Privacy Policy

1. Information We Collect

The information we collect depends on whether you participate as a reader, author, visitor, or other user and how you interact with the Services.

Reader Information

When you create or use a reader account or participate in reader programs, we may collect information including:

• Your name.
• Your email address.
• Your country.
• Your book genre preferences.
• Your audience-level or reading preferences.
• Books and offers you request.
• Books you report as completed.
• Books you report as “Did Not Finish” (“DNF”).
• Review-related activity, including clicks on review links.
• Other reader activity and interactions with VRO offers and Services.
• Referral codes associated with your account.
• Information identifying who or what referral source referred you, when applicable.

Reader activities may be recorded individually so that VRO can maintain account history, operate reader programs, determine eligibility for offers, provide authors with applicable program information, prevent abuse, and improve the Services.

Author Information

When you create an author account, submit a book, purchase or use an author Service, or otherwise participate as an author, we may collect information including:

• Your name.
• Your primary email address.
• A reader-facing or fulfillment contact email address.
• An assistant or other authorized contact email address.
• Author or pen names.
• Information about books you submit.
• Manuscripts or other book files.
• Book cover images.
• Book descriptions, blurbs, excerpts, and promotional copy.
• Download links, redemption information, landing-page information, and other fulfillment materials.
• Information concerning giveaways, promotions, subscriptions, and other VRO Services you use.
• Billing, payment-status, subscription, transaction, and related account information.

Payment-card information is processed by our payment processor rather than stored directly in VRO's application database. VRO may nevertheless receive and retain information relating to transactions, such as payment status, subscription status, transaction or customer identifiers, amounts paid, refunds, and related billing information.

Information Collected Automatically

When you visit or interact with VRO, we may automatically collect technical and activity information, including:

• Internet Protocol (IP) address.
• Browser and device information.
• User agent.
• Operating-system or similar technical information.
• Dates and times of activity.
• Pages, features, offers, buttons, links, or dashboard functions with which you interact.
• Account and session information associated with an interaction.
• Records of acceptance of our Terms of Service or other agreements.
• Security, authentication, and fraud-prevention information.

IP address and user-agent information may be recorded in connection with dashboard or account actions and may be associated with the applicable user account or activity record. We may specifically retain this information in connection with acceptance of our Terms or other agreements in order to document acceptance, maintain security records, investigate abuse, and protect VRO and its users.

2. Cookies and Similar Technologies

VRO uses cookies and similar browser technologies to operate and secure the Services and remember certain user choices or device status.

For example, VRO may place a persistent browser cookie currently identified as vro_device_trusted after a user confirms certain actions or establishes a device as trusted.

This cookie may remain on the device for up to approximately 180 days unless it expires, is replaced, or is removed earlier.

We use this trusted-device functionality to recognize a browser that has previously completed applicable confirmation steps so that the user does not necessarily need to reconfirm the same type of action each time from that trusted device.

You can remove or block cookies through your browser settings. Removing or blocking a functional cookie may cause VRO to require additional confirmations or may otherwise affect features that depend on that cookie.

We may change the names, durations, or technical implementation of cookies as the Services evolve while continuing to use them for substantially similar purposes.

3. How We Use Information

We may use information we collect to:

• Create, authenticate, maintain, and administer reader and author accounts.
• Provide and operate book giveaways and other reader programs.
• Match or present books and offers based on reader preferences.
• Record book requests, completions, DNF activity, and other reader activity.
• Provide books, download information, fulfillment communications, and related Services.
• Operate author giveaways, promotions, subscriptions, and other author Services.
• Process and administer payments, subscriptions, cancellations, and refunds.
• Send transactional, administrative, security, fulfillment, and service-related communications.
• Send promotional or marketing communications where permitted by applicable law.
• Track referrals and administer referral programs.
• Provide review links and facilitate review-related features.
• Determine eligibility for reader offers and other VRO programs.
• Detect, prevent, investigate, and respond to fraud, abuse, manipulation, unauthorized distribution, security incidents, and violations of our Terms.
• Document acceptance of our Terms of Service and other agreements.
• Recognize trusted devices and reduce unnecessary confirmation steps.
• Troubleshoot, maintain, secure, analyze, and improve the Services.
• Understand how users interact with VRO.
• Enforce our Terms of Service and other policies.
• Comply with legal obligations.
• Establish, exercise, or defend legal claims.
• Protect VRO, Turn Page One, authors, readers, and other users.

4. Automated Processing and Account Consequences

Some VRO systems automatically evaluate activity or technical events and may take actions affecting an account or the communications a user receives.

Reader DNF Eligibility

VRO records reader-reported “Did Not Finish” activity.

Under VRO's current reader eligibility rules, a reader who records 10 or more DNF results during a rolling 90-day period may automatically be restricted from requesting new book offers.

This determination may be made automatically based on reader activity stored in VRO systems.

The purpose of this rule is to encourage readers to request books in good faith and to protect authors and the integrity of VRO's reader programs.

VRO may review, correct, modify, or remove restrictions where appropriate, including when we determine that information was recorded incorrectly or unusual circumstances warrant review.

Email Suppression

VRO may also automatically suppress an email address from future email delivery when our systems or email providers report certain delivery or abuse events, including a hard bounce or spam complaint.

Suppression is used to protect recipients, comply with applicable requirements and provider policies, and maintain the security and deliverability of VRO's email systems.

These automated processes do not determine a person's legal rights and may be reviewed or adjusted by VRO where appropriate.

5. Email Communications

VRO uses email to operate its reader and author programs.

Depending on your relationship with VRO and applicable law, we may send:

• Account and security messages.
• Book-offer notifications.
• Giveaway communications.
• Book-delivery and fulfillment messages.
• Reader-request notifications.
• Resend notices.
• Review and completion communications.
• Subscription and billing notices.
• Administrative notices.
• Newsletters and other promotional or marketing communications.

Commercial marketing emails will include an unsubscribe mechanism where required by applicable law.

Unsubscribing from marketing communications may not prevent us from sending transactional, security, account, fulfillment, or other non-promotional messages necessary to provide Services you use.

Commercial emails will include VRO's physical postal address where required by applicable law.

Hard bounces, spam complaints, unsubscribes, and similar events may result in suppression of future email delivery.

6. How We Share Information

We do not sell personal information in exchange for money.

We may disclose personal information to service providers and other third parties when reasonably necessary to provide, secure, administer, or improve the Services, process transactions, comply with law, or protect our rights and users.

Service providers may process information only as necessary for the functions they perform for us, subject to applicable contractual and legal requirements.

Amazon Web Services / Amazon SES

VRO uses Amazon Simple Email Service (Amazon SES), a service provided by Amazon Web Services, to send outbound email.

Information necessary to deliver and manage email may therefore be transmitted to or processed by Amazon Web Services. This may include email addresses, message content, delivery information, and events such as deliveries, bounces, and complaints.

Stripe

VRO uses or may use Stripe to process author payments, subscriptions, and refunds.

Payment-card information is submitted to and processed by Stripe rather than stored directly in VRO's application database.

VRO may receive transaction-related information from Stripe, including customer or transaction identifiers, subscription status, payment status, amounts, refund information, and related billing records.

Supabase

VRO uses Supabase as part of the infrastructure supporting the Services, including database, authentication, application, storage, or related hosting functions.

Information stored or processed through VRO may therefore be processed using Supabase infrastructure.

Amazon and Goodreads

VRO may provide links that allow readers to visit Amazon, Goodreads, or other third-party websites to review, rate, purchase, or obtain information about a book.

When you follow one of these links, you leave VRO and interact directly with the applicable third party. That third party may collect information from you according to its own privacy policy and technologies.

VRO does not control the privacy practices of Amazon, Goodreads, or other third-party websites.

Authors and Readers

Certain information may be shared between authors and readers when necessary to operate a giveaway or fulfillment method.

For example, when an author is responsible for delivering a requested book directly to a reader, information reasonably necessary to fulfill that request may be provided to the author.

Authors receiving reader information through VRO may use that information only as authorized by VRO, the applicable program, the reader, and applicable law.

Legal and Protective Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with applicable law, legal process, court orders, or governmental requests.
• Enforce our Terms or other agreements.
• Investigate fraud, abuse, security incidents, or unlawful conduct.
• Protect the rights, property, security, or safety of VRO, Turn Page One, our users, or others.
• Establish, exercise, or defend legal claims.

We may also disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to applicable law.

7. Payment Information

Author payments may be processed through Stripe or another payment processor identified at the time of payment.

VRO does not intentionally store complete payment-card numbers or card security codes in its application database.

Payment processors maintain and process payment credentials according to their own security standards, terms, and privacy practices.

VRO may retain information necessary to administer purchases, subscriptions, cancellations, refunds, accounting, fraud prevention, and customer support.

8. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, destruction, or misuse.

These measures may include access controls, encrypted communications, authentication systems, logging, monitoring, and use of service providers that maintain their own security controls.

No website, database, transmission method, or storage system can be guaranteed to be completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes for which it was collected or subsequently processed, including to:

• Maintain and administer accounts.
• Provide reader and author Services.
• Maintain reader activity and program eligibility records.
• Maintain transaction, subscription, cancellation, and refund records.
• Maintain email suppression records.
• Prevent fraud, abuse, duplicate accounts, or circumvention of restrictions.
• Document acceptance of Terms and other agreements.
• Resolve disputes.
• Enforce agreements.
• Comply with accounting, tax, legal, regulatory, and other obligations.
• Establish, exercise, or defend legal claims.
• Maintain security and operational records.

Different categories of information may be retained for different periods.

Some records may need to be retained after an account is no longer actively used. For example, VRO may retain limited suppression information necessary to ensure that an unsubscribed address, hard-bounced address, or spam complainant is not inadvertently mailed again.

We may delete, anonymize, aggregate, or otherwise remove identifying information when it is no longer reasonably necessary for these purposes.

We do not promise that all account information will automatically be deleted after a particular period unless we expressly state otherwise or applicable law requires it.

10. Access, Correction, and Deletion Requests

VRO does not currently provide a self-service feature within the application that automatically deletes all information associated with an account.

You may contact us using the information below to request access to, correction of, or deletion of personal information associated with you.

We will evaluate requests according to applicable law and may need to verify your identity before acting on a request.

The right to request deletion does not necessarily require deletion of every record associated with you. We may retain information when permitted or required by law, including information reasonably necessary to:

• Complete transactions or provide requested Services.
• Maintain financial, accounting, or tax records.
• Maintain legally required records.
• Maintain unsubscribe, hard-bounce, or spam-complaint suppression records.
• Detect or prevent fraud, abuse, security incidents, or circumvention of account restrictions.
• Establish, exercise, or defend legal claims.
• Enforce agreements.
• Protect VRO and its users.
• Comply with other applicable legal obligations.

Where appropriate, we may satisfy a deletion request by deleting, anonymizing, de-identifying, restricting, or otherwise removing personal information from active use.

11. Privacy Rights

Depending on where you live, applicable privacy law may provide rights concerning your personal information.

These may include rights to:

• Request information about personal information we maintain about you.
• Request access to certain personal information.
• Request correction of inaccurate personal information.
• Request deletion of certain personal information.
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent.
• Request information concerning categories of third parties to whom information is disclosed.
• Exercise other rights provided by applicable law.

These rights are subject to applicable exceptions, limitations, verification requirements, and jurisdictional requirements.

To submit a privacy request, contact us using the information provided at the end of this Privacy Policy.

12. Users in the European Economic Area and United Kingdom

Where the General Data Protection Regulation, UK GDPR, or similar law applies, VRO processes Personal Data only where an appropriate legal basis exists.

Depending on the circumstances, these bases may include:

• Performance of a contract or taking steps at your request before entering into a contract.
• Compliance with a legal obligation.
• Our legitimate interests in operating, securing, improving, and protecting the Services, where those interests are not overridden by your rights and interests.
• Your consent, where consent is required.

Legitimate interests may include operating book giveaways and reader programs, maintaining account and activity records, preventing abuse, maintaining email deliverability, protecting intellectual property, securing the Services, communicating with users, and improving VRO.

Where applicable law provides additional rights, you may contact us to exercise those rights.

13. Children

VRO's Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If we learn that personal information has been collected from a child under 13 in circumstances requiring parental consent, we may delete or otherwise address that information as required by applicable law.

14. Third-Party Websites

VRO may contain links to websites and services operated by third parties.

When you follow a third-party link, including a review link to Amazon, Goodreads, or another platform, your interaction with that service is governed by the third party's terms and privacy practices.

We encourage users to review the privacy policies of third-party services they use.

15. Business Transfers

If VRO, Turn Page One, or substantially all relevant assets are acquired, sold, merged, reorganized, financed, or transferred, information associated with the Services may be transferred as part of that transaction, subject to applicable law.

16. Changes to This Privacy Policy

We may update this Privacy Policy as our Services, technology, business practices, or legal obligations change.

When we make changes, we will update the effective date at the top of this Privacy Policy.

Where required by applicable law, we may provide additional notice of material changes.

17. CAN-SPAM and Email Requirements

VRO uses email for transactional, administrative, and promotional communications.

For commercial email subject to the CAN-SPAM Act, VRO will take applicable steps to:

• Avoid materially false or misleading header information.
• Avoid deceptive subject lines.
• Identify advertising or promotional messages as required by law.
• Include a valid physical postal address.
• Provide a mechanism for recipients to opt out of future commercial marketing email.
• Honor valid opt-out requests within the period required by applicable law.
• Require service providers sending commercial email on our behalf to comply with applicable requirements.

Our current contact address is:

18. Contact Us

Questions about this Privacy Policy or requests concerning your personal information may be directed to: