Privacy policy
Last updated: July 10, 2026 · Version 2.0
1. Who we are
OnTopic ("the Service"), available at be-on-topic.com, lets you generate personalized books with the help of artificial intelligence and receive them on an e-reader.
The Service is operated by Colin Galtier, currently as an individual (not yet incorporated), based in Toronto, Ontario, Canada.
- Contact address: 18 Yonge Street, Toronto, ON M5E 1Z8, Canada
- Email: contact@be-on-topic.com
For any question about your personal data or to exercise your rights, email contact@be-on-topic.com.
2. Our approach: data minimization
We collect only the data strictly necessary to run and personalize the Service. We do not sell your data, we do not use it for advertising, and we do not use marketing trackers.
3. What data we process, why, and on what legal basis
Where the GDPR applies (visitors in the EU/UK), the legal basis is shown below. In Canada (PIPEDA) and the United States, we process this data to provide the Service you request and as permitted by applicable law.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email and password (password is hashed, never stored in clear text) | Create and secure your account, sign you in | Performance of a contract |
| Google account basic profile (email, name) — only if you choose Google sign-in | Authenticate you via Google | Performance of a contract |
| Your answers to the creation questions | Generate and personalize your book | Performance of a contract |
| The generated books | Provide, display, and deliver your books | Performance of a contract |
| Kindle email address — only if you add it | Send your books to your Kindle | Performance of a contract |
| Dropbox access tokens (encrypted) — only if you connect Dropbox | Deliver your books to your Kobo e-reader | Performance of a contract |
| Order data: amount, promo/gift code, status, payment session identifier | Process your payment, manage your access | Contract and legal obligation (accounting) |
| Technical usage and security logs, and anonymous audience measurement (journey events, timestamps; no cookie and no data that identifies you in the measurement events). An IP address may be processed briefly (24 hours maximum) solely for anti-abuse rate limiting, with no link to the measurement. | Run the Service, prevent abuse, monitor technical costs, and produce anonymous journey statistics to improve the Service | Legitimate interest |
| Session token (hashed) and session cookie | Keep you signed in | Performance of a contract |
| Proof of acceptance of the Terms and Privacy Policy (timestamp, policy version) | Evidence of your agreement | Legal obligation / legitimate interest |
We never store your payment card data. Payments are processed directly by our provider Stripe (see section 5).
4. Artificial intelligence processing
To generate your book, the topic you choose and your answers are sent to our AI provider, Anthropic, which produces the text.
- This content is used only to generate your book at your request.
- Under Anthropic's commercial API terms, this content is not used to train the AI models: by default, Anthropic does not use the inputs or outputs of its commercial products for training, and you retain your rights to what you submit.
5. Who we share data with (subprocessors)
We use technical providers that process certain data on our behalf, solely to operate the Service:
| Provider | Role | Data involved |
|---|---|---|
| Anthropic | AI text generation | Topic and creation answers |
| Stripe | Payment processing | Payment data (card handled by Stripe), email |
| Resend | Sending emails (verification, reset, delivery) | Email address |
| Google sign-in (if used) | Google account identifier and profile | |
| Google Analytics | Audience measurement (only if you consent, see section 9) | Anonymized browsing data, measurement cookie identifier |
| Dropbox | Delivery to Kobo e-reader (if connected) | Book files, access tokens |
| Amazon | Delivery to Kindle by email (if used) | Kindle email address, book file |
| Railway | Hosting of the Service and database | All account data |
6. International data transfers
The Service is operated from Canada and several providers are located in the United States and elsewhere. Where required (for example for EU/UK visitors), such transfers are covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
7. How long we keep your data
- Account and books: kept while your account is active. You can delete your account at any time; your data is then erased.
- Billing records: kept for the period required by applicable tax and accounting law (approximately 6 to 7 years under Canadian/US rules).
- Technical logs: kept for a maximum of 12 months, then deleted or anonymized.
8. Your rights
You can access, correct, delete, or export your personal data, and object to or restrict certain processing. To exercise these rights, email contact@be-on-topic.com. Account deletion is available in the Service.
Depending on where you live, you also have specific rights:
- EU / UK (GDPR): access, rectification, erasure, portability, restriction, objection, and the right to lodge a complaint with your supervisory authority (in France, the CNIL, www.cnil.fr; in the UK, the ICO).
- Canada (PIPEDA): access to and correction of your personal information, and the right to complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).
- California (CCPA/CPRA): the right to know, delete, and correct your personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information, and we will not discriminate against you for exercising your rights.
9. Cookies and audience measurement
We use three categories:
- Strictly necessary cookies (keeping your session, and cookies set by our payment provider Stripe during a payment, for fraud prevention). These are essential to run the Service and do not require your consent.
- Anonymous, cookie-free audience measurement (internal to the Service): we measure your journey through the Service in aggregate (for example, at which steps visitors stop) using a random, temporary session identifier, with no cookie and no data that identifies you in the measurement events. An IP address may be processed briefly (24 hours maximum) solely to limit abuse, with no link to the measurement. This is used only to improve the Service and is shared with no third party.
- Google Analytics measurement cookies: these are placed only with your prior consent. On your first visit, a banner lets you accept or decline as easily as one another. Until you accept, no Google Analytics cookie is placed. You can withdraw your consent at any time via the "Manage cookies" link in the footer; we then disable the measurement and delete the corresponding cookies.
We use no advertising cookies and no trackers for marketing targeting.
10. Sensitive data
The Service is not intended to process sensitive data (health, opinions, religion, etc.). Please do not enter sensitive information in your creation answers, as it could appear in the generated book and be processed by our AI provider.
11. Minors
The Service is for people aged 18 or older. We do not knowingly collect data about minors.
12. Changes to this policy
We may update this policy. For material changes, we will notify you by email or through the Service. The last-updated date appears at the top of this document.
13. Contact
For any question: contact@be-on-topic.com.
← Back to OnTopic