Privacy Policy

Last updated: 30 September 2026

This policy explains how personal data is processed in “When Nature Reveals Its Gifts”: when purchasing digital copies, sending them as gifts, using the online Library and contacting us.

1. Data controller

2. Data we process

Purchases for yourself

• The purchaser’s email address.
• Order and copy details required: RB number, amount, currency, payment date, Stripe payment identifiers, and acceptance of the Terms of Purchase, including their version and date.

Gift purchases

• The purchaser’s email address.
• The recipient’s email address.
• The name provided by the purchaser as the gift sender.
• The same order and copy details as for purchases for yourself.

The recipient’s email address and the sender’s name are provided by the person buying the gift, solely so that it can be delivered. We tell the recipient this in the email with which they receive their copy, together with a link to this policy.

Library

• Information needed to authorise reading devices, up to a maximum of three per copy.
• A basic technical label for each device, derived from the browser (for example, “iPhone · Safari”).
• Dates needed to manage access, such as each device’s authorisation date and last-use date.
• Reading progress (the last page read).
• Access keys and links are stored only as cryptographic hashes, never in plain text.
• Whether you have already seen the book’s welcome screen and the music introduction, so that they are not shown again.
• A record of the emails sent (recipient, type of email, status and date), so that we know what has been delivered and can retry if sending fails.

Contact

• Information you voluntarily provide when emailing us.

We do not receive or store payment card details: these are entered directly into Stripe.

3. Purposes

• To manage purchases and payments.
• To assign an RB number to each copy.
• To deliver the copy to the purchaser or, for gifts, to the recipient.
• To provide access to the Library and manage authorised devices.
• To save reading progress.
• To send emails necessary for purchases and access. We do not send marketing communications.
• To respond to issues and enquiries.
• To comply with legal, tax and accounting obligations.
• To maintain the security of the service and prevent abuse.

4. Legal basis

Depending on the specific processing activity, the legal basis is the performance of the purchase contract and provision of access to the copy, compliance with legal obligations, our legitimate interest in maintaining the security of the service and preventing abuse, or the individual’s consent when they voluntarily contact us.

5. Service providers

The following providers process data on our behalf, to the extent necessary for their respective functions:

• Supabase (Supabase Pte. Ltd., Singapore): database and storage, hosted in the eu-central-1 region, Frankfurt (Germany).
• Resend (Plus Five Five, Inc., United States): delivery of transactional emails. The sending domain is configured in the eu-west-1 region, Ireland. Open and click tracking are not enabled.
• Stripe (Stripe Payments Europe, Limited, Ireland): payment processing. Card details are entered directly on Stripe’s payment page and do not pass through our servers. As part of the order details, Stripe also receives the purchaser’s email address and, for gifts, the recipient’s email address and the sender’s name.
• Hostinger (Hostinger International Ltd., Cyprus): hosting of the website on a server located in France, which may record technical connection data (such as IP addresses) in its standard operational and security logs.

6. International transfers

Some of these providers belong to groups based outside the European Economic Area or may access data from there. In those cases, the transfer is covered by:

• Resend: the EU-U.S. Data Privacy Framework, under which Plus Five Five, Inc. is certified, and the Standard Contractual Clauses approved by the European Commission.
• Stripe: where data is transferred to Stripe, LLC in the United States, the EU-U.S. Data Privacy Framework, under which it is certified, and the Standard Contractual Clauses.
• Supabase and Hostinger: the Standard Contractual Clauses approved by the European Commission, included in their data processing agreements.

You can ask us for more information about these safeguards, or for a copy of them, by writing to helena@whennaturerevealsitsgifts.com.

7. Data retention

• Accounting and tax records of the purchase (order, amount, date and payment details, acceptance of the Terms of Purchase, and the delivery and confirmation emails sent): six years from the purchase and, in any case, for as long as the copy exists.
• Technical access data (authorised or released devices, access links and keys, email sending attempts) and reading progress: kept with the copy for as long as it exists, because they are what allows it to be read.
• Contact messages: for as long as needed to deal with the enquiry.

8. Your rights

Where applicable, you may request access to, rectification or erasure of your personal data, restriction of processing and data portability. You may also object to the processing of your data. To exercise these rights, write to helena@whennaturerevealsitsgifts.com. Where processing is based on your consent (for example, when you write to us), you may withdraw it at any time in the same way, without affecting the lawfulness of processing carried out before its withdrawal. Releasing a device in the Library de-authorises it but does not delete its record: if you would like us to delete that data, write to us. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Cookies

Information about the cookies used by this website is available in the Cookie Policy.