Privacy Policy

ReadVault is built to need very little personal data: an email address, a password, and the reading activity that makes the product work for you. This policy explains exactly what we collect, why, and the rights you have over it.

1. Who is responsible for your data

The data controller is [OPERATOR: legal entity name], [OPERATOR: registered address]. For any privacy question or request, contact [OPERATOR: privacy contact email address].

ReadVault is operated from [OPERATOR: country of establishment] and is reachable worldwide, including from the EU and the UK. Where required, our EU or UK representative is [OPERATOR: EU/UK representative name and address, if appointed; counsel to confirm whether one is required].

2. What we collect

• Account data. Your email address, an optional display name, and a hashed password (we never store the password itself).
• Consent records. Timestamps of your Terms acceptance and your age affirmation, recorded at signup.
• Preferences. Your answers to the optional interest quiz during onboarding.
• Reading activity. Saved titles, reading progress, highlights, and notes. These exist so the product works (resuming where you left off, your library); they are private to your account.
• Subscription state. Your plan, subscription status, trial and billing-period dates, and a reference to the payment provider's record. We do not store card numbers or bank details on our servers; payment details are handled by the payment provider.
• Email log. A record of the transactional emails we sent you, kept so we never send duplicates.
• First-party analytics. Product events (for example, that an onboarding step was completed) processed by us, not by an advertising network.

3. Cookies

We use first-party cookies only:

• Essential session cookies that keep you signed in. The service cannot work without them.
• A consent cookie that stores your choice from the cookie banner for one year, so we do not ask again.

There are no third-party trackers, advertising pixels, or cross-site cookies on ReadVault today. The consent banner is shown to all visitors; declining keeps essential cookies only. If we ever add a category of cookie that requires consent, it will not be set before you accept.

4. How we use your data

• Operating the service: accounts, sign-in, your library, and serving the content your plan entitles you to.
• Billing: managing your subscription, trial, and cancellation.
• Transactional email only: email verification, a welcome email, a reminder before your trial ends, payment receipts, and a cancellation confirmation. We do not send marketing email without a separate opt-in, and we never sell your data.
• Improving the product with first-party analytics, respecting your consent choice.
• Security: rate limiting, abuse prevention, and audit records.

5. Legal bases (EU/UK)

• Contract: account, content delivery, billing, and transactional email.
• Legitimate interests: service security, abuse prevention, and first-party product analytics.
• Consent: any non-essential cookies, per your banner choice.
• Legal obligation: retaining billing and audit records we are required to keep.

6. Who we share data with

We share personal data only with the service providers that run the product: hosting and database infrastructure at [OPERATOR: hosting provider and region], and the payment provider that processes subscription payments. Providers act under contract as processors and cannot use your data for their own purposes.

The AI and text-to-speech vendors we use to produce analyses process book-related editorial content, not your personal data or reading activity.

Where data leaves the EU or UK, transfers are protected by [OPERATOR: transfer mechanism, for example standard contractual clauses; counsel to confirm].

7. Retention and account deletion

We keep your data for as long as your account exists. You can delete your account at any time from your account page, and the deletion is carried out immediately and irreversibly:

• Your display name is removed and your email address is replaced with a non-recoverable placeholder; your quiz answers are cleared.
• Your reading activity is deleted: highlights and notes, saved titles, reading progress, and your streak.
• Every active session is revoked, so the account is unusable from the next request.
• The recipient details inside our email log are redacted.
• Records we are required to keep for billing and audit purposes are retained, but they no longer contain your personal details.

The original email address cannot be recovered from what remains.

8. Your rights

Depending on where you live (including under the EU GDPR and UK GDPR), you have the right to access, correct, export, restrict, or object to the processing of your personal data, and the right to erasure. Account deletion is self-service; for anything else, contact [OPERATOR: privacy contact email address] and we will respond within the statutory deadline. You also have the right to complain to your local supervisory authority.

9. Security

Passwords are stored only as cryptographic hashes. Access to premium content and personal data is enforced on our servers on every request, and admin functions require a separately verified role. Sessions are stored server-side and can be revoked instantly.

10. Children

ReadVault is not directed at children. You must be at least 16 to create an account, and we ask you to affirm this at signup. If we learn an account belongs to someone younger, we will delete it.

11. Changes to this policy

We will post any changes here and update the date above. For material changes we will notify you by email or an in-product notice. See also the Terms of Service and the Disclaimer.