Privacy Policy

The short version

We collect as little as possible: the email address on your account and a record of what you bought. We never see your card details — payment providers handle those. We don't run advertising trackers or sell data to anyone.

1. Who we are

Babe's Bookstore is the data controller for the personal data described here. If you have questions about your data, contact support@babes-bookstore.example.

2. What we collect

• Account data — your email address and, if you register with a password, a salted hash of it (we cannot read your password). If you use "Sign in with Google", we receive your Google account email and name.
• Purchase records — what you bought, when, the amount, and your download history. We keep these so you can re-download your bundles and so we can meet tax obligations.
• Card data — never. Payments run through Stripe, PayPal and Square. Card numbers never touch our servers.
• Server logs — routine request logs (IP address, timestamps) kept briefly for security and troubleshooting.

3. Why we hold it (lawful bases)

• Contract — to run your account, deliver your purchases and provide re-downloads.
• Legal obligation — keeping records of sales for tax purposes.
• Legitimate interests — keeping the site secure and diagnosing faults.

We do not use your data for profiling or automated decisions, and we do not send marketing email unless you explicitly ask.

4. Who else sees it

Only processors we need to run the shop: our hosting provider (application hosting and database), our file storage provider (your downloads), our email provider (transactional receipts and support replies), and the payment providers (who are independent controllers of the payment data they collect). None of them may use your data for their own marketing.

5. Cookies and local storage

We don't use advertising or analytics cookies. The site stores a sign-in token in your browser's local storage so you stay logged in — clear it by logging out. Fonts are loaded from Google Fonts, which means Google receives your IP address as part of that request; if you prefer to avoid this, a browser extension such as uBlock Origin will block it.

6. How long we keep it

Account and purchase records are kept while your account is active, plus up to 6 years for tax-related records. Server logs are deleted within weeks. Download links expire much sooner — the window is shown at checkout.

7. Your rights

Under UK GDPR you can ask us to: access your data, correct it, delete it ("right to be forgotten"), restrict or object to processing, and get a copy of it (portability). Email us and we will respond within one month. Deleting your account removes your sign-in data; purchase records we must legally keep are reduced to the minimum required. You can also complain to the Information Commissioner's Office at ico.org.uk.

8. Children

The shop is not directed at children under 13 and we do not knowingly collect their data.