Bombookstory · UK privacy notice
Privacy Policy.
This notice explains how order, gift-recipient and access data is used. Last updated: 30 August 2026.
01 · Controller
Who is responsible
Vasyl Strazhyr, a UK sole trader trading as Bombookstory, is the controller for the order-fulfilment information described here.
Email: bombookstory@gmail.com
Website: bombookstory.com
Geographic address: Grantham House, 46 Botanic Square, London, E14 0NJ, United Kingdom
02 · Information we handle
Data categories and sources
We may handle the payer email and, where Stripe makes them available for fulfilment or support, payer name, billing country or address, tax ID, limited payment-method metadata, totals, taxes, currency, refunds, disputes and buyer-support status. We also handle order and Stripe Checkout references, payment status, quantity, delivery choice, consent and policy version, gift-recipient emails, access status, expiry and download count, limited security and error logs, and information sent to support.
The payer email and core order data are required to enter into and fulfil the purchase. Gift-recipient emails are required only for a gift order. Payment card details are entered directly into Stripe Checkout and are not stored on Bombookstory servers. We do not ask for a telephone number, business name or full address unless Stripe or applicable law requires it for a particular payment.
03 · Purposes and legal bases
Why we use data
- Contract: to create the order, confirm payment, provide access and support, and enforce the personal licence.
- Legal obligation: to keep tax, accounting and consumer-law records and respond to lawful requests.
- Legitimate interests: to prevent fraud and abuse, secure links, investigate delivery problems, protect copyright, and deliver a requested gift in a limited and expected way.
- Consent: where non-essential cookies or optional marketing are introduced. We do not currently send marketing email.
We do not use order or gift-recipient data for solely automated decisions with legal or similarly significant effects.
04 · Gift-recipient notice
If somebody bought the book for you
Your email came from the purchaser. We use it only to create and deliver personal access, protect that access and provide related support. The delivery email explains that the purchaser supplied the address and does not disclose unnecessary payer data.
Our legal basis is legitimate interests in fulfilling a genuine gift request in a limited, expected way. We do not add gift recipients to marketing lists. You may contact us to correct or erase an incorrect address, subject to limited legal or security records we must retain.
05 · Providers and transfers
Who receives information
We use Stripe and the relevant Stripe Managed Payments/Onelink entities for checkout, merchant-of-record, payment, fraud, tax, regulatory and buyer-support functions; OpenAI Sites and its infrastructure providers for hosting, private object storage and the order database; and Resend for transactional delivery email. Providers may process technical logs for security and reliability.
Stripe/Onelink is an independent controller for payment, tax, fraud-prevention, regulatory and buyer-support purposes. See Stripe’s Privacy Policy. Information may be processed outside the UK. Where required, we rely on applicable adequacy regulations or approved contractual safeguards. We may also disclose information where legally required and do not sell personal data.
06 · Retention and security
How long information is kept
- Paid-order, payer, payment-reference and accounting records: for the period reasonably required by UK tax, consumer and legal duties, normally at least five years after the relevant 31 January tax-return deadline.
- Unpaid, failed or abandoned local orders: normally removed after one month.
- Gift-recipient and access-delivery emails: normally anonymised during routine maintenance once 12 months have passed after access expiry, unless a live support, fraud, refund or legal matter requires longer retention.
- Routine logs and support correspondence: kept for the shortest practical period needed for security, reliability and resolving the matter.
We use restricted server secrets, signed personal download tokens, expiry and download controls, encrypted connections and limited provider access. No online system is risk-free; legally reportable breaches will be handled under applicable notification duties.
07 · Your rights
Access and choices
Depending on the circumstances, UK data-protection law may give you rights to be informed, access data, correct it, erase it, restrict or object to processing, and receive portable data. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
Send requests to bombookstory@gmail.com. We may ask for proportionate information to verify the request. You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
08 · Cookies and local storage
Current website technologies
The storefront does not currently use advertising trackers or optional analytics. When an order is created, Bombookstory sets a secure, HttpOnly, SameSite cookie whose name begins bomba_order_ for up to 30 days. It contains a random return credential used only to match the returning browser to the correct order status; it contains no card data. Stripe/Onelink manages hosted-checkout technologies under its own privacy notices and consent controls.
If optional analytics or advertising technologies are introduced, this policy and the consent controls will be updated before they are enabled where consent is required.
09 · Changes
Policy updates
We may update this notice when providers, legal requirements or the service change. The current version and date remain available at this URL. Material changes affecting existing customers will be communicated where required.