Processing index

Please wait. I am processing all the chapters of your book. This operation may take up to 1 minute.

Privacy Policy

under Article 13 of Regulation (EU) 2016/679 (“GDPR”)

Last updated: 21 August 2026

At a glance

We process the data needed to manage accounts, book creation, payments, digital files, printing, delivery and support. User-provided content is also processed through artificial intelligence systems. Optional analytics and marketing tools on the Site remain off until the user provides the relevant consent.

1. Data controller

Surf Publishing S.r.l.
Via Rignano 17/B – 52011 Bibbiena (AR), Italy
VAT No. 02485200519 – REA AR 220177
Privacy email: privacy@plottybot.com

2. Data we process

3. Source and requirement to provide data

Data comes from the user, their device, the systems used to provide the service and the providers involved in payment, printing and delivery. Data marked as required is needed to create an account, fulfil an order or provide a book; without it, the relevant function cannot be completed. Analytics and marketing data is optional, and refusing it does not restrict the wizard, purchase, reader, editor, download or printing.

4. Purposes and legal bases

5. Artificial intelligence and automated decisions

Book instructions and materials are sent to AI systems integrated into the service, including services supplied by OpenAI or equivalent technical providers, to generate, check or transform text and images. Output is automated and probabilistic and must be reviewed by the user.

PlottyBot does not use these systems to make decisions producing legal or similarly significant effects on users. Operational print review and submission may involve authorised personnel.

6. Third-party content and sensitive data

The service does not request special categories of personal data. A user may nevertheless voluntarily include information about themselves or others in a book. Users should avoid health, biometric, political, religious, sexual, criminal or other particularly sensitive data unless strictly necessary and supported by a valid legal basis. Where third parties or minors are concerned, the user is responsible for the required information and permissions; Surf Publishing processes such content only to provide the service and handle related obligations.

7. Recipients and providers

Data is available only to authorised personnel and providers performing necessary activities within their respective roles:

Depending on the activity, providers act as processors, independent controllers or sub-processors.

8. Transfers outside the European Economic Area

Some providers may process data in the United States or other countries. Where required, transfers rely on adequacy decisions, including the EU–US Data Privacy Framework for participating organisations, European Commission standard contractual clauses or other safeguards under Articles 44 et seq. GDPR. Information on the applicable safeguards may be requested from privacy@plottybot.com.

9. Retention

Residual backup copies may remain for technical overwrite cycles and are protected and not used for ordinary purposes.

10. Security

Surf Publishing applies technical and organisational measures proportionate to risk, including access controls, protected connections, backups, updates and limitation of accessible data. No system can guarantee absolute security; users must protect their credentials and retain copies of files they wish to keep after expiry.

11. Data subject rights

Users may request access, rectification, erasure, restriction, portability and objection and, where processing relies on consent, withdraw it without affecting prior lawfulness. They may object to direct marketing at any time.

Requests may be sent to privacy@plottybot.com. Reasonable identity verification may be required. Users may also complain to the Italian Data Protection Authority or the authority in their country.

12. Children and updates

The service is intended for adults. If Surf Publishing learns that an account was created by a child without valid authorisation, it may restrict or delete it. This Policy may be updated for legal or operational changes; material changes will be highlighted appropriately.

Hi. How can I help you?