Privacy Policy

• Account data: name, email address, password (hashed), profile photo, location, and bio — provided when you create an account.
• Book data: titles, authors, descriptions, cover images, and condition of books you list.
• Loan data: borrow requests, messages, due dates, and loan status history.
• Reviews: ratings and comments you leave for other users.
• Usage data: pages visited, search queries, and browser/device information — collected via server logs only, no third-party analytics.

• To provide and operate the readl.ing platform.
• To display your profile and books to other users.
• To facilitate book loans between families.
• To send transactional emails (loan requests, status updates, reviews) and optional weekly digests — controlled via your email preferences.
• To detect and prevent abuse of the platform.

• Contract: processing necessary to provide the service you signed up for (Art. 6(1)(b) GDPR).
• Legitimate interest: platform security and abuse prevention (Art. 6(1)(f) GDPR).
• Consent: optional marketing emails such as the weekly digest (Art. 6(1)(a) GDPR). You can withdraw consent at any time.

We do not sell your data. We share data only with the following service providers who process data on our behalf:

• Supabase (database and authentication) — EU region.
• Resend (transactional email delivery).
• Netlify (website hosting).

Your public profile, books, and reviews are visible to other registered users. You can make your profile private at any time.

We retain your data for as long as your account is active. When you delete your account, all your personal data, books, loans, and reviews are permanently deleted within 30 days. Server logs are retained for up to 90 days.

Under the GDPR, you have the right to:

• Access your personal data — available via your profile page.
• Rectify inaccurate data — edit your profile at any time.
• Erase your data — delete your account from the profile page.
• Export your data — request a copy of all your data.
• Restrict processing or object to processing — contact us at the address below.
• Withdraw consent for marketing emails — via email preferences.

We use only essential cookies required for authentication (session cookies managed by Supabase). We do not use advertising or tracking cookies. No cookie consent is required for strictly necessary cookies under ePrivacy rules, but we provide a notice for transparency.

readl.ing is a platform for families. Accounts must be created by a parent or legal guardian. We do not knowingly collect data from children under 16. If you believe a child has created an account, please contact us.

All data is transmitted over HTTPS. Passwords are hashed using bcrypt. Database access is protected by Row Level Security policies. File uploads are stored in access-controlled storage buckets.

For privacy-related questions or to exercise your rights, contact us at: privacy@readl.ing

You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) at www.cnpd.pt.