Privacy and Device Storage Policy

1. Controller and contact

The controller for MangaVerba (https://mangaverba.com) is: Grupa MangaVerba. Contact contact@mangaverba.com about privacy, notices or data rights. Controller details remain to be supplied; this document is a draft.

An ordinary request does not require an identity-document scan or national identification number. We first use available authentication methods to establish whether a request concerns your account. We request additional information only where there are reasonable doubts and only as necessary.

2. Scope

This information concerns visitors, account holders, correspondents and people whose data may appear in submitted material. It does not govern an independent source website you visit.

The Service is for reading comics, not processing identity documents, health information, professional secrets or other sensitive material. Do not submit others’ personal data without an appropriate legal basis. An image, text or source address can itself contain personal data.

3. Data categories and sources

• Account: the email you provide, password hash, identifier, role, registration and verification dates, any account restriction, point balance and transactions. We do not store plaintext passwords.
• Authentication: hashes of session identifiers and single-use email-verification or password-reset tokens, and their validity dates.
• Reader: source and image addresses you select, page identifiers, series and chapter titles, languages, acquired access, extracted and translated text, bubble positions, page classification and personal edits.
• Bonus protection: a SHA-256 hash of the normalised mailbox, claim date and account association until deletion. Normalisation includes “+” aliases and Gmail dots. This hash is not complete anonymisation; it can be compared with an email supplied again.
• Traffic and security: IP address, request time and URL, browser details, and errors, limits and provider information. IP is not a column in our account database but may be processed by Cloudflare infrastructure and logs.
• Correspondence: your messages, reply address and attachments you choose to send. We collect no card number or Paddle transaction data because payments have not launched.

4. Purposes, legal bases and providing data

• Creating and maintaining accounts, authentication, requested translation, the library, edits and point accounting: performance of a contract or pre-contractual steps (GDPR Article 6(1)(b)).
• Email verification, password reset and necessary service messages: contract performance (Article 6(1)(b)). These are not marketing messages.
• Abuse prevention, one-time bonuses, security, diagnostics and defending claims: legitimate interests in protecting the Service, users and operator rights (Article 6(1)(f)), balanced against the individual’s rights and circumstances, particularly those of minors.
• Complaints and data-rights requests: contractual and applicable legal duties (Article 6(1)(b) and (c)). Ordinary correspondence and infringement notices: legitimate interests in responding and investigating, or Article 6(1)(c) when law requires action.

Email and password are optional but necessary to create an account. Content and chapter information are necessary for the feature you request. We may be unable to resolve a request without enough information to identify it.

We do not sell data for marketing, send a newsletter or build advertising profiles. If a future operation requires consent, we will request it separately. Refusal or withdrawal does not alter the lawfulness of earlier processing.

5. Images and translation results

A selected image is prepared in your browser. Online images may be retrieved through our proxy. Sections needed for translation are sent to the active model provider with instructions, the target language and limited context from earlier sentences.

We do not append your account email, password or balance to a translation request. The image or context may nevertheless contain a person’s data; do not submit such data without a legal basis.

Images are not stored in the translation database. Cloudflare’s proxy may cache a retrieved image for up to 24 hours. Independently, the AI provider may retain data under its applicable terms. We do not promise zero retention across all providers.

The database stores source text, translations and display information. Results for public-address pages may be reused for other accounts. Device-upload results use account-specific keys; the library and personal edits are not shown to other accounts. Technical privacy does not replace rights in submitted material.

6. Providers and other recipients

• Cloudflare, Inc. — hosting, image proxy and cache, D1, traffic protection, DNS and logs. The current D1 database operates in a European region; other infrastructure, support or processing may involve other countries.
• Resend — transactional email: recipient address, subject, content, the necessary verification or reset link, and delivery status. The eu-west-1 region concerns sending, not exclusive storage location; Resend documentation states US storage.
• Anthropic (Claude, including Haiku) or Google (Gemini), depending on active configuration — images, text and context necessary for translation. Not every provider receives every request.
• OpenRouter, when selected — routes the request to the selected or automatically chosen model provider. Direct OpenAI API use is also possible after configuration. Downstream providers may have different retention and content-use practices.
• Authorised Service personnel and recipients to whom disclosure is legally required, such as competent authorities. Information from a notice is disclosed to another party only insofar as justified and lawful.

Recipients may act as processors or as independent controllers for their own security, billing or legal duties. We do not automatically assign the same role to all recipients.

Interface files and fonts are served from our own domain. We have not added advertising tools, Google Analytics or mobile SDKs. Opening an external website also engages that operator’s practices.

7. Use of content for AI training

We do not use submitted comics to train our own model. Reusing a stored answer in the reader is result caching, not model training.

Provider terms differ between APIs, plans and settings. We do not make a blanket promise that every available model has no retention or improvement use. Anthropic distinguishes its commercial API from Claude.ai; OpenRouter explains that downstream providers’ practices may differ.

Google distinguishes paid and unpaid services and regional terms. For EEA users, API-client availability requirements and data-use terms must be considered separately. Before a provider is made available to a particular user group, its applicable plan, contract and settings must be verified. Accepting this Policy does not replace that verification.

Current information: ai.google.dev/gemini-api/terms, privacy.claude.com and openrouter.ai/privacy. You can ask contact@mangaverba.com about the active provider and applicable conditions.

8. Transfers outside the EEA

Providers or their subprocessors may process data in the US and other countries outside the European Economic Area. A European database or email-sending region does not mean all processing stays in the EEA.

A transfer requires an appropriate GDPR Chapter V mechanism, such as an applicable adequacy decision covering the particular certified recipient, or standard contractual clauses and the necessary safeguard assessment. We do not rely on implied consent from website use.

You can request information or a copy of applicable safeguards from contact@mangaverba.com, subject to protection of confidential information and other people’s data. This draft still requires confirmation of contracts and mechanisms for every enabled provider; publishing this clause does not itself establish them.

9. Retention periods and criteria

• Active database: account data, the library, personal edits and point history remain while the account is maintained. Deletion removes these records from the active database; justified correspondence, evidence and the data below may be treated separately.
• A login session is valid for 30 days, a verification link for three days and a reset link for one hour. Validity is a usage deadline, not a promise that every record is physically deleted at that instant. Inactive records are removed through account operations or account deletion.
• The mailbox hash used for a bonus remains after account deletion, without its account-record association, while the one-bonus policy operates. It is used solely to prevent repeat awards; you can object or request review of continued necessity.
• Shared results and page keys remain for rereading. They currently have no short automatic expiry. Account deletion removes its identifier but does not guarantee that the text, address or upload key is anonymous. A personal-data erasure request can cover these records and requires separate assessment.
• Image proxy cache: up to 24 hours. Workers Logs on the current Free plan: up to three days. D1 point-in-time history on this plan: up to seven days. Deleting an active record does not immediately remove every historical copy.
• Resend’s current documentation specifies 30-day email and log retention on standard plans and seven-day backups. AI providers apply their own retention periods and legal or security exceptions; not having agreed a shorter period is not a zero-retention promise.
• Correspondence and case records remain until resolution; necessary evidence remains longer only for the applicable legal duty or period of pursuing or defending a specific claim. There are currently no user purchase records because sales are unavailable.

Device settings and cached translations remain until you delete them, the browser removes them or the reader cache replaces them. Account deletion does not guarantee deletion of every file or local record from browsers on all your devices.

10. Cookies and local storage

The current application uses no advertising or analytics cookies. The items below support login, selected preferences and requested reader storage. The consent exception in Article 399 of Poland’s Electronic Communications Law covers only storage or access genuinely necessary for transmission or a service you request, not all possible cookies.

• mr_session — login cookie, up to 30 days; HttpOnly, SameSite=Lax and Secure over HTTPS. Logging out removes it from the current browser.
• mr-locale — local storage of your manually selected interface language, until deleted or overwritten.
• mr-settings — local reader preferences, such as translation language and text size, until deleted or overwritten.
• mr-tl:… and mr-tl-index — local translation text and cache index, at most 400 pages; oldest entries may be replaced, with no fixed expiry.
• mr-admin-engine — the administrator’s local model selection, until deleted or changed.

You can remove or restrict these items in browser settings. Blocking the session affects staying signed in; disabling local storage may prevent settings and translation caching. On a shared device, sign out and clear reader storage.

If we add optional analytics, advertising or other operations requiring consent, we will obtain it before activation and provide refusal and withdrawal controls.

11. Rights and response times

Subject to GDPR conditions, you have rights of access and a copy, rectification, erasure, restriction and, for automated processing based on contract or consent, portability. Not every right applies unconditionally to every data category.

You can object on grounds relating to your situation to processing based on legitimate interests. We assess whether overriding grounds justify continuing. Consent-based processing can be stopped by withdrawing consent without affecting earlier lawfulness.

Send requests to contact@mangaverba.com. A reader account can also be deleted in account settings. If the feature is unavailable for your role or you need broader erasure, contact us. Administrator privileges do not remove data rights.

We normally respond without undue delay and within one month of receiving a request. In legally permitted cases of complexity or multiple requests, this can be extended by two further months; we explain the reason within the first month. Requests are normally free of charge, subject to GDPR exceptions.

You may complain to Poland’s President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl, or the competent supervisory authority where you habitually live, work or believe an infringement occurred.

12. Automated checks and human review

The system automatically checks prior bonus claims, temporary-email domains and request limits, and classifies pages for 10- or 15-point charges. A match or model can be wrong.

We do not perform marketing profiling. If an automated check denies a bonus, restricts access or mischarges points, you can present your position and request human review at contact@mangaverba.com. Describing a process as “technical” does not remove any applicable GDPR Article 22 rights.

13. Minors — planned mode

The Service is not directed to children under 13. Launching the planned ages 13–17 mode requires age safeguards, guardian involvement and compatible provider configuration. This draft does not confirm those steps have been completed.

The current form does not collect birth dates, identity documents or guardian confirmation. We therefore do not claim that age has been technically verified. Contact us if a child’s data or unauthorised use is identified so necessary restrictions and erasure can be assessed.

Capacity to contract, AI provider requirements and data-processing consent are separate issues. Where a service offered to a child relies on consent, the applicable GDPR Article 8 threshold and guardian-verification rules must be met; it is not automatically a 13-year threshold.

14. Security and Policy updates

We use HTTPS, PBKDF2 password hashing, hashed tokens and account and administrator access controls. No measure guarantees complete protection against incidents. Report suspected breaches to contact@mangaverba.com; we will also assess notification duties towards authorities and affected people.

When processing changes, we update this document and its date and give appropriate Service or email notice of material changes. Continued use does not replace required consent or authorise any arbitrary new purpose.

This draft requires controller details and confirmation of procedures, retention and provider contracts. It is not a GDPR compliance certification; actual operations must match the information given.