Original tools for authors,created by an author.

Service provider / media owner

HSP Content Production
Owner: Heinz Siegfried Pestner
8181 Dörfl an der Raab 101
Austria

Email: iac@gmx.at
Phone: +43 699 10626119

Business purpose

Development and provision of digital, AI-assisted creative and marketing tools for authors, publishers and content producers, particularly for book marketing, cover concepts, press materials, trailer workflows and book websites.

Supervisory / trade authority

Where trade-law provisions apply: District Authority of Weiz, Styria. Applicable Austrian legislation can in particular be accessed through the Federal Legal Information System (ris.bka.gv.at).

Disclosure under Section 25 Austrian Media Act

Media owner and publisher: Heinz Siegfried Pestner / HSP Content Production, address as stated above.

Editorial direction: Information about books, storytelling, publishing, digital creative production and AI-assisted tools and services for book marketing and author communication, including presentation of own project examples and creative references.

Payments & subscriptions

Paid subscriptions and credit top-ups are sold through Payhip; payment is processed through Stripe as connected to Payhip. Final price, applicable taxes, billing interval and payment conditions are displayed before completion in the Payhip checkout. HSP Author Tools receives only the transaction and status information required for provisioning and accounting, not complete card details.

AI and rights notice

HSP Author Tools creates AI-assisted text, concepts, images and websites. Outputs may contain errors and must be reviewed for factual, legal, technical and creative suitability before publication. Users are responsible for having the necessary rights to uploaded or entered content and for lawful use of generated outputs. AI outputs are not warranted to be unique or free from third-party rights.

External links

This website may link to external services and platforms. The respective external provider is responsible for its content and privacy practices. External services are contacted only after the user actively opens the corresponding link, except for technical services explicitly described in the Privacy Notice.

1. Controller

HSP Content Production
Heinz Siegfried Pestner
8181 Dörfl an der Raab 101, Austria
Email: iac@gmx.at
Phone: +43 699 10626119

1a. Controller / processor role split for business customers

For account administration, subscriptions, billing, credits, security, fraud/abuse prevention, support and HSP compliance purposes, HSP generally acts as an independent controller. Where a business customer acts as controller and submits personal data inside manuscripts, reference material or other customer content solely for execution of a selected tool in HSP Author Tools, HSP may act as a processor under Article 28 GDPR.

For that processor relationship HSP provides a separate Data Processing Agreement (DPA/AVV), including current technical and organisational measures, sub-processor information and feature-specific retention rules. Special-category, Article 10 and children's personal data are not intended for processing unless expressly agreed and lawfully/technically approved in advance.

2. Data processed

Depending on use, HSP Author Tools may process account and contact data, book/profile information, campaign and workspace data, Reader Loop configurations and scan/click events, service usage and credit events, security/session data, Terms and purchase-consent records, payment/subscription status information, and content actively submitted for AI processing such as prompts, manuscript text or PDF files.

Complete card data is not received by HSP Author Tools.

3. Purposes and legal bases

Data is processed to create and manage accounts, provide requested AI and publishing services, synchronize workspace data, administer subscriptions and credits, prevent fraud and abuse, maintain system security, respond to support requests and meet legal obligations. Depending on the processing activity, legal bases include performance of a contract or pre-contractual steps, legitimate interests in secure and reliable operation, legal obligations and consent where required.

4. Hosting / delivery

The Author Tools website is delivered through the configured hosting/CDN environment. Normal technical connection data such as IP address, timestamp, requested resource, browser/user-agent and security information can be processed by hosting/network providers as necessary to deliver and protect the service.

5. Accounts, database and workspace – Supabase

Supabase is used for authentication, database functions, Edge Functions and workspace synchronization. Account identifiers, book profiles, generated-output metadata, subscription/credit information, security events, Terms acceptance and other service data necessary for operation can be processed there. Row Level Security and server-side functions are used to restrict access.

More information: Supabase Privacy.

6. AI generation – OpenAI API

When a user actively starts text, cover, website, Book DNA, Virtual Beta Reader, series, metadata, editorial or manuscript-correction processing, the profile, prompt and, where required, manuscript data needed for that request is sent server-side to the OpenAI API. DOCX, EPUB and TXT text extraction takes place locally in the browser. The original manuscript file is not stored in the HSP workspace. Exception: in the Book-to-Audiobook workflow the extracted, normalized chapter text is stored persistently (see section 6c). Very long text may be reduced to distributed excerpts for resource-efficient analysis. PDF analysis can send the PDF at a low visual-detail setting.

For Book DNA, only the resulting structured profile is stored in the workspace, not the original manuscript. Editorial reports can be saved in the book profile. Auto Polish processes text chunks and reassembles corrected text in the browser; the complete corrected novel is not persistently stored in the HSP workspace.

For Book-to-Screenplay Studio, the selected manuscript is transmitted in sections for the requested server-side AI processing. The original manuscript is not stored as a persistent screenplay source file in the workspace. The Adaptation Blueprint, technical job metadata, generated screenplay sections and the completed Screenplay Development Draft may be stored so an already generated result can later be reopened and exported.

According to OpenAI's current API data controls, API inputs and outputs are not used to train OpenAI models by default unless the organization explicitly opts into data sharing. API content may be retained for abuse monitoring for a limited period under the applicable OpenAI API data-retention configuration.

Please do not submit sensitive personal data, confidential third-party manuscript information or content without appropriate rights. More information: OpenAI API Data Controls.

Format Studio: When e-book and print files are created, the manuscript is read, typeset and packaged locally in the browser only; the files are downloaded directly to your device and are not stored in our workspace. For unlocking and the structure check, only chapter headings, word counts, short chapter openings (up to 140 characters) and short heading-like lines are processed server-side and sent to the OpenAI API for that purpose; the cover stored in the book profile may also be sent to generate alt text. We store the unlock period, word count, a manuscript checksum and export events (format, trim size, template).

Print Cover Studio: The finished wrap PDF is generated locally in the browser from the front cover, approved back-cover copy and calculated page/trim data and is not stored in our workspace. An optional high-resolution front cover loaded only for print stays local to the current browser session and is not uploaded or stored. The backend stores only the 30-day unlock and cover-export events with page count, trim size and paper type.

6.1 Discoverability Studio – OpenAI Web Search

When a signed-in user explicitly starts Market Intelligence, selected book-profile information such as title, genre, description, audience, comparable-title context, Book DNA and an optional author-edited Book Bible is sent server-side to OpenAI so the service can formulate web-search queries and analyze current public sources. The feature uses OpenAI's hosted web-search capability and stores the resulting market report, source URLs, citation metadata, target market and timestamp in the user's private workspace. HSP does not submit the original manuscript to web search for this function.

Web research can contact or retrieve information from public third-party websites through the provider's search infrastructure. Users should therefore avoid including confidential unpublished information, sensitive personal data or trade secrets in fields used for Market Intelligence. Public listings, prices and market conditions can change and must be rechecked before business decisions.

6a. Trailer Audio Studio - xAI, ElevenLabs & Stability AI

When a signed-in user actively requests a voice-over in Trailer Audio Studio, the required narration text, selected preset voice identifier, selected model and technical request metadata are sent server-side to the selected Voice Engine, xAI or ElevenLabs. xAI use requires an additional provider confirmation before generation. HSP Author Tools does not offer custom voice cloning in this workflow. When a user requests trailer music, the already verified Trailer Music Prompt, requested duration and model/technical parameters are sent server-side to Stability AI.

The resulting audio is relayed to the user's current browser session for listening and download and is not persistently stored as a reusable audio asset in the HSP workspace. So that an interrupted transfer does not leave a paid but lost result, the file is kept briefly (by default for up to 7 days) in your private storage area and then deleted automatically. For billing, abuse prevention, idempotency and security, HSP may store generation metadata such as user/book identifiers, a random client request identifier, provider/model, input hash, HSP credit amount, status, output byte count, consent confirmations and timestamps. API keys remain server-side.

Provider-side processing and retention are governed by the respective provider terms, privacy notices and contractual settings. Users should avoid including unnecessary sensitive personal data and must have the necessary rights to submitted material.

6b. AI video - fal.ai / Features & Labels

When a signed-in user actively starts Complete Trailer, HSP Author Tools sends the required shot prompts and, where selected, temporary signed URLs for character/reference images to fal.ai / Features & Labels, Inc. The provider returns technical queue identifiers and generated video URLs. Later production steps can also send approved shot URLs, temporary title-card images and temporary audio URLs to fal.ai composition services. Legacy in-flight jobs created before the current hybrid pipeline may still finish an already-started upscaling task.

HSP stores job metadata needed for billing, idempotency, progress, abuse prevention and recovery, including user/book IDs, target duration, HSP credit reservation, model/endpoint identifiers, prompt hashes, fal request/status information, consent confirmations, shot status and output URLs. The FAL API key remains server-side. Character references and temporary audio/title-card assets are stored in a private Supabase bucket for the production workflow. Provider output URLs and retention are governed by fal.ai's applicable terms and settings; HSP does not promise permanent storage of provider-hosted video files. fal.ai may process service/usage data under its then-current provider terms and contractual settings; HSP does not control provider-side retention beyond those settings.

Do not submit unnecessary sensitive personal data. Users are responsible for having a lawful basis and all necessary rights/consents for reference images and identifiable people.

6c. Book-to-Audiobook - persistent manuscript & audio processing

For Book-to-Audiobook, the manuscript text required for the Audiobook Blueprint and dialogue-attribution analysis can be sent server-side to OpenAI. HSP may use distributed excerpts for the initial cast/production analysis and the relevant chapter text for dialogue attribution. The normalized manuscript text is then stored chapter by chapter, together with its checksum, the editable Audiobook Blueprint, cast and narrator settings, pronunciation entries, speaker segmentation, production-job metadata and finished chapter masters in a private Supabase workspace so the project can be resumed and selectively regenerated later. These audiobook project contents remain until the user deletes the audiobook project or storage is otherwise removed in accordance with account/legal retention requirements.

When the user explicitly starts chapter production, the text required for each voice block, the selected provider voice identifier and technical synthesis metadata are sent server-side to the Voice Engine selected in the Audiobook Blueprint: xAI (standard) or ElevenLabs (optional). xAI use is additionally gated by an explicit provider disclosure confirmation inside the Audiobook Blueprint. Voice blocks and chapter MP3 masters are stored in a private Supabase bucket. For chapter mastering, temporary signed audio URLs may be sent to fal.ai / Features & Labels, Inc.. For an optional M4B master, temporary audio and technical chapter/metadata information may be processed by CloudConvert. Provider API keys remain server-side. Provider-side processing and retention are governed by the respective provider terms, privacy notices and contractual settings.

Users should not upload unnecessary sensitive personal data or third-party confidential manuscripts and must have the required rights to the manuscript and intended audio use. Deleting the audiobook project removes project records and known private audio assets under the service's deletion workflow, subject to provider-side temporary copies and mandatory legal retention requirements that HSP cannot unilaterally shorten.

6d. BookCast Studio - OpenAI, xAI / ElevenLabs, CloudConvert & private MP3 storage

BookCast uses the manuscript-derived Book DNA already stored in the selected book profile. Structured Book-DNA content may be sent server-side to OpenAI to create the spoiler-safety boundary, podcast script and subsequent spoiler check. The original manuscript does not need to be uploaded again for BookCast. The BookCast project stores the generated script, spoiler-safety information, production status, selected voice provider/voices and, where applicable, a spoken-title form used only for TTS.

During audio production only the text segment required for the relevant host turn, the selected preset voice ID, language and technical synthesis parameters are sent to xAI or ElevenLabs. Temporarily signed segment URLs and technical audio information may be processed by CloudConvert for final MP3 mastering. The finished MP3 master is then stored in the private Supabase bookcast-assets bucket and delivered through time-limited signed URLs. Temporary segment files are removed by the production workflow after successful mastering. Provider API keys remain server-side.

Provider-side processing and retention are governed by the applicable terms, privacy notices and contractual settings of OpenAI, xAI, ElevenLabs and CloudConvert. Users should not include unnecessary sensitive personal data in BookCast scripts and must have the required rights in the book, names and intended audio use.

6e. Publishing House Workspace collaboration data

If a user creates or joins a Publishing House Workspace, HSP Author Tools processes the workspace name, membership role, account email, invitation status, linked-book identifiers and limited catalogue/workflow information, comments, approval decisions, activity events and team-level credit-usage summaries needed to provide collaboration. Invitation links use random time-limited tokens; only a cryptographic hash of the token is stored server-side. The raw token is shown to the inviter so it can be shared with the intended recipient.

Linked books expose only the collaboration data required by the Workspace, such as title, author, genre, workflow completion flags and campaign types. The Workspace does not automatically expose manuscript text, private Book DNA content, private AI media files or the full contents of generated campaigns. Comments and approvals are visible to members of that Workspace. Users should therefore invite only people who should receive the relevant project information and should remove access when collaboration ends.

Team usage figures are management information derived from completed HSP credit events for workspace members. They are not accounting, payroll or financial statements. Workspace owners and administrators can see more membership and usage detail than Editor, Marketing and Viewer roles where required to administer the Workspace.

7. Payment processing – Payhip & Stripe

Payhip is used as the commerce and checkout platform for paid subscriptions and credit top-ups. Payment data is processed by Stripe or another payment method offered through Payhip. HSP Author Tools receives product, transaction, subscription, refund and status data as well as secure checkout metadata needed to associate a purchase with the correct account, but does not receive complete payment-card data.

Depending on Payhip settings and applicable law, Payhip may calculate or handle certain digital taxes/VAT in checkout. The actual Payhip tax configuration and legal obligations for the transaction remain decisive.

More information: Payhip Privacy · Stripe Privacy.

8. Contact

If you contact us by email, the contact details and message content you provide are processed to handle your request. The contact form on this website does not itself submit data to our server; it opens your local email application with prepared text. The legal basis depends on the request and can include Article 6(1)(b) or (f) GDPR.

8a. Optional newsletter and email preferences

If you voluntarily subscribe to the HSP Author Tools newsletter, we process your account email address, consent status, consent/version timestamps and technical provider references required to manage the subscription. The newsletter uses a double-opt-in process through Brevo; marketing emails are sent only after separate confirmation. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw this consent at any time in the account settings or via the unsubscribe link in a newsletter.

Newsletter consent applies only to optional marketing communication. Account, security, billing, legal, service-critical and transaction-related messages may be sent independently where required to provide the service, perform a contract, protect the service or meet legal obligations.

9. Local storage, referrals and Reader Loop statistics

HSP Author Tools uses the Meta Pixel only after an explicit, optional marketing consent. Without that choice, the Meta Pixel script, tracking pixels and advertising cookies are not loaded. Essential storage for login, security and the requested workspace remains independent of marketing consent. If a visitor opens an HSP affiliate referral link, the visitor is asked for consent before the affiliate code, a random referral-session identifier and capture time are stored in first-party browser storage for up to 30 days. If consent is declined, the referral parameter is removed and no 30-day affiliate attribution storage is created. Affiliate reporting stores referral relationships, confirmed sale amounts, commission amounts, payout status and the affiliate's PayPal payout email where provided. Public Reader Loop pages also record server-side page scans and actively triggered outbound clicks so authors can understand use of their printed QR links. Raw IP addresses and raw User-Agent strings are not persistently stored. To reduce duplicate reloads and estimate unique readers, technical connection data is converted into a pseudonymous daily HMAC fingerprint; coarse country, device category and referrer host may also be stored. These data are used only for Reader Loop statistics, service security and abuse limitation.

Technically necessary browser storage such as Local Storage or Session Storage can be used for login/session support, security functions, workspace state and requested convenience features. Meta advertising measurement is separate and is activated only after your optional express consent.

The Supabase browser library is currently loaded through jsDelivr; the CDN provider therefore receives normal connection data when that library is loaded. A future build may host the library locally to remove this additional request.

Meta advertising measurement (currently active only with consent): With the optional “Allow marketing” choice, HSP Author Tools loads the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin D04 X2K5, Ireland (Pixel ID 1446636747595244). It measures website visits (PageView) and verified new registrations (CompleteRegistration) to assess the effectiveness of HSP advertisements. Depending on the visitor's browser and ad interaction, Meta may receive the page URL and referrer, timestamp, technical browser/device details, IP address, Meta click identifiers and cookies such as _fbp and _fbc, and may associate these with an existing Meta account. Meta may process those data for advertising measurement and, subject to its applicable terms and settings, for other Meta business-tool purposes. Where legally applicable, HSP and Meta share responsibility for the collection and transfer of pixel event data; Meta is responsible for further processing within its services under its own privacy terms. See Meta Privacy Policy and Meta Business Tools Terms for details, data-subject contact options, retention and any transfers outside the EEA (including applicable safeguards).

The legal basis for the optional access to and storage of information on your device and related personal-data processing is your explicit consent (Art. 6(1)(a) GDPR, § 165(3) Austrian TKG 2021). Before consent, neither the Meta Pixel nor Meta advertising cookies are loaded. Declining does not restrict the requested Studio features. You can change or withdraw consent for future processing at any time under “Marketing cookies” in the footer. We make a best-effort deletion of first-party Meta cookies on withdrawal; this cannot undo data already transmitted or automatically remove data retained by Meta. The local choice is saved for at most 180 days before it needs to be renewed. Newsletter consent and affiliate attribution are separate decisions. HSP does not deliberately include manuscript text, email addresses, checkout/payment data or generated content in pixel events; Payhip checkout redirects do not trigger an asserted purchase. Server-side Meta Conversions API, advanced matching and customer-list uploads are not enabled in this version.

9.1. Google services – current use and future options

Currently: Google Search Console is used to verify domain ownership and review how the public website appears in Google Search. The verification HTML file is not a visitor analytics tag. An optional time-based one-time password (TOTP) setup can be used with Google Authenticator or another compatible authenticator app; the TOTP process itself does not require sending website visitor activity to Google. External YouTube videos are currently opened through links instead of loading an automatic embedded player. Google Analytics 4, Google Ads conversion/remarketing tags and Google Tag Manager are not currently enabled as visitor-tracking tools on this website.

Only if activated in a future version: HSP may offer Google Analytics 4 for aggregated website measurement (e.g. page views, source, interactions, approximate location/device details) and/or Google Ads conversion measurement and remarketing (e.g. ad clicks, registration conversions and pseudonymous identifiers). Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, would be a relevant recipient. Depending on the specific tags and settings, Google may process IP address, browser data, page addresses, interaction and conversion events, cookie identifiers such as _ga, _ga_* and _gcl_*, and data outside the EEA under applicable safeguards and provider rules. Details: Google Privacy Policy and Google Business Data Responsibility.

These future services are not authorised by the current Meta marketing choice and will not be switched on merely because they are described here. Before any activation, HSP must provide updated, service-specific information and obtain appropriate, granular consent for optional analytics and advertising; enable refusal and withdrawal; configure and verify Google Consent Mode v2 with appropriately denied defaults for analytics_storage, ad_storage, ad_user_data and ad_personalization; and check provider settings, international data transfers, retention and third-party arrangements. No future Google conversion event, audience upload, enhanced conversion, automatic YouTube embed or marketing tag will be activated without that review. The applicable consent basis would be Art. 6(1)(a) GDPR and § 165(3) TKG 2021 where required.

9a. Withdrawal and cancellation declarations

If you use “Withdraw from contract” or “Cancel contracts here”, we process your name, email address, contract details, optional notes and the date and time of receipt to handle the declaration and send the legally required acknowledgment (Art. 6(1)(b) and (c) GDPR). These data are kept for the duration of statutory evidence and retention obligations.

10. External links and YouTube

Sample and trailer areas generally open external platforms through links rather than automatically embedding videos. Merely opening HSP Author Tools therefore does not automatically load a YouTube video. The external provider's privacy terms apply once the user opens its link.

11. Retention

Accounts and workspace content are generally retained for as long as needed to provide the service and maintain the user account, or until deletion, subject to statutory retention requirements. Usage and security data is retained only as long as needed for billing, abuse prevention, technical security or legal obligations. Reader Loop event statistics are designed for an operational window of approximately 13 months; older events are excluded from author-facing statistics and should be periodically deleted. Payment, order and invoice data held by Payhip and Stripe is subject to their respective statutory and contractual retention requirements.

12. Your rights

Subject to the GDPR, data subjects may in particular have rights of access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn for the future where processing is based on consent.

To exercise rights, contact iac@gmx.at. You also have the right to lodge a complaint with the Austrian Data Protection Authority.

13. Data security

Technical and organizational measures are used to protect personal data, including server-side secrets/API keys, access controls, Row Level Security, credit and rate limits, session checks and abuse protection. Registration and login may additionally use the configured CAPTCHA provider (Cloudflare Turnstile or hCaptcha), which processes technical connection and security data necessary to detect automated access and abuse. No internet-based service can guarantee absolute security.

14. Changes to this Notice

This Privacy Notice is updated when technical functions, providers or legal requirements change. The current version is made available through HSP Author Tools.