PRIVACY POLICY

1. Who We Are & How to Contact Us

Body Prison is a digital book sold at www.bodyprison.com. This policy explains what we collect when you buy it, and what we do with it.

For all privacy matters — including any request to exercise your rights — contact our privacy contact at bodyprison.book@gmail.com.

EU establishment: We are established in the European Union (Slovenia), so no Article 27 representative is required.

2. The Data We Collect

We sell one thing, a digital book, so we collect very little. The categories below also map to the “categories of personal information” disclosure required by California law.

We do not collect government IDs, and we do not store your payment card number, bank details or billing address. Those are handled entirely by Stripe (see Section 7). We do not ask for, and have no use for, special-category or sensitive data.

3. How & Why We Use Your Data

• To take your payment and deliver the book you bought
• To send the transactional email containing your download link
• To re-send that link if you ask us to, or to answer a question you email us
• To keep the site secure and prevent fraud and abuse
• To understand aggregate traffic in a privacy-preserving way
• To comply with our tax, accounting and consumer-law obligations

We do not sell your data, do not “share” it for cross-context behavioural advertising, do not run advertising, do not send marketing email unless you have separately asked for it, and do not use your data to make solely automated decisions with legal or similarly significant effects (see Section 10).

4. Legal Bases for Processing (GDPR / UK GDPR)

• Performance of a contract — taking your payment and delivering the book you bought.
• Legitimate interests — keeping the site secure, preventing fraud and abuse, and understanding aggregate traffic (balanced against your rights).
• Consent — any optional communications, and any non-essential cookies or technologies should they ever be introduced. You may withdraw consent at any time.
• Legal obligation — keeping the records required by tax, accounting and consumer law.

5. Cookies & Local Storage

Body Prison is intentionally low-tracking. We set no cookies of our own.

We use no advertising cookies, no third-party tracking cookies and no cross-site profiling. Because we rely only on strictly-necessary storage and a cookieless analytics tool, no consent banner is legally required. If we ever add non-essential cookies, we will ask for your consent first.

6. Who We Share Data With (Processors & Sub-processors)

We share data only with the service providers needed to sell and deliver the book. Each acts as our processor under a data-processing agreement and has its own privacy policy.

We never sell or rent your data to anyone. We may disclose data if required by law, to protect our rights, or to prevent harm.

7. Payments

Purchases are processed by Stripe. Your card number, security code, bank and billing details are entered directly with Stripe and are never seen or stored by us. We receive only your email address and a confirmation that payment succeeded, so that we can send you the book. See Stripe’s Privacy Policy.

8. International Data Transfers

Your order records are stored in the European Union (Ireland). Some processors (Stripe, Resend, Vercel) may process limited data in the United States or other countries. Where data leaves the EU/UK, transfers are protected by appropriate safeguards under GDPR Articles 44–49 — typically the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU–US Data Privacy Framework where the provider participates.

9. How Long We Keep Data

You may ask us at any time to delete any personal data we are not legally required to keep, by emailing bodyprison.book@gmail.com. We must retain the minimum record of a sale for tax purposes, and we will tell you exactly what that is if you ask.

10. Security

• All traffic encrypted in transit over HTTPS
• Row-Level Security on every database table, so order records are not reachable from the browser
• Private file storage; the book is delivered through short-lived, signed links
• Security headers (Content-Security-Policy, X-Frame-Options, HSTS) and rate limits on checkout

No system is perfectly secure. If a breach affects your rights and freedoms, we will notify the competent supervisory authority within 72 hours and affected users without undue delay, as required by law.

11. Automated Decisions & Profiling

We do not subject you to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects. XP and streaks are simple activity counters, not automated decision-making about you.

12. Your Rights — EU & UK (GDPR)

You have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and to withdraw consent at any time. To exercise any right, email bodyprison.book@gmail.com; we respond within one month. You may also lodge a complaint with your local supervisory authority (e.g. Ireland's Data Protection Commission, or the UK ICO).

13. Your Rights — California (CCPA / CPRA)

California residents have the right to know, to access, to correct, to delete, and to opt out of the "sale" or "sharing" of personal information, plus the right to limit use of sensitive personal information and the right to non-discrimination for exercising these rights.

• We do not sell or share your personal information (including for cross-context behavioural advertising), so there is nothing to opt out of.
• We collect the categories listed in Section 2, for the purposes in Section 3, and retain them per Section 9.
• To exercise a right, email bodyprison.book@gmail.com with the subject "California Privacy Request". We respond within 45 days (extendable once). Authorised agents may submit requests with proof of authorisation.

14. Your Rights — Canada (PIPEDA & Québec Law 25)

If you are in Canada, you may access and correct your personal information and withdraw consent (subject to legal/contractual limits). We collect, use and disclose personal information only for the purposes identified here, with your knowledge and consent. You may direct questions or complaints to us and, if unresolved, to the Office of the Privacy Commissioner of Canada (or, for Québec residents, the Commission d'accès à l'information).

15. Children's Privacy

Body Prison is intended for adults. We do not knowingly collect data from children under 13 (or under 16 in parts of the EU without parental consent). If you believe a child has bought the book and given us their data, contact us and we will delete that data promptly.

16. Changes to This Policy

We may update this policy. We will revise the “Last updated” date above. The version that applies to your purchase is the one in force on the day you bought.