Privacy Policy

Welcome to bookstair.com, the official website of Ocxly Publishing House, the literary arm of the Ocxly Group. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, purchase our publications, subscribe to our communications, or otherwise interact with our services.

By accessing or using bookstair.com and any associated services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please discontinue use of our website and services immediately.

Throughout this policy, "we," "us," and "our" refer to Ocxly Publishing House, its imprints (including Ocxly AI Labs™ and Ocxly Neuro Labs™), and the Ocxly Group. "You" and "your" refer to you, the user of our website and services.

Section 1

Information We Collect

We collect information to provide, maintain, and improve our services, to communicate with you, and to comply with applicable laws. The types of information we may collect include:

1.1 Personal Information You Provide

We may collect personal information that you voluntarily provide to us, including but not limited to:

• Identity Information: Your name, username, or similar identifier.
• Contact Information: Your email address, postal address, telephone number, and any other contact details you provide.
• Account Credentials: Username, password, and security questions if you create an account.
• Transaction Information: Billing address, payment card details (processed securely by our third-party payment processors — we do not store full card numbers), purchase history, and order details.
• Communication Data: The content of messages, emails, or correspondence you send to us, including feedback, reviews, and customer support inquiries.
• Newsletter & Marketing Preferences: Your email address and communication preferences when subscribing to our newsletter or other marketing communications.
• Survey & Contest Data: Information you provide when participating in surveys, promotions, or contests.

1.2 Information Collected Automatically

When you visit bookstair.com, we automatically collect certain information about your device and your interaction with our website, including:

• Device Information: Hardware model, operating system and version, unique device identifiers, browser type and version, screen resolution, and language preferences.
• Log Data: Internet Protocol (IP) address, access times and dates, pages viewed, links clicked, referring URL, and the page you visited before navigating to our site.
• Usage Data: Pages visited, time spent on each page, navigation paths, scroll depth, click patterns, search queries entered on our site, and other interaction data.
• Location Data: Approximate geographic location derived from your IP address (city/region level — we do not collect precise GPS data).

1.3 Cookies and Similar Technologies

We use cookies, web beacons, pixel tags, and similar tracking technologies to collect information about your browsing activities. For comprehensive details on the cookies we use and how to manage your preferences, please refer to Section 3 of this policy and our separate Cookie Policy.

1.4 Information from Third Parties

We may receive information about you from third-party sources, including:

• Analytics providers (e.g., Google Analytics, Cloudflare Web Analytics).
• Advertising networks that help us serve relevant advertisements.
• Payment processors that confirm transaction completion.
• Social media platforms if you interact with our content or link your account.
• Retail partners (e.g., Amazon) who provide aggregated sales data.

Section 2

How We Use Your Information

We use the information we collect for the following purposes, based on applicable legal grounds (consent, contractual necessity, legitimate interest, or legal obligation):

• Service Delivery: To process and fulfill your orders, deliver purchased books and digital content, manage your account, and provide customer support.
• Communication: To respond to your inquiries, send transactional emails (e.g., order confirmations, shipping notifications), and provide updates regarding our publications and services.
• Marketing & Promotions: To send you newsletters, promotional offers, new release announcements, and other marketing communications — only where you have provided explicit consent or where we have a legitimate interest to do so. You may opt out of marketing communications at any time.
• Website Improvement: To analyse usage patterns, diagnose technical issues, personalise your experience, improve website functionality, and develop new features.
• Analytics & Research: To conduct internal analytics, market research, and trend analysis to better understand our readership and optimise our publishing strategy.
• Security & Fraud Prevention: To detect, prevent, and address fraud, unauthorized access, and other illegal or harmful activities.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.
• Advertising: To deliver targeted advertisements and measure advertising effectiveness on our site and through third-party advertising networks.

Section 3

Cookies and Tracking Technologies

bookstair.com uses cookies and similar tracking technologies to enhance your browsing experience, analyse site traffic, and personalise content. A cookie is a small data file stored on your device that helps us recognise your browser and capture certain information.

3.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the website to function properly. These cookies enable core functionality such as security, session management, and cookie consent preferences. They cannot be disabled.
• Performance & Analytics Cookies: Allow us to count visits and traffic sources so we can measure and improve the performance of our site (e.g., Cloudflare Web Analytics, Google Analytics). All information these cookies collect is aggregated and therefore anonymous.
• Functional Cookies: Enable the website to provide enhanced functionality and personalisation, such as remembering your reading preferences, font size settings, and dark mode selection.
• Targeting & Advertising Cookies: May be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.

3.2 Managing Your Cookie Preferences

When you first visit bookstair.com, a cookie consent banner will appear allowing you to accept or decline non-essential cookies. You may also manage your cookie preferences through your browser settings:

• Chrome: Settings ? Privacy and Security ? Cookies and other site data
• Firefox: Settings ? Privacy & Security ? Cookies and Site Data
• Safari: Preferences ? Privacy ? Manage Website Data
• Edge: Settings ? Cookies and site permissions

Please note that disabling certain cookies may affect the functionality of bookstair.com and limit your ability to use some features.

3.3 Web Beacons & Pixel Tags

We may use web beacons (also known as pixel tags or clear GIFs) in our emails and on our website to track engagement, measure the effectiveness of our communications, and compile statistical data about website usage. These technologies work in conjunction with cookies and do not collect personal information on their own.

3.4 Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature that signals to websites that you visit that you do not want to have your online activity tracked. There is currently no universally accepted standard for how companies should respond to DNT signals. At this time, bookstair.com does not respond to DNT browser signals or mechanisms. However, you may opt out of tracking as described in this Section 3 and in our Cookie Policy.

Section 4

Third-Party Services

We engage certain trusted third-party service providers to assist us in operating our website, conducting our business, and serving our readers. These providers have access to your personal information only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose.

4.1 Analytics Providers

• Cloudflare Web Analytics: Privacy-focused analytics that does not use client-side state (cookies) to collect data. Collects aggregated usage metrics.
• Google Analytics: May be used to analyse website traffic and user behaviour. Google Analytics uses cookies to collect anonymous data. You may opt out by installing the Google Analytics Opt-Out Browser Add-on.

4.2 Advertising Networks

We may partner with third-party advertising networks (e.g., Google AdSense, Media.net) to display advertisements on bookstair.com. These networks may use cookies and similar technologies to collect information about your visits to our site and other websites in order to provide you with relevant advertising based on your browsing activities and interests. You may opt out of personalised advertising by visiting:

• Digital Advertising Alliance (DAA) Opt-Out
• Network Advertising Initiative (NAI) Opt-Out
• Your Online Choices (EU/EEA)

4.3 Payment Processors

When you make a purchase on bookstair.com, your payment information is processed directly by our third-party payment processors (e.g., Stripe, PayPal). We do not store, access, or process full credit/debit card numbers on our servers. These processors are PCI-DSS compliant and handle your payment data securely. Please review their respective privacy policies for details on how they handle your information.

4.4 Content Delivery & Hosting

• Cloudflare: Provides CDN, DDoS protection, and performance optimization. May process IP addresses and HTTP request headers.
• Google Fonts: Serves web fonts used on our site. Google may log your IP address when fonts are requested. See Google's Privacy Policy.

4.5 Retail Partners

When you click "Buy Now" links for our books, you are directed to third-party retailers such as Amazon. Once you leave bookstair.com, your interaction is governed by the privacy policy of that respective third-party platform. We encourage you to review those policies independently.

Section 5

Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share your information in the following limited circumstances:

• Service Providers: With trusted third-party vendors who perform services on our behalf (as described in Section 4), subject to contractual obligations of confidentiality and data protection.
• Within the Ocxly Group: With affiliates, subsidiaries, and imprints of the Ocxly Group (including Ocxly AI Labs™ and Ocxly Neuro Labs™) for internal business purposes, marketing coordination, and service improvement.
• Legal Requirements: When we believe in good faith that disclosure is necessary to comply with a law, regulation, legal process, or governmental request; to protect the safety, rights, or property of Ocxly Publishing House, our users, or the public; or to detect, prevent, or address fraud, security, or technical issues.
• Business Transfers: In connection with a merger, acquisition, reorganisation, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information.
• With Your Consent: We may share your information for any purpose with your explicit, informed consent.
• Aggregated or De-Identified Data: We may share aggregated, anonymised, or de-identified data that cannot reasonably be used to identify you, for analytics, industry benchmarking, or research purposes.

Section 6

Data Retention

We retain your personal information only for as long as is necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting obligations.

• Account Information: Retained for the duration of your active account, plus a reasonable period thereafter (typically 24 months) to allow for reactivation or dispute resolution.
• Transaction Records: Retained for a minimum of seven (7) years to comply with tax, accounting, and legal requirements.
• Marketing Consent Records: Retained for as long as you remain subscribed, plus a reasonable period (typically 36 months) after unsubscription as evidence of prior consent.
• Website Analytics Data: Typically retained in aggregated, anonymised form for up to 26 months.
• Correspondence & Support Tickets: Retained for up to 36 months from the date of last communication.
• Cookie Data: Retention periods vary by cookie type — see our Cookie Policy for specific details.

When your personal information is no longer required, we will securely delete or anonymise it. In some cases, we may anonymise your data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Section 7

Data Security

We implement appropriate technical and organisational measures designed to protect the security, confidentiality, and integrity of your personal information. These measures include, but are not limited to:

• Encryption: All data transmitted between your browser and bookstair.com is encrypted using TLS/SSL (HTTPS). Sensitive data at rest is encrypted using industry-standard encryption algorithms.
• Access Controls: Access to personal information is restricted to authorised personnel on a need-to-know basis. Multi-factor authentication is required for administrative access.
• Infrastructure Security: Our website is protected by Cloudflare's security infrastructure, including DDoS mitigation, Web Application Firewall (WAF), and bot management.
• Regular Monitoring: We conduct periodic security assessments and monitoring of our systems for vulnerabilities.
• Vendor Security: We require our third-party service providers to maintain appropriate security measures to protect data they process on our behalf.

Important: While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security and shall not be liable for any unauthorised access, alteration, disclosure, or destruction of data resulting from circumstances beyond our reasonable control.

If you become aware of any security breach or suspect that your personal information has been compromised, please contact us immediately at the address provided in Section 12.

Section 8

Your Privacy Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information. We are committed to facilitating the exercise of these rights in accordance with applicable laws.

8.1 Rights Under the EU/UK General Data Protection Regulation (GDPR)

If you are a resident of the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights:

• Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): You have the right to request correction of any inaccurate or incomplete personal data.
• Right to Erasure (Article 17): You have the right to request deletion of your personal data in certain circumstances ("right to be forgotten").
• Right to Restriction of Processing (Article 18): You have the right to request that we limit the processing of your personal data under certain conditions.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transfer it to another controller.
• Right to Object (Article 21): You have the right to object to the processing of your personal data for direct marketing or where processing is based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

8.2 Rights Under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA (as amended by the CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your information.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information as defined under the CCPA. If this changes in the future, we will provide a "Do Not Sell or Share My Personal Information" link on our website.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights under the CCPA.
• Right to Limit Use of Sensitive Personal Information: You may limit the use or disclosure of sensitive personal information to what is necessary to perform the services you request.

8.3 Exercising Your Rights

To exercise any of the above rights, please submit a verifiable request using the contact details provided in Section 12. We will respond to your request within the timeframes required by applicable law (typically 30 days for GDPR and 45 days for CCPA, with extensions permitted in certain circumstances).

To protect your privacy, we may need to verify your identity before processing your request. This may involve confirming personal information we already have on file or requesting additional documentation. We will not fulfill a request if we cannot verify your identity.

You may also designate an authorised agent to make a request on your behalf, in which case the agent must provide proof of written authorisation and we may still require you to verify your identity directly.

Section 9

Children's Privacy

bookstair.com is not directed at, and is not intended for use by, children under the age of thirteen (13) years. We do not knowingly collect personal information from children under 13 in compliance with the U.S. Children's Online Privacy Protection Act (COPPA). In the EEA and UK, we do not knowingly collect personal information from children under sixteen (16) years of age without verifiable parental consent, in compliance with the GDPR.

Some of our publications address mental health and neurodivergence topics that may be relevant to parents, caregivers, and educators. However, the bookstair.com website, its interactive features (including account creation, newsletter subscriptions, and purchase functions), are designed for and directed to adult audiences.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at the address provided in Section 12. If we become aware that we have collected personal information from a child without proper consent, we will take prompt steps to delete that information from our servers.

Section 10

International Data Transfers

bookstair.com is operated and managed from multiple locations. If you access our website from outside the jurisdiction where our servers are located, your information may be transferred to, stored, and processed in a country that may have different data protection laws than your country of residence.

When we transfer personal information across international borders, we take appropriate safeguards to ensure your data receives an adequate level of protection, including:

• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses for data transfers from the EEA/UK to countries that have not received an adequacy decision.
• Adequacy Decisions: Where applicable, we transfer data to countries that have received formal adequacy decisions from the European Commission or the UK Secretary of State.
• Binding Corporate Rules: Where applicable, we ensure that third-party processors have approved Binding Corporate Rules in place.
• Supplementary Measures: We implement additional technical and organisational measures (such as encryption and pseudonymisation) where necessary to ensure the effective protection of transferred data.

By using bookstair.com, you consent to the transfer of your information as described in this section. If you have questions about cross-border data transfers, please contact us at the address provided in Section 12.

Section 11

Changes to This Policy

We reserve the right to update, revise, or modify this Privacy Policy at any time at our sole discretion. When we make changes, we will:

• Update the "Last Updated" date at the top of this page.
• Post the revised policy on this page at bookstair.com/privacy-policy.
• For material changes that significantly affect how we process your personal information, we will provide additional notice via email (if you have provided one) or through a prominent announcement on our website prior to the change becoming effective.

We encourage you to review this Privacy Policy periodically to stay informed about our data practices. Your continued use of bookstair.com after the posting of changes constitutes your acceptance of those changes. If you do not agree to any revised policy, you must discontinue your use of our website and services.

Previous versions of this Privacy Policy are available upon request by contacting us at the address provided in Section 12.

Section 12

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, or our data protection practices, please contact us using one of the following methods:

We aim to respond to all privacy-related enquiries within thirty (30) days of receipt. If your request is complex or we have received a large number of requests, we may extend the response period by an additional sixty (60) days, in which case we will notify you of the extension and the reasons for it.