IP hash used for the free-credit cap is kept for at most 24 hours. Rate-limit entries live only in memory for minutes and are cleared on restart. The wallet id is never put in a URL. Server logs may contain a short hash of a wallet id, not the full id. Hosting logs are kept for at most 30 days. For anything Google holds, Google’s Gemini API terms apply. For anything Stripe holds, Stripe’s privacy policy applies.
Your rights
You can ask for access, correction, deletion, restriction, or a portable copy of your data, and you can object to processing. Email [email protected]. You also have the right to complain to the Autoriteit Persoonsgegevens.
Cookies
Our site sets no cookies. This browser keeps a pseudonymous wallet id in local storage so we can look up the credit balance. That is not an account. If you buy credits, you pay on Stripe’s own checkout page (on stripe.com). That page applies Stripe’s cookie policy and Stripe’s privacy policy.
Decisions, accounts, and selling data
We do not make automated decisions that produce a legal effect on you, or a similar significant effect. There are no accounts. We do not sell your data.