Privacy Policy

This Privacy Policy explains how Temple Seven Press, Inc., a Wyoming corporation doing business as "Temple Seven" ("Temple Seven," "Company," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with www.templeseven.com and our related Services, and describes the rights available to you depending on where you live. This Policy is incorporated into, and should be read together with, our Terms and Conditions and our Cookie Policy.

1. Scope of This Policy

This Policy applies to personal information we collect through the Services — including when you browse the catalog, create an Account, purchase a Digital Product or Print Product, subscribe to a paid tier, purchase or redeem a gift card, make a donation, join our affiliate program, contact customer support, or subscribe to our mailing list. It does not apply to third-party websites or services that we do not control, even where linked from our Services, including the separate privacy practices of our Payment Processor (Stripe) and Fulfillment Partner (Lulu Press, Inc.), each of which maintains its own privacy policy governing information it collects directly.

2. Who We Are

Temple Seven Press, Inc. is the entity responsible for the personal information described in this Policy (in EU/UK data protection terminology, the "controller" for most processing described below, except where we act as a processor on behalf of a Fulfillment Partner or Payment Processor for narrow, specified tasks). Our mailing address is 971 US Highway 202N #8250, Branchburg, NJ 08876, United States, and we can be reached at the contact details in Section 25. Our registered agent for service of legal process is Northwest Registered Agent Service Inc., 30 N Gould St, Ste N, Sheridan, WY 82801.

3. Information You Provide to Us

• Account information: name, email address, password (managed via Firebase Authentication and stored in hashed/encrypted form, never in plain text), country/region, and, if you choose to enable it, time-based one-time-password (TOTP) multi-factor authentication enrollment.
• Order information: billing name, and, for Print Products, shipping name, address, and phone number (a phone number is required by our Fulfillment Partner, Lulu, to arrange delivery), items purchased, and order history.
• Subscription and billing information: subscription tier, billing cycle, status, and a token representing your payment method as provided by Stripe (we do not receive or store your full card number).
• Reading data: annotations, highlights, bookmarks, resume/reading-progress positions, and reader display preferences associated with your Account, so your reading experience is consistent across sessions and devices.
• Book requests: if you use our book-request form, the title, author, source, and any notes you submit.
• Gift card information: gift card codes purchased or redeemed, and, if you send a gift card to another person, the recipient's name, email address, and any personal gift message you include.
• Donation information: donation amount and date, and your identity as provided through Stripe Checkout.
• Affiliate/creator information: for public program applicants, name, email, platform(s), audience size, and pitch submitted through our application form; for approved Affiliates, payout identity and details collected through Stripe Connect Express onboarding (Stripe performs "know your customer" verification; we do not separately collect or store your government ID).
• Communications: information you provide when you contact customer support, respond to surveys, or submit a review.

We do not intentionally collect special categories of personal information (such as health, religious belief, or biometric data) through the Services, and ask that you not include such information in support messages or reviews unless clearly necessary and relevant.

4. Information We Collect Automatically

When you use the Services, we and our service providers automatically collect certain technical information through cookies, pixels, log files, and similar technologies, including: IP address and approximate geolocation derived from it; device, browser, and operating system type; referring and exit pages; pages viewed, reading progress, and features used; date and time stamps; and diagnostic and crash information. Details of the specific cookies and similar technologies we use, their purposes, and how to control them are set out in our separate Cookie Policy, which forms part of this Privacy Policy.

5. Information We Receive From Third Parties

• From our Payment Processor (Stripe): payment status, a tokenized representation of your payment method, fraud-risk signals, and, where you use Stripe Tax, information used to calculate applicable sales tax or VAT.
• From our Fulfillment Partner (Lulu Press, Inc.): production and shipping status for Print Products, including tracking information.
• From analytics and advertising partners: aggregated or pseudonymous audience and campaign-performance data, where we run or measure marketing campaigns.
• From social sign-on providers: basic profile information (such as name and email), if you choose to register or log in using a third-party account.

6. Payment Information

All payment card data is collected and processed directly by Stripe, Inc., a PCI-DSS compliant payment processor. We never receive, transmit, or store your full card number, card verification code, or bank account credentials. We receive limited information from Stripe necessary to confirm your purchase, issue receipts, detect fraud, process refunds, and manage Subscriptions, such as the last four digits of your card, card brand, expiration month/year, billing postal code, and a payment token. Your use of Apple Pay, Google Pay, or Link is likewise governed by Stripe's and, where applicable, Apple's or Google's own privacy practices.

7. Children's Privacy

The Services are not directed to children under the age of thirteen (13) (or the equivalent minimum age in your jurisdiction, which may be higher, such as sixteen (16) in some EU member states or under certain U.S. state laws), and we do not knowingly collect personal information from such children without appropriate consent. If we become aware that we have collected personal information from a child in violation of applicable law, we will take reasonable steps to delete it. A parent or guardian who believes we may have collected information from a child may contact us using the details in Section 25.

8. How We Use Your Information

• To create and administer your Account and deliver Digital Products and Print Products you purchase or access for free.
• To process payments, calculate applicable tax, prevent fraud, and manage Subscriptions, gift cards, and donations.
• To fulfil and ship Print Products through our Fulfillment Partner, and to provide order status and delivery updates.
• To provide customer support and respond to your inquiries.
• To operate, secure, troubleshoot, and improve the Services, including analyzing reading and usage trends across our catalog.
• To personalize your experience, including recommending titles and remembering reading progress.
• To send transactional communications (order confirmations, receipts, renewal notices, shipping updates) and, where you have opted in or as otherwise permitted by law, marketing communications about new Editions, promotions, or Subscription offers.
• To administer the affiliate program, including calculating and paying commissions.
• To comply with legal obligations, enforce our Terms, and protect the rights, property, and safety of the Company, our users, and the public.

9. Legal Bases for Processing (EU/UK Users)

Where the EU General Data Protection Regulation ("GDPR") or the UK GDPR applies to our processing of your personal information, we rely on the following legal bases: performance of a contract (to create your Account, deliver purchases, and administer Subscriptions); legitimate interests (to secure and improve the Services, prevent fraud, and, in a manner that does not override your rights, conduct analytics and limited direct marketing to existing customers); consent (for non-essential cookies and, where required, marketing communications to prospective customers); and compliance with a legal obligation (for example, tax and accounting records). You may withdraw consent at any time as described in Sections 22–23 without affecting the lawfulness of processing before withdrawal.

10. We Do Not Sell Your Personal Information — Ever

We do not sell your personal information for money, and we do not use advertising or marketing pixels of any kind on the Services. Our only non-essential tracking technology is Google Analytics (via Firebase Analytics), which is disabled by default and only activates if you affirmatively accept it through our cookie banner, as described in our Cookie Policy. Because we do not engage in cross-context behavioral advertising and do not disclose personal information to third parties in exchange for money or other valuable consideration, we do not believe our current practices constitute a "sale" or "sharing" of personal information under the CCPA/CPRA or comparable U.S. state privacy laws, and we accordingly do not currently operate a "Do Not Sell or Share My Personal Information" link. If our practices change in the future such that a sale or sharing occurs, we will update this Policy and implement the required opt-out mechanism before doing so. As a precaution, we nonetheless detect and honor the Global Privacy Control (GPC) signal, where technically supported by your browser, as a general opt-out preference signal for any future non-essential tracking.

11. Cookies and Tracking Technologies

We use a small number of strictly necessary cookies for core site functionality (authentication, cart, and remembering your cookie preference) and, only if you affirmatively opt in through our cookie banner, Google Analytics to help us understand site usage. We do not use advertising or marketing cookies of any kind. You can accept or decline non-essential cookies through our cookie banner and change your choice at any time via "Manage Cookies" in the site footer. For a full description of each cookie we use, its purpose, and duration, please see our Cookie Policy.

12. How We Disclose Information

We disclose personal information to the following sub-processors and categories of recipients, each engaged under contractual terms that restrict their use of your information to the purposes we specify:

• Google LLC (Firebase / Google Cloud Platform) — authentication (Firebase Authentication), database and file storage (Firestore, Cloud Storage), hosting and serverless functions (Firebase Hosting, Cloud Functions), site analytics (Firebase/Google Analytics, only after consent), and AI-assisted processing used in our editorial pipeline (Cloud Vision for OCR/image processing and the Gemini API for AI-assisted cleanup, description generation, and book-request triage).
• Stripe, Inc. — payment processing, tax calculation and collection via Stripe Tax, and Affiliate payouts and identity verification via Stripe Connect Express.
• Lulu Press, Inc. (our Fulfillment Partner) — to manufacture and ship Print Products, which requires disclosure of your name, shipping address, and phone number.
• Resend — to deliver transactional email, including receipts, authentication and security emails, subscription lifecycle notices, and gift card, donation, and book-request confirmations.
• Sentry — error and crash telemetry to help us identify and fix technical issues; Sentry is configured not to collect personal information beyond an internal user identifier (default PII collection is disabled).
• Professional advisors (lawyers, accountants, auditors) and, where necessary, regulators or law enforcement — to comply with legal obligations or protect our rights.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to that entity's assumption of the commitments in this Policy.

We do not disclose personal information to third parties for their own independent marketing purposes without your consent, and, consistent with Section 10, we do not disclose personal information to any party in exchange for money or other valuable consideration.

13. International Data Transfers

We are based in the United States, and personal information we collect is processed and stored primarily in the United States by our sub-processors named in Section 12 (Google, Stripe, Lulu, Resend, and Sentry each operate infrastructure in the United States). If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data-transfer restrictions, your information may be transferred to and processed in a country that has not been deemed to offer an "adequate" level of data protection by your local authority. Where required, we rely on the European Commission's Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum) with our sub-processors, or another lawful transfer mechanism.

We are currently assessing, based on the scale and nature of our processing of EEA and UK personal information, whether we are required to appoint a representative in the EU and/or UK under Article 27 of the GDPR/UK GDPR. If a representative is required, we will appoint one and update this Policy with their contact details.

14. Data Retention

We retain personal information according to the following schedule, which we review periodically to ensure it reflects only what is necessary to provide the Services and meet our legal obligations:

• Account data: retained while your Account is active. If you delete your Account, it enters a seven (7) day grace period (during which you may reactivate it), after which private account data is permanently and irreversibly deleted on an hourly deletion cycle.
• Order and billing records: retained for seven (7) years to meet tax, accounting, and fraud-prevention obligations. Following Account deletion, order records are retained but disassociated from your Account (the record's user reference is cleared) rather than linked to your identity going forward.
• Analytics data: retained for fourteen (14) months, after which it is anonymized or deleted.
• Error/crash logs (Sentry): retained for ninety (90) days.
• Support-related AI assistant chat threads: retained for fourteen (14) days.

We may retain limited information for longer where necessary to resolve disputes, enforce our Terms, or comply with legal obligations, and we will delete or anonymize personal information when it is no longer needed for these purposes.

15. Data Security

We implement administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, including: HTTPS-only access with HSTS preload; a Content Security Policy; server-side sanitization of user-submitted HTML; rate limiting on abuse-prone and sensitive endpoints; optional two-factor (TOTP) authentication; time-limited, signed access URLs (expiring after thirty minutes) for stored content files; and reliance on PCI-DSS-compliant payment processing so that we never handle full card data ourselves. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information that requires notification under applicable law, we will notify you and/or the relevant regulator in accordance with that law.

16. Your Privacy Rights — United States

Depending on your state of residence and whether we meet the applicable thresholds for coverage, you may have rights under the CCPA/CPRA and comparable laws in states such as Virginia, Colorado, Connecticut, Utah, and others that have since enacted similar comprehensive privacy statutes. Where applicable, these rights may include the right to: know and access the categories and specific pieces of personal information we have collected about you; delete personal information we hold about you; correct inaccurate personal information; opt out of the "sale" or "sharing" of personal information and of use of sensitive personal information for certain purposes (as described in Section 10, we do not currently sell or share personal information, so no opt-out is currently necessary, but you may still submit a request and we will confirm this in response); opt out of profiling in furtherance of decisions that produce legal or similarly significant effects; and not receive discriminatory treatment for exercising these rights. You may exercise these rights by contacting us as described in Section 21. We will verify your request using information reasonably necessary to confirm your identity before acting on it, and you may designate an authorized agent to submit a request on your behalf in accordance with applicable law.

17. Your Privacy Rights — European Economic Area and United Kingdom

If the GDPR or UK GDPR applies to you, you have the right to: access your personal information; rectify inaccurate information; erase your information in certain circumstances; restrict or object to processing, including processing based on legitimate interests and direct marketing; receive a copy of your information in a portable format; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local data protection supervisory authority, including, for UK residents, the Information Commissioner's Office (ICO).

18. Your Privacy Rights — Canada

If you are located in Canada, our collection, use, and disclosure of your personal information is governed by the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial equivalents. You have the right to access the personal information we hold about you, request correction of inaccurate information, and withdraw consent to certain processing, subject to legal and contractual restrictions. You may contact us as described in Section 21, or you may contact the Office of the Privacy Commissioner of Canada if you believe your rights have not been respected.

19. Your Privacy Rights — Australia and New Zealand

If you are located in Australia, we handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth), including by taking reasonable steps to keep your information accurate, secure, and used only for the purposes for which it was collected or as otherwise permitted by law. If you are located in New Zealand, we handle personal information in accordance with the Privacy Act 2020. In both cases, you have the right to access and request correction of personal information we hold about you, and you may lodge a complaint with the Office of the Australian Information Commissioner or New Zealand's Office of the Privacy Commissioner, respectively, if you believe we have not met our obligations.

20. Your Privacy Rights — Other Jurisdictions

If you reside in a jurisdiction not specifically addressed above, you may nonetheless have rights under local data protection law, and we will honor requests to access, correct, or delete your personal information to the extent required by, and in the manner provided under, the law applicable to you. Contact us as described in Section 21 and we will respond in accordance with applicable law.

21. How to Exercise Your Rights

You may exercise the rights described above by emailing privacy@templeseven.com, by adjusting settings in your Account (where self-serve tools are available, such as Account deletion and profile correction), or by writing to the mailing address in Section 25. To protect your information, we will take reasonable steps to verify your identity before fulfilling a request — typically by confirming details associated with your Account or order history — and may decline a request, or a portion of it, where permitted by applicable law, such as where fulfilling it would be unlawful, would infringe the rights of others, or where an exception applies (for example, retaining records required for tax compliance). We aim to respond to verifiable requests within thirty (30) days, and in all cases within the maximum timeframes required by applicable law — generally forty-five (45) days under the CCPA/CPRA (extendable by a further forty-five (45) days where necessary) and one (1) month under the GDPR/UK GDPR (extendable by a further two (2) months for complex requests) — and we will notify you of any extension. We do not currently offer a self-serve data export/portability tool; portability requests are handled manually by our privacy team.

22. Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" signal; because no common industry standard for interpreting that signal currently exists, the Services do not currently respond to browser Do Not Track signals. We do, however, detect and honor the Global Privacy Control (GPC) signal, where technically supported by your browser or browser extension, as a valid request to opt out of the sale and sharing of personal information under applicable law.

23. Marketing Communications

Where you have opted in, or where otherwise permitted by applicable law (including for existing customers regarding similar products, consistent with applicable e-marketing rules such as CAN-SPAM in the United States, CASL in Canada, and PECR/GDPR in the UK/EU), we may send you marketing emails about new Editions, promotions, and Subscription offers. Every marketing email includes an unsubscribe link, and you may also manage your communication preferences from your Account. Opting out of marketing communications does not affect transactional messages necessary to service your Account or orders, such as receipts, renewal notices, and shipping updates.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will post the revised Policy on this page with an updated "Last Updated" date and, where changes are material, provide additional notice as required by applicable law (which may include email notice or a prominent notice on the Services). Your continued use of the Services after the effective date of a revised Policy constitutes acceptance of the changes, to the extent permitted by applicable law.

25. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our data practices, please contact us at:

Temple Seven Press, Inc. — Attn: Privacy Officer
Mailing address: 971 US Highway 202N #8250, Branchburg, NJ 08876, United States
Registered agent for service of process: Northwest Registered Agent Service Inc., 30 N Gould St, Ste N, Sheridan, WY 82801
Email: privacy@templeseven.com | Website: www.templeseven.com

If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority, including, for UK residents, the Information Commissioner's Office (ico.org.uk).