Privacy policy
Last updated 5 October 2026
This says what we do with personal information on Bookstorez: what we collect when you browse, when you buy, when you open an account and sell, and who else handles it.
Who we are
Bookstorez is run by Harber Glaves Limited, a company registered in England and Wales, company number 17162810, registered office SIU Offices, 4-6 Greatorex Street, London E1 5NF, United Kingdom. Write to us at hello@bookstorez.io.
Harber Glaves Limited is registered with the Information Commissioner's Office as a data controller, registration number ZC243302. We have not appointed a data protection officer because the law does not require one; hello@bookstorez.io reaches the person responsible.
What we collect
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your email address, when you sign in | To send sign-in codes and to run your account. We do not use passwords, so the address is how you get in | Performing our contract with you | While your account exists, then 90 days |
| Your storefront: display name, handle, bio, country and, later, a picture | To show your public storefront and product pages. Everything in this row is public by design | Performing our contract with you | While your account exists |
| Your products: titles, descriptions, covers, prices, the files you upload, and your original-work and AI-assisted declarations | To list and sell them. Files are private until a sale delivers them; the rest is public once you publish | Performing our contract with you | While the product exists, then 90 days; sales records longer, see Money |
| Your country and how you chose to be paid | To offer the right payout options for your country and to know whether you can be paid. Stripe collects your identity and bank details itself; what we keep for PayPal payouts is set out in Money | Performing our contract with you, and Stripe's legal duties on its side | While your account exists |
| Sign-in and request logs: your internet address, browser and the time | To keep accounts secure and stop abuse | Our legitimate interest in keeping the site working and safe | Up to 30 days |
| Your cookie choice | So we don't ask again | Strictly necessary; stored in your browser, not on our servers | Until you clear your browser storage or change it in the footer |
When a discount code is entered and does not work, we may keep a scrambled form of the visitor's network address for up to two days, to stop codes being guessed. We do not keep the address itself.
When you buy or claim a product, we note whether you reached the seller's page from elsewhere on Bookstorez or went straight to it. Sellers see only totals, never where one buyer came from.
We do not sell personal information, and we do not use it for anything this policy does not say. We will email you about your account, your products and money owed to you; we will not send marketing without asking first.
Money
Harber Glaves Limited is the merchant of record for every sale, so sales records, payouts and the tax we account for are ours to keep. We keep them for six years after the tax year they fall in, which is what HMRC requires, even if you close your account.
Card payments are processed by Stripe. You type your card details into Stripe's checkout, not ours, and we never see full card numbers.
When you buy, or claim a free product, we keep your email address and the country you are in with the order. We use them to deliver the download, send your receipt, let you find your purchases again and keep the tax records the law asks for. Our legal basis is performing our contract with you for the order, receipt and download, and our legal obligation for the tax records. Records for EU sales are kept for 10 years, which is what EU VAT rules require; other sales records for the six years above.
Sellers see the country a buyer is in and what they bought, not the buyer's email.
To pay you through Stripe, Stripe opens a connected account in your name. Stripe asks you for identity, address and bank details directly and is the data controller for what it collects; its privacy policy at stripe.com/privacy covers that. We see only whether the account is complete and whether it can receive payouts.
If you choose PayPal instead, we store your PayPal email address and your tax details (legal name, address, country and tax number) when you set up payouts. The tax details are encrypted and used only to pay you and to meet our tax reporting duties. We keep your payout method while your account exists. We keep your tax details for six years after the end of the tax year of your last payout, even if you close your account.
Who else handles it
We use suppliers to run the site. Each acts on our instructions and holds only what it needs.
| Supplier | What for | Where |
|---|---|---|
| Supabase | The database and the file storage behind the site | London, United Kingdom |
| Supabase Auth | Sends the sign-in email | London, United Kingdom, and the EU |
| Vercel | Hosting. Vercel's request logs hold your internet address briefly for security and are not used for analytics | Global edge network; logs in the United States |
| Stripe | Card payments, payouts and identity checks. Stripe is a controller in its own right for the identity and bank details it collects from you | United States and Ireland, under Stripe's UK-approved transfer terms |
| PayPal | Payouts, for sellers who choose it. PayPal is a controller in its own right for the account details it holds | United Kingdom (PayPal UK Ltd), the United States and other countries, under PayPal's Binding Corporate Rules and UK-approved transfer terms |
| Resend | Receipts, support replies and account email | United States, under the UK Addendum to the EU standard contractual clauses and the UK Extension to the EU-US Data Privacy Framework |
| Google (Tag Manager and Analytics) | Analytics, only if you accept on the cookie banner. See the cookies page | United States, under Google's UK-approved transfer terms |
Where a supplier is outside the UK, the transfer relies on the UK International Data Transfer Addendum or the UK's adequacy decisions.
Your rights
- Ask what we hold about you and get a copy.
- Ask us to correct or delete it. Deleting your account removes your storefront, your products and your files; sales records stay for the period in Money.
- Object to, or ask us to limit, anything we do on the legitimate-interest basis.
- Complain to the Information Commissioner's Office at ico.org.uk if you think we've got something wrong. We'd rather you told us first.
For any of these, email hello@bookstorez.io. We reply within one month.
Changes
If we change what we collect or who handles it, we update this page first. The date at the top changes whenever the words do.