I. Who we are
re-book is an app developed and maintained by Elliot Hegraeus, based in Stockholm. For anything in this policy, including exercising your rights, write to support@re-book.app. We aim to reply within two working days.
We are the data controller for the personal data described here, which means we decide why and how it is processed. We have not appointed a data protection officer, as we are not required to.
II. What we collect
Account details: your name, your email address, and the credentials held by our authentication provider. We never see or store your password.
Delivery and payment details: the postal address you give us for deliveries, and the billing information you enter at checkout. Card numbers go directly to our payment provider and never reach our servers.
Your reading journey: the answers you give in the questionnaire, the goals you set, the books we recommend, and any ratings and reviews you write. If you choose to link a Goodreads ID, we read the public shelves on that profile.
Technical data: server logs containing IP address, browser type, and the pages requested, and - only if you consent - aggregate visit statistics.
We ask you not to put passwords, payment details, health information, or other sensitive data into the questionnaire. It is a reading prompt, not a form for confidential information.
III. Why we process it, and on what basis
To provide the service - creating your account, curating recommendations, taking payment, and delivering books - we process your data because it is necessary to perform our contract with you (Article 6(1)(b) GDPR).
To meet legal obligations, in particular keeping accounting records of your orders, we rely on Article 6(1)(c).
To keep the service secure, prevent abuse, and improve what we offer, we rely on our legitimate interests (Article 6(1)(f)). We weigh those interests against your rights, and you may object at any time.
For analytics and for any marketing email beyond service messages, we rely on your consent (Article 6(1)(a)). You may withdraw consent at any time, and withdrawal does not affect processing already carried out.
IV. AI curation
Your questionnaire answers, the goals you set, and - where you supplied one - the public Goodreads shelves you linked are sent to OpenAI to generate reading recommendations and the short reasons attached to them. We send the reading context. We do not send your name, address, payment details, or account credentials.
OpenAI processes this on our instructions as our processor, and does not use it to train its models. Recommendations are produced by a model and may be imperfect. They carry no legal or similarly significant effect, and no automated decision is taken about you within the meaning of Article 22.
Because these prompts pass to a third party, please keep sensitive personal information out of them.
V. Who receives your data
We use a small number of processors, each bound by contract to process data only on our instructions:
Clerk, for accounts and authentication. Stripe, for payments and card processing. Resend, for transactional email. OpenAI, for recommendations, as described above. Neon, for the database holding your account and journey. Vercel, for hosting, for storing book cover images, and - with your consent - for visit and page-speed analytics. Geoapify, for address suggestions while you type a delivery address.
If you link a Goodreads profile, we request its public RSS feeds from Goodreads on your instruction. We hold no Goodreads account on your behalf and cannot see anything you have not made public.
We do not sell personal data, and we do not share it for advertising.
VI. Book covers
Book covers are cached on our own storage wherever we can. When a cover is not available from that cache, your browser fetches the image directly from Open Library, operated by the Internet Archive, or from Google Books. Those requests disclose your IP address and browser details to the provider concerned and are governed by that provider's own privacy policy. Nothing about your account or your reading journey is sent with them.
VII. International transfers
We host in the European Union wherever the provider offers it. Some processors, including OpenAI, Stripe, Vercel, and Resend, are established in the United States or may process data there. Those transfers rely on the European Commission's standard contractual clauses and, where applicable, on the EU–US Data Privacy Framework. You may ask us for details of the safeguards in place.
VIII. How long we keep it
Account data is kept while your account exists and deleted within 30 days of you closing it. Invoices and accounting records are kept for seven years, as Swedish bookkeeping law requires; that obligation survives the deletion of your account. Questionnaire answers, recommendations, ratings, and reviews are kept for the life of the account. Waitlist entries are kept until launch or until you unsubscribe, whichever comes first. Server logs are kept for around 30 days. Your cookie choice is kept for 180 days, after which we ask again.
IX. Your rights
Under the GDPR you have the right to obtain access to the personal data we hold about you and to receive a copy; to have inaccurate data corrected; to have data erased where there is no continuing basis to keep it; to restrict processing while a dispute is resolved; to receive the data you provided in a portable format; to object to processing based on our legitimate interests; and to withdraw consent at any time where processing rests on consent.
To exercise any of these, email support@re-book.app. We answer within one month, and will tell you if a request is genuinely complex and needs longer. There is no charge.
X. Cookies
We set only the cookies needed to run the site, plus analytics if you allow them. The full list, what each cookie does, and how long it lasts are set out on our data privacy page, where you can also change or withdraw your choice at any time.
XI. Changes and complaints
We will post any revision on this page and update the revision date below. Where a change materially affects how we use your data, we will tell you before it takes effect.
If you believe we have handled your data unlawfully, please contact us first - we would rather put it right. You also have the right to lodge a complaint with a supervisory authority. Ours is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). If you live elsewhere in the EU or EEA, you may complain to the authority in your own country.
Last revised August 2026