Privacy Policy
Effective date: 2026-09-13
Last updated: 2026-09-12
This Privacy Policy explains how Noveo Europ Ltd. (Company, we, us, or our) collects, uses, discloses, retains, and protects personal data when you use Lulliby and its related website, conversion, feed, Google Drive, support, and payment services (the Service).
1. Controller and contact details
The controller is:
Noveo Europ Ltd. Cyprus registration number: HE353199 Registered office: 1, Anastasiou Sioukri, Themis Court, 4th Floor, Flat 402, 3105 Limassol, Cyprus Privacy email: lullibynet@gmail.com
2. Scope
This policy applies to personal data processed through the Service. It does not govern Google, Stripe, AI providers, podcast applications, or other independent services that process data under their own policies.
3. Data we process
Account and Google profile data
We process your Google identifier, name, email address, profile image, sign-in information, encrypted OAuth access and refresh tokens, token expiry, and related account-security information.
Google Drive data
At your direction, we access or create selected Drive folders and files,
including EPUBs, audiobooks, generated audio, cover images, RSS feeds, file IDs,
names, types, sizes, permissions, and related metadata. We use the drive.file
scope where supported so access is limited to files created by or opened with
the Service.
Book, feed, and conversion data
We process audiobook titles and descriptions; author, language, chapter and page-range metadata; original filenames; source chapter text; selected model, voice, and quality; conversion status; provider identifiers; generated audio; feed URLs; errors; and usage information.
Although primary book and audio files are placed in Google Drive, the current conversion process may store source chapter text, staged or completed audio, job records, and error data on our application or conversion systems.
Feed and streaming data
We process feed and Drive file identifiers, request timing, streaming state, request counts, and streamed duration to operate and protect feeds. An unlisted feed or file may be accessible to anyone who obtains its URL. Podcast applications may independently download or cache content.
Billing and transaction data
We process Stripe customer IDs, checkout session and payment references, purchase amounts, currencies, taxes, credit balances, ledger entries, conversion charges, refunds, disputes, integrity holds, and billing status. Stripe processes payment-card and other payment credentials; we do not receive full payment-card numbers.
Analytics, technical, security, and communications data
We process IP addresses, device and browser information, timestamps, session, cookie and pseudonymous analytics identifiers, page routes, feature interactions, heatmap interaction data such as clicks and scroll depth, server and security logs, support communications, copyright notices, counter-notices, rights declarations, and records of policy acceptance.
When you consent to analytics, PostHog may use a stable pseudonymous identifier and, for signed-in users, an identifier based on the internal account ID. If you do not consent, the PostHog browser SDK is not loaded. Limited server-side analytics events may still be recorded without a persistent visitor or account identifier and without creating a PostHog person profile.
4. Why we process data and our legal bases
We process personal data as follows:
| Purpose | Typical data | GDPR legal basis |
|---|---|---|
| Create and administer accounts | Account and Google profile data | Contract |
| Access Drive and perform requested file operations | OAuth, Drive files and metadata | Contract; consent where required for a specific permission |
| Convert text to audio and generate feeds | Content, settings, job data, generated audio | Contract |
| Process credit purchases, refunds, taxes, and disputes | Billing and transaction data | Contract; legal obligation; legitimate interests |
| Secure the Service and prevent fraud or infringement | Logs, identifiers, usage, rights records | Legitimate interests; legal obligation |
| Provide support and communicate service information | Contact and communication data | Contract; legitimate interests |
| Comply with copyright notices, court orders, tax, accounting, and other law | Relevant account, content, and transaction data | Legal obligation; legitimate interests |
| Send optional marketing | Email and preference data | Consent, or legitimate interests where law permits |
Where we rely on legitimate interests, they include providing and improving a secure Service, enforcing agreements, preventing fraud and infringement, maintaining business records, and defending legal claims. You may request information about a particular balancing assessment.
We do not use consent as the legal basis for processing that is strictly necessary to perform a contract merely because you accepted the Terms. Where we request GDPR consent, you may withdraw it without affecting prior lawful processing.
5. Google API data
We use Google API data only to provide and improve user-facing features you request, maintain security, and comply with law. We do not sell Google user data, use it for advertising, or use it to train or improve a general-purpose AI model.
Lulliby's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We disclose Google API data to another provider only where necessary to provide the requested feature, with appropriate permission and safeguards, or where security or law requires it.
6. AI and text-to-speech providers
When you request conversion, we disclose the selected source text and conversion settings to AI gateway and the applicable model provider.
We retain responsibility for accurately describing our own practices, but each provider may process operational, abuse-prevention, or legally required records under its applicable terms.
Do not publish a promise of zero retention or no training until it has been verified contractually for every selected model and provider.
7. Recipients
We disclose personal data as necessary to:
- Google for authentication and Drive operations;
- AI gateways and selected text-to-speech/model providers;
- Stripe and related payment, tax, fraud, and banking providers; monitoring, email, support, and security providers
- professional advisers, auditors, insurers, and corporate transaction parties under confidentiality obligations;
- copyright claimants and affected users; and
- courts, regulators, law enforcement, tax authorities, or other recipients where required or permitted by law.
We do not sell personal data. We do not share personal data for cross-context behavioural advertising as those terms are used in applicable United States state privacy laws. If that changes, we will update this policy and provide required choices before beginning the practice.
8. International transfers
We are established in Cyprus. Providers and recipients may process data in the European Economic Area, United States. For transfers restricted by the GDPR, we rely as appropriate on adequacy decisions, the EU-U.S. Data Privacy Framework for certified recipients, European Commission standard contractual clauses, and supplementary safeguards.
You may contact lullibynet@gmail.com for information about the safeguard used for a particular transfer and how to obtain a copy, subject to lawful redactions.
9. Retention
We retain personal data only for as long as necessary to provide the Service, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements. Our default retention periods are:
- active account and project data is retained while the relevant account or project remains active;
- when an account is scheduled for deletion, access is disabled and eligible account and content data is placed in a restricted recovery state for up to 30 days, after which it is deleted or anonymised;
- encrypted Google OAuth tokens are deleted promptly when the Google connection is removed or the Service account is closed;
- chapter text stored by the application is retained while the relevant audiobook exists and is deleted when that audiobook is deleted;
- temporary chapter text and generated or staged audio held by conversion systems is deleted within 24 hours after a successful Google Drive upload and within 7 days after a failed or abandoned conversion;
- security and application logs are retained for up to 90 days, unless a particular record must be preserved for investigation or legal purposes; and
- deleted data may remain in restricted backups for up to 90 days before those backups are overwritten.
Files stored in your Google Drive remain under your control. Disconnecting Google access does not itself delete those files. When closing an account, the Service will identify whether supported Google Drive files will be deleted or left in your Drive.
We may retain limited billing, tax, acceptance, copyright, fraud, dispute, and legal records for longer where required by law or reasonably necessary for the establishment, exercise, or defence of legal claims. During that period, those records are restricted to the relevant compliance purpose.
Where deletion is requested as an applicable data-protection right, we process the request without undue delay and do not apply a recovery period where doing so would conflict with applicable law.
10. Your choices and rights
Depending on applicable law, you may have rights to:
- access and receive a copy of personal data;
- delete data;
- restrict or object to processing;
- withdraw consent;
- opt out of certain sale, sharing, targeted advertising, or profiling; and
- complain to a supervisory authority.
Submit requests through lullibynet@gmail.com. We may verify your identity and authority. We will not discriminate against you for exercising a privacy right. An authorised agent may submit a request where applicable law permits, subject to verification.
11. Account and Drive deletion
You can delete supported audiobook projects through the Service. Depending on the action shown, this may delete the corresponding Google Drive folder and files. Deletion cannot remove copies already downloaded by a podcast application or another person who obtained the URL.
To close your account, contact lullibynet@gmail.com. Revoking Google access alone does not close the Service account or delete all Service records. Closing the Service account does not automatically delete Drive files unless the product explicitly confirms that it will do so.
12. Security
We use organisational and technical measures designed to protect personal data, including encryption of OAuth tokens, transport encryption, access controls, logging, backups, and incident procedures. No system is completely secure.
Keep Google credentials and feed URLs confidential. Notify lullibynet@gmail.com promptly if you suspect unauthorised access.
13. Cookies
We use cookies and similar technologies. We request consent before using non-essential cookies where required.
14. Children
The Service is not directed to children and is available only to users aged 18 or older. We do not knowingly collect personal data directly from children. If you believe a child has provided data, contact lullibynet@gmail.com.
15. Automated decision-making
We may use automated checks to price conversions, detect technical abuse, or identify payment and security anomalies. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on users.
16. Changes
We may update this policy to reflect changes in the Service, providers, or law. We will post the updated version and revise the date above. We will provide additional notice or request consent where required for a material new use.
17. Contact
Privacy questions and requests: lullibynet@gmail.com Security reports: lullibynet@gmail.com Postal address: 1, Anastasiou Sioukri, Themis Court, 4th Floor, Flat 402, 3105 Limassol, Cyprus