In brief
- We collect only what is needed to run your account and to record learning progress.
- We do not sell personal data, show advertising or use advertising or analytics trackers.
- Children use Bookiverse through a profile created and managed by a parent, or through an account provided by their teacher or school.
- You can download your data or ask for its deletion at any time from your dashboard.
This Privacy Policy explains what personal data Bookiverse collects when you use www.bookiverse.online, why it is collected, how long it is kept, who can see it and the choices available to you.
Bookiverse's policies are aligned with international best practice in data protection, consumer protection and online education. In particular, they take into account the principles and requirements of:
- European Union: the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”);
- United States: the Children's Online Privacy Protection Act (COPPA) and, where schools use Bookiverse, the Family Educational Rights and Privacy Act (FERPA);
- International organisations: UNESCO's guidance on protecting learners' privacy and data security in education (Minding the data, 2022), UNICEF's Children's Rights and Business Principles, and the Guidelines for Industry on Child Online Protection issued by the International Telecommunication Union (ITU) and UNICEF.
1.Who we are
Bookiverse (www.bookiverse.online), hosted in the United States of America, is responsible for the personal data described in this policy (the “controller” in the terms of data protection law). You can contact us at info@bookiverse.online.
When a school, company or teacher provides Bookiverse to its learners under a separate agreement, that organisation decides how its learners' data is used. In that case Bookiverse processes the data on the organisation's behalf and according to its instructions, and the organisation is the first point of contact for its learners.
2.What we collect
- Account information: your email address, the name you give, your account type (learner, parent, teacher or employee), your preferred language and your password. Passwords are stored only as a secure one-way hash; we cannot read them.
- Learner profiles: a display name (a first name or nickname is enough) and, if you choose to set one, a 4-digit PIN, also stored as a hash. Child profiles have no email address.
- Class logins: for students in a teacher's classroom, a name, a username and a password (stored as a hash), created by the student with the class code or by the teacher. Class logins have no email address.
- Learning records: books finished, lessons and activities completed, games played, scores and results (including level estimates from placement tests), attempt numbers, and the date and time of each.
- Time on task: the active time spent on each page, stored as a daily total per page. Time is counted only while the page is open, visible and in use.
- Subscription information: plan, start and end dates and, for online purchases, the information Paddle sends us about the order: name, email address, country, and the order and subscription identifiers. Payment card details are handled by Paddle; Bookiverse does not receive or store them.
- Technical and security information: a sign-in cookie; your IP address, used briefly to limit repeated sign-in attempts; and the standard server logs kept by our hosting provider.
- Messages you send us, and deletion requests.
We do not ask for sensitive information, such as information about health, religion or ethnic origin, and we ask you not to include it in names or messages.
3.How we use personal data
| Purpose | Legal basis |
|---|---|
| Providing your account, saving progress and showing your dashboard | Performance of our agreement with you |
| Giving subscribers access to the full library and applying the limits of free access | Performance of our agreement with you |
| Child profiles created by a parent or guardian | Consent of the parent or guardian, and performance of our agreement with them |
| Keeping the service secure, including sign-in protection and prevention of misuse | Our legitimate interests; legal obligations |
| Service emails, such as password reset, and replies to your messages | Performance of our agreement; our legitimate interests |
| Improving the platform using aggregated statistics, such as the number of books read at each level | Our legitimate interests |
We do not use personal data for advertising, we do not sell or rent it, and we do not share it for cross-context behavioural advertising. We do not take decisions with legal or similarly significant effects based solely on automated processing: placement test results and level estimates are guidance for choosing reading material.
4.Children
- Accounts are opened by adults. A person under 18 may open their own account only with the permission of a parent or guardian. Children under 13 should use Bookiverse only through a child profile in a parent's account, or through an account provided by their teacher or school.
- For a child profile we record only a display name and learning activity. We do not collect a child's email address, photograph, location or contact details.
- The parent or guardian can view, download, correct and delete the child's data at any time from the dashboard, and can protect each profile with a PIN.
- Children's data is never used for advertising or marketing.
- If we learn that we have collected a child's data without the required consent, we will delete it promptly.
7.International transfers
Our servers are located in the United States. When personal data is transferred from the European Union or other countries, we rely on the safeguards recognised by the applicable law, such as contractual commitments from our providers, and we limit the data transferred to what is needed to provide the service.
8.How long we keep data
| Data | Retention |
|---|---|
| Account information | While your account exists. |
| Learning records and time on task (subscribers) | While your subscription is active. When a subscription ends and is not renewed, your dashboard stays available, read-only, for 60 days. After that, the records from the subscription period are deleted and the account continues as a free account. |
| Learning records (free accounts) | While the account exists, unless you ask for their deletion. |
| Deletion requests | Completed within 30 days of the request. |
| Sign-in sessions | Expire after 30 days, or when you sign out. |
| Password-reset links | Valid for one hour; removed within one day. |
| Sign-in attempt records (including IP address) | Deleted within 24 hours. |
| Students in a teacher's classroom | While the teacher's plan is active. When it ends and is not renewed, the records stay available, read-only, for 60 days and are then deleted. The teacher can remove a student or a classroom, with its records, at any time. |
| Accounts provided by an organisation | As set out in the agreement with that organisation. |
Deleted data may remain in routine backups for a limited period until those backups are overwritten.
9.Security
We protect personal data with measures appropriate to the risk, including encrypted connections (HTTPS), one-way hashing of passwords, PINs and sign-in tokens, limits on repeated sign-in attempts, and restricted access to administration tools. No online service can be guaranteed to be completely secure. If a personal data breach occurs that is likely to affect you, we will inform you and the competent authorities where the law requires it.
10.Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- receive your data in a portable format;
- restrict or object to certain processing;
- withdraw consent at any time, without affecting processing carried out before the withdrawal;
- not be treated differently for exercising these rights; and
- lodge a complaint with the data protection authority of your country.
How to exercise them. In your dashboard, under Account and data, you can download all your records (CSV file), request deletion and change your password. For any other request, write to info@bookiverse.online. We reply within 30 days and may ask you to confirm your identity first.
11.Changes to this policy
We may update this policy. The date at the top of the page shows the latest version. We will inform account holders of significant changes by email or by a notice on the website before they take effect.
Contact. For any question about this document, write to info@bookiverse.online. We reply within 30 days at the latest.
See also the Terms of Use.