Privacy Policy
Last updated:
This Privacy Policy explains how personal data is processed when you visit this website, sign up for emails, buy or use the interactive book Make Money with AI, or contact us. It is written to meet the information duties of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), in particular Articles 13 and 14.
1. Who is responsible for your data
The controller is:
(private individual)
Registration no.:
VAT no.:
Email:
Phone:
We have not appointed a Data Protection Officer. Article 37 GDPR requires one only for public authorities, or where the core activities consist of large-scale regular and systematic monitoring of people or large-scale processing of special categories of data. Our processing does not fall into these cases. For any privacy question, write to the email above.
2. Overview of the data we process
| Situation | Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Visiting the website | IP address, date and time, page, browser, device, referrer (server logs) | Delivering the site, security, preventing abuse | Legitimate interest, Art. 6(1)(f) | We keep no copies of these logs ourselves. Our hosting provider processes them for a short time under its own retention rules (see “Who receives your data”); we can only see what its dashboard shows |
| Website statistics | Records of page views and events (such as “Buy click”) with page, referrer, country, device and browser type, linked to a visitor identifier that is a hash changing every 24 hours. Your raw IP address and browser string are never stored. No cookies.Pages visited, events, device data and an online identifier stored in a cookie | Understanding which pages help visitors | Legitimate interest, Art. 6(1)(f)Consent, Art. 6(1)(a) | For as long as we use the statistics service; the records contain no direct identifiersUp to 14 months |
| Optional email updates (newsletter) | Email address, date/time and source of sign-up, consent text, date/time of your confirmation click, email opens and clicks; for abuse limits, a salted one-way hash of your IP address and of your email address, kept 2 days | Sending book updates and tips | Consent, Art. 6(1)(a) | Until you unsubscribe or withdraw consent; proof of consent up to 3 years after |
| Buying the book | Name, email, billing country, order number, price, VAT, date, and your confirmation of consent to immediate access with its time; payment details are handled by | Concluding and performing the contract, giving access, support, accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | As long as accounting and tax law requires: under the Bulgarian Accountancy Act, 10 years for accounting registers and financial statements and 3 years for other accounting records; longer where tax law requires it for a tax audit |
| Activating your personal license key and loading the full book | Your license key, a random device label (for example “web · k3x9a2”) and the activation time. Lemon Squeezy links them to your order. To deliver chapters 4–13, our server checks the key with Lemon Squeezy and also checks with Lemon Squeezy that the order has not been refunded. It then issues a signed 24-hour session token containing a one-way fingerprint of the key and of the device activation, your first name and last initial (for example “Ivan P.”) and your order number. The book asks for a new token when the old one expires (at most once a day while you read online). Your IP address is held briefly in the server’s memory to limit repeated attempts (rate limiting) and is not stored. | Delivering the paid content only to buyers, limiting each key to devices, closing access after a refund, and showing “Licensed to … · order #… · ID …” in the chapters to discourage copying; preventing brute-force attempts | Contract, Art. 6(1)(b); legitimate interest in protecting the Book against unlicensed sharing, Art. 6(1)(f) | The token expires after 24 hours and is not stored on our servers; the rate-limit counters are kept in memory for about 10 minutes; the order data stays with Lemon Squeezy as long as the license exists |
| Withdrawal notices (online withdrawal function) and refund requests | Reference number, date/time received (UTC), name, email, order number, purchase date and note you entered, whether the order matched, status and its history (audit log: received, acknowledgement sent or failed, status changes), an integrity code (HMAC) of the notice, and — for abuse limits only — a salted hash of your IP address | Receiving and handling your notice, sending the acknowledgement of receipt, proving when it arrived and that it was not changed, preventing misuse of the form | Legal obligation, Art. 6(1)(c) (Art. 11a Directive 2011/83/EU; Art. 52a of the Bulgarian Consumer Protection Act); contract, Art. 6(1)(b); legitimate interest in proving receipt and preventing abuse, Art. 6(1)(f) | Our withdrawal register: a Cloudflare D1 database whose data is stored in the EU (see “Who receives your data”). The proof of receipt (reference number, time, name, email, order number, purchase date, whether the order matched, status history and integrity code) is deleted automatically 5 years after receipt — we keep it that long because a claim connected with the withdrawal or refund can be brought within the general 5-year limitation period of Bulgarian law (Art. 110 Obligations and Contracts Act); we review this period regularly. Longer only while a dispute is pending. The optional note you wrote is not needed for that proof and is erased after 12 months (unless a dispute is pending). The IP hash is erased after 30 days. An automatic job runs every 15 minutes to resend failed acknowledgements (with increasing intervals, up to 8 attempts), send combined acknowledgements, notify us of notices held by the abuse limits and apply these deletion rules. If our register is briefly unavailable, a notice whose email and order number match an order is accepted with a provisional reference: it then exists as our email copy and is added to the register when it works again. Deleted records disappear from Cloudflare's point-in-time backups within a further 30 days. The seller's email copy of each notice is kept for the same period |
| Abuse limits on our forms (withdrawal, newsletter, checkout, license checks) | A salted one-way hash of your IP address and, for the withdrawal and newsletter forms, of the email address entered, with the time | Stopping automated misuse (for example sending many emails to someone else's address) | Legitimate interest, Art. 6(1)(f) | 2 days (license checks and checkout: only in server memory, about 10 minutes) |
| Contacting us | Your email address, name and anything you write | Answering you | Legitimate interest, Art. 6(1)(f), or contract, Art. 6(1)(b) | Up to 2 years after the conversation ends |
About the hashes: a salted hash cannot be turned back into your IP or email address, but whoever holds the salt could check whether a given address produces the same hash. Hashed values are therefore still personal data (pseudonymised, Recital 26 GDPR), which is why we keep them only as long as stated above and use them for nothing else.
3. Data stored only on your device
The interactive book is a web application that runs in your browser. To work, it saves the following in your browser's local storage, on your own device:
- your language and light/dark theme;
- chapters you have read, quiz answers, your notes and saved excerpts, your personal plan and XP level;
- game-mode data: virtual wallet, story choices, tool cards, missions, streak and the name you type on the certificate;
- your license key and its device identifier, the session token (with your first name, last initial and order number), the time of the last successful license check, and a copy of the paid chapters so you can read them offline for up to 7 days without a connection; and the edition you last saw.
Your reading progress, notes and game data are not sent to us or to anyone else. We cannot see them, and they are not linked to your purchase. The only exception is the license key: when you activate it, and when a session token has expired (at most about once a day while you read online), the book sends the key and its device activation ID through our server function to the License API to check that it is valid, and then downloads the paid chapters with a signed session token (see section 2). The videos of the paid chapters are loaded in the same way: the session token and the device activation ID are sent to our server in the video address, so that only buyers can play them. Nothing about what or how much you read is sent.
All of this stays until you delete it: clear the site data in your browser settings, or use the “Reset” buttons in the book. We use this storage only for features you actively use, so we consider it strictly necessary for the service you asked for. Under Article 5(3) of the ePrivacy Directive (2002/58/EC) and Article 4a(4) of the Bulgarian E-Commerce Act, such storage does not require consent. The book does not use cookies, advertising identifiers or third-party tracking scripts.
The sales page also stores two small values in your browser: your theme choice and whether you have already signed up (so the sign-up pop-up is not shown again). Both are strictly necessary for features you use and never leave your device.
4. Cookies and similar technologies
This website and the book do not use cookies, and they load no statistics, advertising or tracking scripts. That is why we do not show a cookie banner. If we add privacy-friendly statistics later, we will update this policy first.
This website and the book do not use cookies. For statistics we use Plausible Analytics (Plausible Insights OÜ, Estonia; servers in the EU). It does not place anything on your device. To count unique visitors, it computes a hash from the website, your IP address and browser string with a random value that is replaced every 24 hours. Your raw IP address and browser string are never stored, and visitors cannot be followed across days or websites. That is why we do not show a cookie banner.
When you click “Buy”, and only then, this page loads Lemon.js, a small script from , and opens 's secure checkout in a window on top of the page. The checkout runs on 's own servers and uses its own cookies to process the payment and prevent fraud. Its own privacy notice applies there. Visitors who do not click “Buy” never connect to .
The pages load fonts from Google Fonts (Google Ireland Ltd.). To deliver the fonts, your browser connects to Google's servers, which receive your IP address. Legal basis: legitimate interest in a consistent, readable design (Art. 6(1)(f)). We plan to host the fonts ourselves, which will end this transfer.
5. The free chapter and optional emails
- The free chapter is a plain download. You do not need to give your email or agree to anything to get it.
- Email updates are separate and voluntary. We only add you if you enter your email in the subscription form, tick the box and submit it. Your address goes from our server function to . then sends you a confirmation email; you only become a subscriber after you click the link in it (double opt-in), so nobody can sign you up without your knowledge. If you don't confirm, you receive nothing else.
- What you receive: news about book updates and new editions, and occasional practical tips with offers for the book. We send at most a few emails per month.
6. Purchases and payments
Purchases are processed by , which acts as the Merchant of Record: it is the official reseller of the book, processes your payment, calculates and pays VAT, issues your receipt, and handles payment disputes. For the payment data it collects, is an independent controller and its own privacy notice applies. We receive from only what we need to give you access and support you: your name, email, country, order number, product and amount — never your full card or bank details.
Payments are processed by . It processes your payment details on our behalf and on its own responsibility as a payment provider. We never receive your full card or bank details.
Providing your name, email and billing data is necessary to conclude the purchase. Without it, we cannot sell you the book.
7. Who receives your data
We do not sell, rent or trade personal data. We share it only with service providers that help us run the business, under written data processing agreements (Art. 28 GDPR) or as independent controllers where stated:
- — checkout, payments, VAT, receipts, refunds (independent controller as Merchant of Record);
- — sending emails and managing the mailing list;
- — hosting the website and the book, server logs, and the small server functions that create checkouts, forward license-key checks to , pass newsletter sign-ups to , and receive withdrawal notices — which are stored in its database service (Cloudflare D1). We created the database with Cloudflare’s EU jurisdiction setting, which keeps the stored data in EU data centres; it does not by itself mean that no one outside the EU can ever access it — requests pass through Cloudflare’s global network, and Cloudflare as our processor may access data under its data processing agreement, with transfers outside the EEA covered by the EU–US Data Privacy Framework and Standard Contractual Clauses. Access to the register is limited to us, through an admin key; Cloudflare stores it on our behalf;
- — sending the automatic acknowledgement when you submit a withdrawal notice (your name, email, order number and notice);
- — website statistics;
- Google Fonts — delivering fonts;
- Proton AG (Switzerland) — our support mailbox, when you write to us. Switzerland has an EU adequacy decision;
- our accountant — where order and payout records must be kept for tax purposes;
- authorities such as tax offices or courts, only where the law obliges us.
8. Where your data is processed and transfers outside the EU
We choose providers that store data in the EU where possible. Where a provider is based in the United States, the transfer is covered by the EU–US Data Privacy Framework (an adequacy decision of the European Commission under Art. 45 GDPR) and, as a fallback, by the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
| Provider | Role | Where data is stored | Transfer safeguard |
|---|---|---|---|
| Processor: mailing list and emails | EU: Google Cloud in Germany and the Netherlands | Stays in the EU. MailerLite, Inc. (US) is certified under the EU–US Data Privacy Framework for any access from the US. | |
| Netlify (Netlify, Inc., USA) | Processor: hosting, server logs, server functions | Global content delivery network; company in the US | EU–US Data Privacy Framework certification; Standard Contractual Clauses in Netlify's data processing agreement |
| Cloudflare Pages (Cloudflare, Inc., USA) | Processor: hosting, server logs, server functions | Global network of data centres; company in the US | EU–US Data Privacy Framework certification; Standard Contractual Clauses in Cloudflare's data processing addendum |
| (Sendinblue SAS, France) | Processor: acknowledgement emails for withdrawal notices | EU | No transfer outside the EU for storage |
| (Sold through Link, LLC, formerly Lemon Squeezy LLC, USA, part of the Stripe group) | Merchant of Record: independent controller for payments; processes license-key checks | United States (Stripe infrastructure) | Stripe is certified under the EU–US Data Privacy Framework; Standard Contractual Clauses |
| Plausible Analytics (Plausible Insights OÜ, Estonia) | Processor: website statistics | EU (Germany) | No transfer outside the EU |
You can ask us for a copy of the relevant safeguards at . Providers' own policies apply to the data they process as independent controllers.
9. How we protect your data
- The website is served only over encrypted HTTPS connections.
- We use reputable providers with strong security and protect our accounts with strong passwords and two-factor authentication.
- We keep only the data listed in this policy and delete it when it is no longer needed.
No system is perfectly secure. If a breach that risks your rights ever happens, we will notify the supervisory authority and, where required, you, as the GDPR demands.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (“right to be forgotten”), unless we must keep it, for example for tax law (Art. 17);
- restrict processing in certain cases (Art. 18);
- receive your data in a portable format — data portability (Art. 20);
- object at any time to processing based on our legitimate interests, and to direct marketing (Art. 21);
- withdraw consent at any time, with effect for the future (Art. 7(3));
- complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the problem happened (Art. 77). Our lead authority is: .
For a withdrawal notice, you can ask for a copy of the stored record and its history. We cannot delete it on request before the end of the period above while we need it to prove that we received and handled your notice (Art. 17(3)(b) and (e) GDPR); we can correct inaccurate details.
To use any of these rights, write to . We answer within one month (extendable by two months for complex requests, in which case we tell you why). It is free. We may ask you to confirm your identity, for example by writing from the email address you used to buy.
11. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR). The payment provider may run automated fraud checks on payments under its own privacy notice.
12. Children
The book is intended for adults. Email sign-up is only allowed from the age of . We do not knowingly collect data from younger children. If you believe a child has given us personal data, write to us and we will delete it.
13. Links to other websites
The book and this site link to other websites, such as AI tools, platforms and sources. Their own privacy policies apply when you visit them; we are not responsible for how they process data.
14. Changes to this policy
We update this policy when our services, providers or the law change. The date at the top always shows the current version. If a change significantly affects how we use data you already gave us, we will tell you by email before it takes effect.