Privacy Policy

BookSite Org ("BookSite", "we", "us") is operated by Graphican.com Pty Ltd (ABN 29 630 287 642, ACN 630 287 642), PO Box 330, Somerton VIC 3062, Australia. Last updated: 27 October 2026.

This policy explains what personal information we collect through booksite.org, how we use it, who we share it with, and the choices and rights you have. It applies to everyone who uses BookSite — readers, authors and visitors. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where it applies to you, the GDPR and the UK GDPR.

1. What we collect

• Account details — your name or display name, email address and a password (stored only as a one-way hash, never in readable form), and your phone number only if you choose to give it. If you sign in with Google, we receive your name, email address and profile picture from Google. We only ask Google for basic identity information — never for access to your email, files, calendar or any other Google data.

• Confirmations — when you create an account you confirm that you are 18 or older and accept our Terms. We record that you did, and when.

• Email confirmation — whether you have confirmed your email address and when. We also record when you asked us to send the confirmation link again, to limit repeated requests.

• What you do on BookSite — books you buy, chapters you open or complete, your reading progress, items you save, and what you post: comments, discussion posts, replies, reviews and action reports. What you post publicly can be seen by other readers and by the book's author.

• Your answers — your answers to a book's Reader-Fit assessment and, if you choose to answer them, the optional Reader Profile questions. These are shared with the author of that book (see section 3).

• Purchases — what you bought, when, and for how much. Your card details are handled by Stripe and never reach us.

• Newsletters and email — your email address, which book's list you joined, when and where you signed up, whether you confirmed, and whether you opened or clicked an email (so authors can see what works).

• Messages and applications — anything you send us or an author, including coaching applications and support emails.

• Pictures you upload — for example profile photos and images placed in content. We resize and compress new uploads, and remove hidden camera data (including the location a photo was taken) from them.

• Technical information — your IP address, browser and device type, the pages you visit and your approximate region. We use it for security, to limit abuse, to keep the service running, and to count visits.

• Cookies and similar technologies — described in our Cookie Policy.

• If you are an author — your author profile and books, and the information needed to publish and be paid, much of which is collected by Stripe, our payments provider.

2. How we use it, and why

• To provide BookSite — run accounts, deliver what you buy, show your library and progress, let you take part in discussions, take payments, and pay authors their share. (Needed to provide the service you asked for.)

• To email you — confirmations, receipts, security notices and replies, and the newsletters you chose to subscribe to. (Needed to provide the service; your consent for newsletters, which you can withdraw at any time.)

• To keep BookSite safe — spam protection, limiting repeated attempts, and preventing fraud and abuse. (Our legitimate interest in a secure service, and legal obligations.)

• To understand and improve BookSite — our own visit statistics, plus Google Analytics and Hotjar. (Our legitimate interest.)

• To help authors understand their readers — authors see activity and answers relating to their own book (section 3). (Our legitimate interest, and your choice when you answer optional questions.)

• To meet legal obligations — tax and accounting records, and responding to lawful requests.

We do not sell your personal information, and we do not use it for advertising.

3. Who sees what

• Authors see the people who subscribed to their newsletter (and their email addresses), the people who bought their book, the answers readers gave to that book's assessment and profile questions, and the comments and posts on their book.

• Other readers see only what you post publicly, under the name you chose. We never show your email address to other readers.

• BookSite staff can see account and activity information where needed to run the service and give support.

4. Confirming and checking email addresses, and newsletters

Joining a book's newsletter is a two-step process: you enter your email address, we email you a link, and you are subscribed only when you click it (the link expires after 7 days). Every newsletter has a one-click unsubscribe link, and signed-in readers can manage their subscriptions under Profile → Email preferences. We keep an address that has unsubscribed so that we keep honouring your choice.

Confirming your email address. When you create an account with an email address and a password, we email you a link and you must confirm that you own the address before you can use the account. Until then you can see only the confirmation page, and you can ask us to send the link again (up to 3 times a day) or sign out. The link works for 7 days from when you signed up. If you have not confirmed within 7 days, the sign-up is removed and the details you gave are deleted. For readers this happens automatically. For author accounts, we review unconfirmed accounts and delete those that have no books or other content. Accounts created with Google are confirmed by Google and do not need this step. If someone signs in with Google using an address that an unconfirmed account is holding, we remove the unconfirmed account, because Google has shown the address belongs to the person signing in. We do this so that nobody can use your email address without your knowledge.

Before we send a confirmation email, we check the address with our email provider, Emailit (emailit.com). Emailit tells us whether the address looks valid and can receive mail — for example, whether it is mistyped, belongs to a disposable service, or has no mail server. The address you type is sent to Emailit for that check, in the same way it is when Emailit later delivers our email to you. We do this so that people are not left waiting for an email that can never arrive, and to keep our email reliable.

5. The service providers we use

We share personal information with the companies that help us run BookSite, only as needed for the job they do for us:

Some of these providers store or process information outside Australia, including in the United States and Europe. Where we send personal information overseas we take reasonable steps to make sure it is handled in line with this policy, and, for people in the EEA and UK, we rely on recognised safeguards such as standard contractual clauses where they apply. We may also share information when the law requires it, to protect people's safety or our rights, or as part of a sale or restructuring of our business (we would tell you first).

6. Cookies and analytics

We use essential cookies to keep you signed in and the site working, and a first-party cookie that gives each visitor an anonymous random ID so we can count unique visitors and visits for authors. We also use Google Analytics and Hotjar to see how the site is used; you can block them in your browser settings or with an opt-out tool such as Google's Analytics opt-out add-on. Details, including every cookie we set and how long it lasts, are in our Cookie Policy.

7. How long we keep information

We keep account and activity information while your account is open. If you ask us to delete your account, we delete or anonymise your personal information within a reasonable time, except for records we must keep by law — for example purchase and tax records, for the period the law requires. Confirmation links expire after 7 days, and an account whose email address is still unconfirmed after 7 days is deleted (section 4). Our providers keep technical logs on their own schedules.

8. Keeping your information safe

We use reasonable technical and organisational measures to protect your information, including encrypted connections, hashed passwords and secure hosting. No online service can guarantee perfect security. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator, as Australian law requires.

9. Your rights

You can ask us to access the personal information we hold about you, correct it, delete it, or give you a copy of it. If the GDPR or UK GDPR applies to you, you can also object to or restrict how we use it, and you can withdraw consent at any time (for example, unsubscribe from a newsletter) without affecting what happened before. Email us at support@booksite.org; we may need to confirm it's you, and we aim to reply within 30 days.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, if you live in the EEA or UK, to your local data protection authority.

10. Age

BookSite is for adults (18 and over) only. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as BookSite grows. The "Last updated" date at the top shows when it last changed, and we will let you know of significant changes.

12. Contact us

Questions or requests about your privacy: support@booksite.org. Graphican.com Pty Ltd (ABN 29 630 287 642, ACN 630 287 642), PO Box 330, Somerton VIC 3062, Australia.