Canon Pack Lite Privacy Policy

Effective: 25 April 2026 · Last updated: 25 April 2026

Plain-English summary. This site is a marketing page, not a product. It collects almost nothing: standard server logs and any emails you choose to send us. We do not use cookies, trackers, or analytics on this Site. We do not sell or share personal data with advertisers. We do not use anything submitted through this Site to train AI models. Pilot or commercial engagements operate under separately negotiated data terms.

1. Scope

This Privacy Policy explains how Living Literature, operated by Rayan B. Vasse ("we," "us," "our"), handles personal information collected through the Canon Pack Lite website at cplite.living-literature.org (the "Site"). Canon Pack Lite is referred to throughout this Policy as "CP-Lite."

This policy covers the public marketing Site only. Pilot or commercial engagements are governed by separately negotiated data-processing terms set out in the applicable Data Processing Addendum (DPA) or equivalent agreement.

2. What we collect through the Site today

The Site is a static marketing site with minimal data collection:

Server logs. Standard web-server logs (IP address, browser user-agent, page accessed, timestamp) maintained by our hosting provider, Vercel. Retained per Vercel's default retention policies and used for service reliability and abuse prevention.
Email correspondence. If you email us at rayan@living-literature.org, we retain the email and any information you choose to share for the purposes of responding, following up, and (where applicable) discussing a pilot or engagement.
API endpoint requests. The endpoints listed at /api/ are documentation stubs. They do not currently process or store user-provided content beyond standard server-side request logging.

We do not currently use cookies, tracking pixels, third-party analytics, fingerprinting, session storage, or any client-side persistence on the Site.

3. What we do not do

We do not sell personal information.
We do not share personal information with advertisers.
We do not profile visitors for marketing purposes.
We do not use data submitted through the Site to train AI models.

4. Future data handling under pilot or commercial engagements

When a publisher, author, platform, or institution engages CP-Lite under a separate agreement:

Manuscripts, configuration data, and reader-interaction logs are processed only as specified in the executed agreement.
A separate Data Processing Addendum (DPA) is signed where personal data crosses borders or where regulatory frameworks (such as GDPR or CCPA) apply.
Content is processed by third-party large-language-model providers under their respective data-handling commitments, which are disclosed at the time of engagement.
The publisher or rights holder retains ownership of all manuscript content, reader data, and governance configurations. We act as a processor on the controller's instructions.

5. Third-party processors we rely on

Hosting: Vercel (Site and API endpoints).
DNS / registrar: IONOS.
Future operational stack: Supabase (database), commercial large-language-model providers (model inference), and email services. Specific processors are disclosed at engagement.

Each third party operates under its own privacy and security commitments, available on their respective sites.

6. Your rights

Depending on your jurisdiction (including but not limited to the European Economic Area, the United Kingdom, and the State of California), you may have the right to:

Access the personal data we hold about you
Correct or update inaccurate personal data
Request deletion of personal data, subject to operational and legal retention requirements
Object to specific processing activities
Withdraw consent where processing relies on consent
Lodge a complaint with a supervisory authority

To exercise any of these rights, contact rayan@living-literature.org. We respond to verifiable requests within the timeframes required by applicable law.

7. Security

We rely on standard infrastructure-level security provided by our hosting providers, plus standard transport-layer encryption (HTTPS) for all Site traffic. We do not store sensitive personal information on the public Site.

For pilot or commercial engagements, additional security commitments are set out in the executed agreement, including, where appropriate, encryption at rest, role-based access controls, audit logging, and breach-notification procedures.

8. International data transfers

The Site is operated by Rayan B. Vasse, based in [OPERATING LOCATION TO BE CONFIRMED]. Server infrastructure may be located in multiple regions consistent with our hosting provider's edge architecture. By using the Site, you acknowledge that information may be processed across borders consistent with applicable law. For pilot or commercial engagements involving personal data, appropriate transfer mechanisms (such as Standard Contractual Clauses where applicable) are addressed in the DPA.

9. Children

The Site is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the Site, contact us and we will delete it.

10. Changes to this Policy

We may update this Privacy Policy from time to time. Changes are effective when posted at this URL with an updated "Last updated" date. Material changes affecting any executed agreement will be communicated through the channels specified in that agreement.

11. Contact

Privacy questions and requests: rayan@living-literature.org.

Note on legal review. This Privacy Policy is a preliminary framework for a public marketing Site. It is not a substitute for legal advice. Pilot or commercial engagements involving personal data require separately negotiated data terms (DPA, SCCs where applicable, vendor sub-processor disclosures) reviewed by your own qualified legal counsel and ours.