Privacy
What we collect, why, who sees it, and how long we keep it.
This notice explains what personal data The Wolfsbane Library collects, why, who we share it with, how long we keep it, and the rights you have over it. We collect as little as we can: there are no customer accounts, nothing is sold to anyone, and nothing that tracks you is used unless you agree to it.
Who is responsible for your data
The Wolfsbane Company, which runs this shop, is the controller of your personal data:
The Wolfsbane Library
Write to us at that address about anything in this notice. Our full company details are on our Legal notice.
In short
- To fulfil an order, we keep your name, email address, delivery address and phone number, your billing address if it is different, and what you bought.
- Card details go to Stripe, never to us. We only learn the last four digits of the card.
- Your name, delivery address, phone number and email go to our printing partner and the carrier, so that your books can be printed and delivered.
- We email you only about your order, unless you tick the box at checkout to hear our news.
- Google Analytics, Google Ads, affiliate tracking and players from other sites (videos and audio) are used only if you allow them, purpose by purpose, on the cookie banner.
- We count visits ourselves, without cookies, and without storing your IP address.
What we collect, and why
When you order
Your name, email address, delivery address and the phone number the courier can use (for ebooks, only your name and email), your billing address if it is different, what you bought, the prices, shipping, VAT and any voucher, and when you ordered. We also note the country of your internet connection when you order, worked out on our own server from your IP address, which we do not keep: tax rules ask us to keep evidence of where an ebook was sold.
We use these details to take your payment, print and deliver your books, send your ebooks, email you about your order, answer you, handle returns and refunds, and keep the accounts and tax records the law requires. The legal basis is the contract between us and, for our accounts and tax records, our legal obligations.
Payment
You pay on the secure page of Stripe, which receives your email address, the amount and the payment details you enter there. Stripe tells us whether the payment succeeded, the last four digits and the brand of your card, and the billing details you gave it. Stripe also checks payments for fraud, which it does as a controller in its own right, under Stripe's privacy policy.
Printing and delivery
To print your books and send them to you, we give our printing partner, Lulu, your name, delivery address, phone number and email address. Lulu passes the address and phone number to the carrier that delivers your parcel, which may contact you about the delivery.
Ebooks
When you download an ebook, we record when, which file, and the country of your connection (worked out on our own server; your IP address itself is not kept). This lets us limit how often each file is downloaded, and keeps the record tax rules ask for of where a digital sale took place. Your download page is private to your order.
Following your order
Anyone can look up an order only with its reference and the email address it was placed with. The tracking page shows your books, their progress, the carrier's tracking and the town they are going to, never your name, street, email or phone. Orders are no longer shown online a year after they are complete.
When our emails do not reach you
There are no accounts here, so your email address is how your receipt, download links and tracking reach you. If you mistype it, you can correct it from the browser you ordered with for 48 hours after ordering (or later, if our email to you was returned), and everything is sent again to the corrected address only.
From any other browser, "Didn't get your email?" on Track an order finds your order from an address close to the one you typed, the amount you paid, and the last four digits of your card or your postcode. Stripe tells us those four digits with each payment; we keep them for this and for our records, never the full card number.
If an email to you is returned as undeliverable, or reported as spam, our email service tells us. We note it on your order so that we can put it right, and stop sending you our newsletter: an address that bounces is not written to again.
Our email list
At checkout you can tick a box to hear from us about new releases and occasional offers. It is never ticked for you, and you do not need it to buy anything. If you tick it, we keep your name and email address, when you agreed and with which order. The legal basis is your consent, which you can withdraw at any time.
Our emails have no tracking pixels and no tracked links: we do not know whether you open them or what you click. Every email has an unsubscribe link that works with one click. You are taken off the list straight away; we keep only a note that you unsubscribed, so we know not to write to you. Write to us if you would rather we deleted your details entirely.
When you write to us
We keep your message, your email address and our reply, to answer you and to keep a record of what was agreed. The legal basis is our legitimate interest in answering you, or the contract between us if it is about an order.
When you visit the website
Where you ship to. On your first visit we suggest a destination from your approximate location, so that prices are in your currency. It is worked out on our own server from your IP address, which is not stored or shared, and you can change it at any time at the foot of every page.
Counting visits. To see which pages people read and how they found us, the shop counts visits itself, without cookies and without storing anything in your browser. It records the page, the site or campaign link that brought you, your country (worked out from your IP address on our own server), and the kind of device and browser. Your IP address is not stored: it is combined with your browser's name into a code that changes every day and cannot be traced back to you, so we cannot follow you from one day to the next. Nothing is shared with anyone, and the counts are deleted after 25 months. Staff signed in to the shop are not counted. The legal basis is our legitimate interest in understanding how the shop is used, which this does without identifying you.
Keeping the site safe. Like every website, ours receives your IP address with each request. We use it briefly to protect the shop from abuse (for example, to limit repeated attempts at something), and our hosting provider may keep it in its server logs for a short time for the same reason. That is our legitimate interest in keeping the shop secure.
Cookies. The website uses a few cookies that it needs to work, and others only if you agree. Our Cookie policy lists every one.
Only if you agree
The cookie banner asks for each of these purposes separately. Nothing is switched on until you choose, rejecting everything takes one click, just as accepting does, and closing the banner is never taken as agreement.
If you allow measuring visits, or advertising and partners:
- Google Analytics measures how the shop is used (pages seen, the books viewed and added to the basket, and purchases), and Google Ads measures which of our adverts led to an order. Google receives your IP address and the identifiers in its cookies, and processes them under its own terms, as described in how Google uses information from sites that use its services. We keep Google Analytics data for no longer than 14 months.
- Affiliate partners. If you arrive through a link from one of our affiliate partners (a reviewer or reading club who recommends our books), we keep the partner's click reference for the length of the referral period, so that they can be paid a commission if you order. We then tell our affiliate network, impact.com, the order reference, the books and what was paid for them, the currency, whether you have ordered from us before, and a scrambled (hashed) version of your email address, never the address itself.
The legal basis is your consent. Nothing from Google, and no affiliate reference, is loaded or kept until you agree, and you can change your mind at any time with "Cookie settings" at the foot of every page.
Videos and audio in our articles
Some of our Marginalia articles include a video or audio player from YouTube (in its privacy-enhanced mode), Vimeo, Spotify or SoundCloud. Until you allow videos and audio from other sites on the cookie banner, or press play on one of them, nothing is loaded from that service: you see a notice in its place, with a link to open it on the service's own site instead. Once you play it, the player is loaded from that service, which receives your IP address and may set its own cookies, under its own privacy policy. The legal basis is your consent.
Your cookie choices
To show that we asked before setting anything, we keep a record of each choice made on the cookie banner: which purposes were allowed, on which version of the banner, how (accept all, reject all, or chosen one by one) and when, under a random reference that is also kept in your consent cookie. The record holds nothing that identifies you: not your IP address, nor anything about your browser. We keep it for two years. The legal basis is our legal obligation to be able to show consent.
People we publish with
If you are an author, a rights holder, a translator, an illustrator or someone else we work with, we keep your name, contact details, our correspondence and the agreements and documents that record our right to publish each book, for as long as we publish it and for ten years after, to show where our rights come from. The legal basis is the contract between us and our legitimate interest in being able to prove our rights.
Who we share it with
We share your data only as this notice describes, with these service providers, which act on our behalf and under our instructions:
| Provider | What for |
|---|---|
| Stripe Payments Europe Ltd. (Ireland) | Taking payments |
| Lulu Press, Inc. (United States), and the carriers it uses | Printing and delivering your books |
| The email service we use (Google, Brevo, Resend or Amazon Web Services) | Sending our emails |
| Cloudflare, Inc. | Storing website files, print files and our encrypted backups |
| Our hosting provider | Running the website and its database |
| Google Ireland Ltd., only with your consent | Analytics and measuring adverts |
| impact.com, only with your consent | Paying affiliate partners |
We also share data when the law requires us to (for example, with the tax authorities), with our professional advisers, such as our accountant, under a duty of confidence, and with a buyer of our business if it is ever sold, who would take on this notice. We never sell your personal data.
Outside the European Economic Area
Some of these providers, such as Lulu, Cloudflare and impact.com, are based in the United States, or may handle data there. Where they do, your data is protected either because the provider is certified under the EU-US Data Privacy Framework, or by the European Commission's standard contractual clauses. Write to us for a copy of the safeguards that apply.
How long we keep it
| What | How long |
|---|---|
| Orders, invoices and payment records | Ten years, as Portuguese accounting and tax law requires |
| An order shown on Track an order | One year after it is complete |
| Ebook download records | As long as the order |
| Our email list | Until you unsubscribe; then only a note that you did |
| Messages you send us | Up to three years after the matter is closed |
| Visit counts | 25 months |
| Records of cookie choices | Two years |
| Our encrypted backups | The five most recent, made every few days |
| Rights records for the books we publish | As long as we publish the book, and ten years after |
When a period ends, we delete the data, or keep it only in a form that no longer identifies you.
Your rights
You have the right to:
- see the personal data we hold about you, and have a copy of it;
- correct it, if it is wrong or incomplete;
- delete it, where we no longer need it or you withdraw your consent (we must still keep order and tax records for as long as the law requires);
- restrict how we use it, or object to our using it on the basis of our legitimate interests;
- take it with you, in a common format, where we hold it on the basis of your consent or our contract;
- withdraw your consent at any time, where we rely on it, without affecting what we did before.
To use any of these rights, write to us. We may ask you to confirm your identity, for example by writing from the email address you ordered with, and we will reply within one month.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to a data protection authority: in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or the authority of the country where you live or work.
Children
Our shop is not intended for children under 16, and we do not knowingly collect their personal data. Parents and guardians are welcome to order our children's books for them.
Keeping your data safe
The shop runs over an encrypted connection, the back office needs a password and a second, time-based code, staff see only what their work needs, every change is logged, and our backups are encrypted. No system is perfectly secure, but if a breach ever puts your data at risk, we will tell you and the authorities as the law requires.
No automated decisions
We do not make decisions about you by automated means that have legal or similarly significant effects on you, and we do not build profiles of our customers.
Changes to this notice
We will update this notice when what we do with personal data changes, and show the date at the foot of this page. If a change matters to you, we will tell you before it takes effect.
Last updated: 18 October 2026.