Privacy Policy

Last updated: 22 September 2026 · Version 1.1

This policy explains how OHL Books handles personal data. It covers the current service, including optional Meta Pixel, and identifies planned tracking tools. Logging in or acknowledging this policy is not consent to optional tracking or marketing.

1. Controller and company separation

Guided Boost PSA is the controller of personal data used to operate OHL Books. Our address is ul. Domaniewska 37, 02-672 Warsaw, Poland; NIP: 5214177112 (international format PL5214177112); KRS: 0001261827; REGON: 54554673100000. Contact details for questions and rights requests appear at the end of this page.

Guided Boost PSA and One Horse Life Media SL cooperate through mutual support and knowledge sharing, but maintain separate customer relationships. We do not share our customers, customer databases, account details, individual reading activity or marketing lists with One Horse Life Media SL as part of that cooperation. Its trademark permission does not give it access to OHL Books customer data. If you independently visit or buy from another company’s website, that company handles your data under its own privacy policy.

2. Data we process

Account and access data include your email address, account identifier, language, verification and sign-in records, session records, account status, roles and preferences. We use passwordless email codes. Treat codes and private account links as confidential.

Subscription data include your customer and subscription references, purchase and renewal status, billing-period dates, cancellations, transaction currency, amounts and refunds. The payment provider collects the billing and payment information needed at checkout. OHL Books does not receive your complete payment-card number or card security code.

Reading and usage data include visited pages, book and chapter identifiers, language, reading progress, active reading time, navigation, coarse device class, referral hostname and campaign parameters where supplied. Random visitor and visit identifiers distinguish visits; signed-in activity may be associated with your account. These identifiers are pseudonymous, not a promise of anonymity.

Communication data include support correspondence, beta applications and feedback, email preferences, delivery outcomes, unsubscribe records and suppression records. Hosting, network and security services may also process IP addresses, browser information, request details and error logs as necessary to deliver and protect the service. Do not include sensitive personal information about yourself or others in feedback unless necessary for your request.

3. Purposes and legal bases

We use account, authentication, subscription and service-request data to provide the service and perform our contract with you or take steps you request before entering it (GDPR Article 6(1)(b)). Certain billing, tax, accounting and legally required records are processed to meet legal obligations (Article 6(1)©).

We rely on legitimate interests (Article 6(1)(f)) where appropriate for security, fraud prevention, diagnosing faults, handling legal claims and proportionate internal service evaluation. Those interests are operating a reliable service, protecting accounts and understanding whether our publications are useful. You may object on grounds relating to your particular situation. This basis does not replace consent where consent is required for access to your device, tracking or electronic marketing.

Optional Meta Pixel advertising tracking relies on consent where required (Article 6(1)(a)). Planned third-party analytics will also require an appropriate consent choice before activation. You may refuse or withdraw consent without losing access to the account or paid reading service. Withdrawal does not affect the lawfulness of earlier processing based on consent. Necessary service emails are handled separately from optional publication news.

4. Current first-party analytics and cookies

With your Analytics choice enabled, OHL Books uses its own analytics to understand reading journeys, chapter usefulness, where readers stop and subscription performance. Optional readership analytics cookies are not set before this choice. Our analytics records do not store IP addresses, full user-agent strings or complete external referrer URLs. Administrators and recognised automated crawlers are excluded, and the browser’s Do Not Track signal is respected for readership analytics. These limitations concern our first-party analytics records; they do not describe every hosting log or Meta Pixel.

The current site uses ohlbooks_session for sign-in, ohlbooks_csrf for request security and ohlbooks_locale to remember language. A privacy-choice cookie, ohlbooks_consent, tells our server whether you allowed Analytics. Your choices are also stored in this browser for up to 180 days. Session and security-cookie lifetimes depend on their purpose and configuration; an account session expires or ends on sign-out. If you allow Analytics, ohlbooks_visitor has a browser lifetime of up to one year, and ohlbooks_visit is refreshed with a lifetime of 30 minutes. These analytics cookies are removed on a later server response if Analytics is refused. Cookie lifetime is different from the period for which associated server records may be needed. Browser settings can remove or block cookies, although blocking essential cookies can prevent sign-in.

Our internal analytics records are used for OHL Books operation, improvement and subscription reconciliation. We do not sell those records or provide the internal reading database to advertising platforms. Optional Meta Pixel events are described separately below.

5. Planned Google Analytics

We plan to introduce Google Analytics 4 to measure website use, traffic sources and interactions. It is not activated merely by publishing this policy. Before activation, we will provide a consent choice and disclose the actual configuration, cookie durations and retention settings. Optional Google Analytics tracking will remain disabled until you choose it where consent is required.

If enabled with your consent, Google Analytics may receive page views, interaction events, device and browser information, approximate location and online identifiers. Google states that GA4 does not log or store individual IP addresses, although the connection to its service necessarily involves processing network information. Google and its relevant group entities may process information outside the EEA under the applicable transfer arrangements.

We will not send your sign-in codes, private links, full payment details or directly identifying account information such as your email address to Google Analytics. Advertising features or linkage to advertising services would require a separate assessment and the appropriate disclosure and consent. Read Google’s Privacy Policy and Google’s information about partner sites.

6. Meta Pixel

OHL Books uses Meta Pixel to measure advertising results and, where you consent, create or use advertising audiences and show relevant OHL Books advertising on Meta services. The pixel is not loaded before you choose to allow advertising tracking. Refusing it leaves the reading and subscription service available.

With consent, Meta may receive page-view and confirmed-subscription events, the page address, timestamps, browser and device information, IP address and cookie identifiers. The pixel does not send the checkout session ID in the page address, and OHL Books does not send transaction value, currency, email address or payment details through this integration. Meta may associate events with a Meta account and use them for advertising measurement and personalisation under its policies. This can involve advertising profiling.

For users in the EEA, Meta Platforms Ireland Limited is generally the relevant Meta entity. Where Meta’s Business Tools terms make us joint controllers for collection and transmission of event data, the applicable controller arrangement will govern that limited stage; Meta’s subsequent processing is governed by its own terms and responsibilities. Meta must not simply be described as our processor for every purpose.

This browser pixel does not include customer-list uploads, email-based advanced matching or server-side Conversions API sharing. Any additional integration requires its own assessment and updated information and consent where necessary. See Meta’s Privacy Policy, Cookies Policy and Controller Addendum.

7. Tracking choices

The cookie banner offers Reject all, Accept all and separate Analytics and Marketing choices. Analytics controls our own readership analytics cookies; Marketing controls Meta Pixel. No Meta code is loaded before Marketing is allowed. You can change either choice using Cookie settings in the footer. Refusing optional tracking does not prevent account creation or paid reading. Accepting the Terms, acknowledging this policy, purchasing a subscription or continuing to browse does not provide tracking consent. Google Analytics remains inactive and would require its own disclosure and choice before activation. Meta may set identifiers such as _fbp and _fbc after consent; their operation and duration are described in Meta’s Cookies Policy linked above.

8. Service providers and other recipients

We use hosting, database, backup, security and technical service providers to operate OHL Books, with access limited to their tasks. Twilio SendGrid handles email delivery and associated operational events. Stripe receives information necessary for checkout, subscription administration and reconciliation. With Stripe Managed Payments, the seller identified at checkout also acts as merchant of record and has its own legal and privacy responsibilities. See Stripe’s Privacy Policy and Twilio’s Privacy Notice.

Authorised personnel and professional advisers may access information needed for support, accounting or legal matters. We may disclose information where required by law or necessary to establish, exercise or defend legal claims. The Meta recipient and planned Google recipient are described in sections 5 and 6 and are subject to the stated activation and consent conditions. Cooperation with One Horse Life Media SL is not a customer-data sharing arrangement.

9. International transfers

Some providers and their subprocessors may process data outside the EEA, including in the United States. Where a transfer requires safeguards, we use an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with supplementary measures where necessary. We do not assume that every provider or every transfer is covered by the same mechanism. Contact us to request information about the safeguards applicable to your data and how to obtain a copy.

10. Weekly publication-news email

Weekly publication-news email concerns newly published books and chapters. You can manage it in your profile or through the private management or unsubscribe link in a message. This preference is separate from sign-in, subscription, billing, beta-program, support and security messages. An enabled account preference is not by itself proof of legally required marketing consent; optional campaigns may be sent only when the applicable permission requirements are met.

We keep preference changes, language, delivery and suppression information to honour your choices and avoid unwanted messages. Suppression after an unsubscribe, complaint or delivery failure takes precedence over an enabled preference. The weekly flow supports one-click unsubscribe. Opening a management link with GET does not unsubscribe you; the relevant confirmation or one-click unsubscribe action makes the change.

Private management and unsubscribe tokens are stored as keyed HMAC hashes. The weekly event-processing flow does not store raw provider payloads, webhook signatures, request headers, IP addresses, user-agent strings or raw private tokens in weekly engagement records. Open and click tracking events are ignored in that flow. These technical safeguards do not make all account or email-delivery data anonymous.

11. Retention and security

We retain account and preference data while needed to provide your account and resolve its closure. Authentication credentials expire or are revoked according to their security purpose. Billing and accounting records are retained for the applicable statutory periods; relevant records may be retained longer where a dispute, legal claim or preservation obligation requires it.

Support, beta feedback, usage and diagnostic records are retained for as long as reasonably necessary for the request, publication improvement, security investigation or reporting purpose concerned. Relevant criteria include whether your account remains active, the age and usefulness of the record, whether it can be aggregated or anonymised, applicable limitation periods and an outstanding dispute. We do not promise automatic deletion on a fixed timetable that the service does not implement. You may ask for the retention criteria applicable to a particular record or request deletion subject to lawful exceptions.

Minimal unsubscribe or suppression information may remain necessary to prevent further unwanted email. Backup copies may remain until their normal replacement cycle and are protected from ordinary use. We use access restrictions, protected connections and other technical and organisational measures appropriate to the service. No online service can guarantee absolute security.

12. Your rights

Depending on the applicable conditions, you may request access, correction, erasure, restriction and portability of your personal data, and object to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent for processing based on consent. We may need proportionate verification of your identity before acting. We normally respond to a rights request within one month; any lawful extension will be explained.

You may complain to the President of Poland’s Personal Data Protection Office, UODO, or the competent supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us before exercising that right.

The account service is intended for adults aged 18 and over. Contact us if you believe a child has supplied personal data contrary to that restriction. Providing an email is necessary to create and use an account; optional tracking consent is not. OHL Books does not use solely automated decisions producing legal or similarly significant effects on you. Possible advertising profiling is described separately above.

13. Policy updates

We will update this policy when our processing changes, including before introducing further tracking integrations. Material changes will be brought to your attention where appropriate. A policy update does not replace any fresh consent required by law.

Contact Guided Boost PSA

For support, complaints, withdrawal, account closure or privacy requests, email [email protected] or write to the address below.

Guided Boost PSA
ul. Domaniewska 37
02-672 Warsaw, Poland
NIP: 5214177112 · International format: PL5214177112
KRS: 0001261827
REGON: 54554673100000