Privacy policy

This policy explains how (“we”, “us”) processes personal data when you use Readhem. It is written to meet the EU General Data Protection Regulation (GDPR). Replace the controller details in your environment before you go live.

1. Controller

The controller is , established in . For privacy requests, email . For general support, .

If you operate as a natural person without a company number, say so here and add a postal address. If you later appoint a Data Protection Officer, name them in this section.

2. What we collect

• Account data: email address and a password stored as a hash by our authentication provider. We never see your password in plain text.
• Consent records: that you accepted the terms and this policy, and your age confirmation.
• Purchases: when paid stories are sold, we will store which story you bought and when, so we can give you access. Payment card data is handled by the payment provider, not stored by Readhem.
• Technical logs: our host and authentication provider may keep security logs (IP address, time, error codes) for a short period.
• On your device only: reading progress and choices live in this browser’s sessionStorage. We do not upload that to our servers today. The cookie notice dismissal is stored in localStorage.

We do not sell personal data. We do not run advertising or analytics cookies. We do not send promotional or newsletter email.

3. Why we process it (legal bases)

• Contract (Art. 6(1)(b) GDPR): creating and signing in to an account, sending a confirmation or password-reset email, and delivering stories you bought.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, and defending legal claims. You may object; see section 7.
• Legal obligation (Art. 6(1)(c)): invoices and tax records for paid sales, once that exists, for as long as law requires.

4. Processors and where data is stored

We use Supabase (Supabase, Inc. and its subprocessors) for authentication and the database. Create the project in an EU region (for example Frankfurt) so personal data stays in the EEA. If a transfer outside the EEA is required, it must rest on an adequacy decision or Standard Contractual Clauses.

Hosting of this website is a processor too. Name your host (for example Vercel) in this paragraph when you deploy, and keep a record of processing.

5. How long we keep data

• Account and profile: until you delete the account, or we close an unused account after a long period of inactivity (we will email first where we can).
• Purchase and invoice data: as required by tax law, even if the account is deleted, if a sale has taken place.
• Security logs: typically up to 90 days, unless needed for an investigation.

6. Children

You must be at least 16 to create an account. Readhem is not directed at children under that age. If you believe we hold data about a younger person, email and we will delete it.

7. Your rights

You have the right to:

• access your data and get a copy (Art. 15);
• rectify inaccurate data (Art. 16);
• erase data in the cases in Art. 17 — including by using Delete account;
• restrict processing (Art. 18);
• data portability for data you provided, in a machine-readable format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22) — we do not make such decisions.

Use your account page or email . We will answer within one month, or tell you if we need more time (up to two further months for complex requests).

8. Complaints

You may lodge a complaint with the supervisory authority in : Gegevensbeschermingsautoriteit / Autorité de protection des données. You may also complain in the EU country where you live or work.

9. Cookies

See the cookie policy. Sign-in cookies are strictly necessary. We do not use tracking cookies.

10. Changes

If we change this policy in a way that matters, we will update the date above and, for account holders, we may also email you. Continued use after a material change means you should read the new text; we will ask for a new consent where the law requires it.