Privacy Policy

This Privacy Policy explains how BookReef (“BookReef”, “we”, “us”) collects, uses and protects personal data when you use our website and service at bookreef.co. If you have any questions, contact us at [email protected].

Who we are

BookReef is a link-in-bio service for authors and publishers. For data you provide as a BookReef account holder, BookReef acts as the data controller. For email addresses that readers submit to download an author’s bonus (a “lead magnet”), the author who collected them is the controller and BookReef acts as a processor on their behalf.

What we collect

• Account data: your email address and the author/brand name and profile details you provide.
• Content you create: books, links, smart links, QR codes, bonus files, bios and avatars.
• Reader email captures: when a reader chooses to download a gated bonus, the email address they submit, stored for the author who created that bonus.
• Coarse analytics: country, device type and referring domain for clicks, scans and downloads. We do not store raw IP addresses by default.
• Product analytics: usage data on our own website and dashboard (pages viewed, clicks, device and browser type, referring site) and error reports, and — for signed-in authors — recordings of dashboard sessions so we can diagnose usability problems. This measurement sets no cookies, and visitors remain anonymous unless they create an account.
• Billing data: when you buy a paid plan, our merchant of record (Polar) collects the billing details needed to process the payment; we receive your plan, subscription status and a customer reference, never your full card number.
• Cookies: strictly necessary cookies for authentication and a short-lived cookie used to deliver a gated download after an email is submitted. See our Cookie Policy for the full list and your choices.

Legal bases

Where the GDPR applies, we process personal data on these bases:

• Contract (Art. 6(1)(b)) — operating your account, your public page, links, QR codes, downloads and billing.
• Legitimate interests (Art. 6(1)(f)) — securing the service, preventing abuse and measuring aggregate, privacy-respecting usage.
• Consent (Art. 6(1)(a)) — reader email capture on gated bonuses, and author-enabled advertising pixels for visitors in the EEA/UK.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records kept via our merchant of record.

How we use data

• To provide and operate the service (your public page, smart links, QR codes and downloads).
• To send transactional emails (email confirmation, password reset).
• To show authors basic, privacy-respecting analytics about their links.
• To secure the service and prevent abuse.

Service providers

We share data only with providers that help us run BookReef:

• Supabase — database and authentication.
• Cloudflare — hosting, CDN, file storage and public routing.
• Vercel — dashboard and marketing site hosting.
• PostHog — product analytics and error monitoring for our own website and dashboard (PostHog, Inc., US, certified under the EU–US Data Privacy Framework).
• Resend — sending transactional email.
• Polar — merchant of record and payment processing for paid plans. When you buy a paid plan, the sale is completed by Polar, which acts as an independent controller for the payment, invoicing and tax data it processes (Polar uses Stripe as its underlying payment processor).

Some of these providers process data in the United States. Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

Marketing tools authors enable

Authors can connect their own third-party marketing and measurement tools to their public BookReef page, such as an Amazon Attribution tag or a Meta or TikTok advertising pixel. Where an author enables these, that author is the controller of the activity and is responsible for the related notices and consents on their page; this policy covers only BookReef’s own processing. An Amazon Attribution link carries a tracking parameter to Amazon and sets no cookie on the BookReef page; an advertising pixel an author enables loads third-party code that may set its own cookies. Questions about a specific author’s page should go to that author.

Retention

We keep account and content data while your account is active. Raw analytics events are kept for a limited window and aggregated into anonymous daily rollups. You can delete your content at any time from the dashboard.

Your rights

Subject to applicable law (including the GDPR), you may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. To exercise these rights, email [email protected]. Readers who submitted their email to an author should contact that author directly; we will assist where required. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Changes

We may update this policy from time to time. Material changes will be reflected by the date above.

Contact

Questions about this policy: [email protected].