Privacy

What we collect

• Your email address, if you buy an eBook (GoCardless passes us the address you give when you pay by bank) or join the mailing list.
• Order records: what you bought, when, and the payment reference.
• Download activity against your own links, so we can spot broken ones.
• Visit records - the page, the time, your browser type, your internet (IP) address and the country it comes from, and the country you choose if you answer "where are you reading from?" - kept 90 days, for security (spotting and blocking abusive bots) and to count visitors. An address caught attacking the site (for example probing for admin pages or filling hidden form fields) stays on our block list until we remove it.
• Anything you send through the feedback form.
• If you have an account: your email, display name, a scrambled (hashed) copy of your password and of your identification number (never the number itself; each character is scrambled separately so 4 of them can be checked at sign-in), how long you chose to stay signed in, and a counter that lets "sign out" end every session.
• If you sign in with Google: the permanent Google account number, name and verified email address Google shares when you choose to continue in Google's own sign-in window. We never see your Google password. We keep the account number to recognise you next time; nothing else is shared with Google by us.
• The language you choose for the site (a cookie on your device, a year).
• Which menu items, eBooks and page buttons are clicked, counted as daily totals only - never linked to you, your address or your account.
• The country you choose when you first visit, and the answer when we ask on a later visit whether it is still right. It is kept in a cookie on your device and used to show prices, tax and the right choice of eBooks for where you are reading.
• If you publish with us: your country of tax residence and, for US residents, the tax declaration you sign (your typed name, the time and your internet address) — kept for as long as the law requires for tax records. We never ask for a Social Security or other tax identification number.

We do not see or store card details or bank log-ins at any point. A bank payment is approved in your own bank's app and processed by GoCardless Ltd, which holds the payment details under its own privacy notice.

Publisher identity checks (Veri-ID Safe)

If you publish with us we ask, once, for a short camera recording of your face and a photo of your passport or national identity card, with the machine-readable lines from it if you choose to type them. We use them only to confirm that a real person stands behind the rights declaration and the royalty payments on your eBooks, and to prevent fraud and impersonation.

• Special category data. A recording of your face used to identify you is biometric data. We process it only with your explicit consent, given on the check page before the camera turns on (UK GDPR Article 9(2)(a)); the document is processed to take steps before and to perform our publishing agreement with you, and to meet our legal duties on fraud.
• How it is checked. Software on our own server compares the head movements with the order we asked for, and your face with the photo on the document; the check digits in the machine-readable lines are verified. The result may be decided automatically. If it goes against you, you can ask for a person to look at it again, explain your side, and challenge the decision - write to us at the address below. Passing these checks shows the document is internally consistent and matches you; it is not a confirmation from the issuing authority.
• Where it is kept. On our own server, in a private store that is never published, never shown to readers or other authors, and never used for advertising or to train any system. Only a site administrator can open it, and every opening is recorded in a log that cannot be edited.
• How long. The recording and the document photo are deleted automatically 365 days after an accepted check, or 90 days after a check that was not accepted or not decided. The outcome (accepted or not, and when) is kept for as long as you publish with us and then as long as the law requires for payment records.
• Your choices. You can withdraw consent and ask us to delete the recording and document at any time; that also withdraws the verification, and eBooks cannot go on sale until a new check is done.

What we do with it

Deliver your purchase, answer support questions, and — only if you asked — email you when a new eBook is out. We do not sell or share your data, and we do not run advertising trackers.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Mailing list unsubscribe is one click and takes effect immediately. Order records are kept as long as tax law requires.

Cookies

Only what is needed to make the site work. No analytics or advertising cookies are set. The ones we use: your sign-in (lasting as long as you chose when signing in), the language you chose (a year), the country you chose (a year) and whether you confirmed it this visit (until you close the browser), and - on the sign-in and create-account pages - a one-time check that lasts 10 minutes and makes a Google sign-in work only in the browser that started it. The site remembers on your own device whether you dismissed the "install the app" bar; that never leaves your device.

The "Continue with Google" button on the sign-in and create-account pages is loaded from Google (Google Ireland Limited / Google LLC), which may set its own cookies when you use it, under Google's privacy policy. It is not loaded on any other page.

Data controller contact: ebookyou@outlook.com · Registered with the Information Commissioner's Office, registration number ZC258750