legal
Privacy policy
Draft awaiting legal review. It describes how Lanternbee works today but is not yet binding.
This policy explains what personal data Lanternbee collects, why, and your rights. The controller is [Lanternbee legal entity and address — to be completed]. Contact: [privacy contact email — to be completed].
Who this covers
- Authors who have a Lanternbee account. Lanternbee is the controller of your account data.
- Readers who buy from a store or join its newsletter. The author who runs the store is the controller of your data; Lanternbee processes it for them under a data processing agreement. Lanternbee is also controller for a small set of data it needs to run the platform securely (for example abuse prevention and the reader library sign-in).
- Visitors to lanternbee.com.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Author name, email, password hash, two-step sign-in settings | Run your account and keep it secure | Contract |
| Store settings, catalogue, files | Run your store | Contract |
| Plan and billing records | Charge for plans and keep accounting records | Contract, legal obligation |
| Reader email, name, orders, library, Kindle address, newsletter consent | Deliver books and run the store for the author | The author’s instructions (we are processor) |
| Waiting-list and contact form messages | Answer you and let you into the beta | Consent, legitimate interest |
| Technical logs (IP address, browser, pages requested) | Security, fraud prevention and fixing problems | Legitimate interest |
Email addresses are replaced by a one-way code in our logs. Payment card details are handled by Stripe and never reach Lanternbee.
Who we share data with
We use these providers, each under a contract that protects the data: Hetzner (servers, Germany), Cloudflare (network, storage), Stripe (payments and tax), Amazon Web Services (email delivery, EU region), and Better Stack (uptime monitoring). Where data leaves the EEA or UK, the transfer is covered by standard contractual clauses or an adequacy decision. The full list is in the data processing agreement.
We do not sell personal data and do not use it for advertising.
How long we keep it
- Account data: while your account is open, then up to 90 days after closing.
- Invoices and payment records: as long as tax law requires (usually 6 to 10 years).
- Reader data: as the author decides, and deleted when the author closes the store or a reader asks for erasure.
- Logs: up to 30 days.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its use, and take it elsewhere. Readers can download their data and delete their account from the reader library settings at any time. Authors can export their data from the admin. To exercise any right, email [privacy contact email]. You can also complain to your data protection authority.
Cookies
See the cookie policy.
Changes
We will post changes here and email authors about material changes.