This Privacy Policy explains how Omorphos Publishing LLC ("we", "us", "our") collects, uses, and protects your personal data when you use our website. We are committed to keeping your data safe and being transparent about what we collect and why.
Information we collect and how we use it
Language level assessment
When you complete the self-assessment quiz, your scores are saved against an anonymous visitor token stored in a browser cookie. Your results are never associated with your name or email address unless you also sign up to our mailing list.
Data collected:
- Language assessment scores — Your self-reported proficiency scores across four language domains (listening, reading, speaking, writing), stored against your visitor token.
- Visitor token — An anonymous identifier stored in a browser cookie. Used to link your assessment results to your signup without storing your identity against your results directly.
Purpose: Language assessment.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: Assessment results are stored for the lifetime of the visitor token cookie (365 days) or until you request erasure.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Email subscriptions
When you sign up to hear about new books and language learning resources, we store your email address and record your consent. If you tell us your country (optional, on a signup form or right after you confirm your email), or you buy from our store, we keep your country so we know which privacy rules apply to you. We never work it out from your IP address.
Data collected:
- Email address — Used to contact you and verify your identity.
- Name — Used to address you in correspondence.
- Visitor token — An anonymous identifier stored in a browser cookie. Used to link your assessment results to your signup without storing your identity against your results directly.
- IP address (stored as a one-way hash — cannot be reversed) — Recorded at time of submission for security and spam-prevention purposes.
- Consent record — A log of the consent you gave, including the exact wording shown to you, the date and time, and a one-way hash of your IP address.
Purpose: Email marketing.
Legal basis: Consent (GDPR Art. 6(1)(a)).
How long we keep it: Until you unsubscribe or request erasure. Your subscriber row is anonymised rather than deleted so we can maintain a consent audit trail, as required by GDPR Art. 5(2).
Your rights: Right to unsubscribe at any time, Right to erasure ("right to be forgotten"), Right to access your data, Right to export your data.
Event notifications
When you preorder a book, we keep your email address and language until we have told you it is available. If you ask to be told when a book is released, we keep them for that one message.
Data collected:
- Email address — Used to contact you and verify your identity.
- Consent record — A log of the consent you gave, including the exact wording shown to you, the date and time, and a one-way hash of your IP address.
Purpose: Telling you when a book you preordered, or asked to be told about, is available.
Legal basis: Contractual necessity (GDPR Art. 6(1)(b)).
How long we keep it: The email address is removed 30 days after the message is sent or the request is cancelled (a salted hash stays so an erasure request can still find the record). Deleted outright on an erasure request.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Free sample and release notification requests
When you request a free sample of a book, or ask to be told when an unreleased book is out, we store your email address (and the book you asked about) so we can send you what you asked for.
Data collected:
- Email address — Used to contact you and verify your identity.
- IP address (stored as a one-way hash — cannot be reversed) — Recorded at time of submission for security and spam-prevention purposes.
Purpose: Email marketing.
Legal basis: Contractual necessity (GDPR Art. 6(1)(b)).
How long we keep it: Until you request erasure. Anonymised rather than deleted, matching the subscriber row above.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Emails we sent you
When we email you (a sign-in link, a purchase confirmation, a confirmation of a request), we keep a record of it: your email address, which email it was, its subject line, the language, when it was sent and whether it was delivered to our mail server. We use it to avoid sending the same email twice and to answer questions about mail you did or did not receive.
Data collected:
- Email address — Used to contact you and verify your identity.
Purpose: Sending you the emails you asked for, and checking they were sent.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: Deleted after 180 days, or straight away on an erasure request.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Link click log
When you click a book's retailer button, a recommendation or a shared link on this site, or download a book's study materials, we count the click so we know which links are useful and can tell people from automated bots. We do not record your IP address or your name.
Data collected:
Purpose: Email marketing.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: Click records are kept for the life of the link's statistics. The daily-changing code is deleted after 30 days.
Your rights: Right to erasure ("right to be forgotten").
Replies to our social posts
When someone replies publicly to a post from our social accounts, we keep a copy of the reply (their handle, display name and the text) for 14 days so we can answer it, then delete it. Only public replies are kept; nothing from private messages or profiles.
Data collected:
- Name — Used to address you in correspondence.
- Message content — The text of your support enquiry.
Purpose: Email marketing.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: 14 days from when the reply was written, then automatically deleted. Aggregate counts (likes, replies) contain no personal data and are kept.
Sample reader links
The reader link we send you for a free sample includes your email address in its internal label, so we can tell which token belongs to which request.
Data collected:
- Email address — Used to contact you and verify your identity.
Purpose: Email marketing.
Legal basis: Contractual necessity (GDPR Art. 6(1)(b)).
How long we keep it: Until the reader link expires or is revoked, or you request erasure.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Purchases and subscriptions (reading access)
When you buy a book or a subscription we keep a record of your access: the email you bought with, the order or subscription reference from our payment provider, which book, series or plan it unlocks, and whether it has since been refunded or cancelled. We use it to unlock what you paid for and to email you a sign-in link. Your card and billing details are handled entirely by Paddle and never reach our servers.
Data collected:
- Email address — Used to contact you and verify your identity.
Purpose: Delivering and managing the books and subscriptions you buy.
Legal basis: Contractual necessity (GDPR Art. 6(1)(b)).
How long we keep it: For as long as your access lasts, and afterwards for as long as we are required to keep payment records (tax and accounting law; Paddle, as merchant of record, also holds the payment and tax record). Deleting this record would end your access to what you bought, so a standard erasure request leaves it in place; contact us if you want it removed as well, and your access will end.
Third parties:
- Paddle — Merchant of record: takes your payment, handles sales tax and keeps the payment and tax records.
Your rights: Right to access your data.
Portal login links
Requesting a "log in to your library" link stores your email address until the link is used or expires (15 minutes).
Data collected:
- Email address — Used to contact you and verify your identity.
Purpose: Email marketing.
Legal basis: Contractual necessity (GDPR Art. 6(1)(b)).
How long we keep it: Deleted once the link is used or expires, or you request erasure.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Reading terms acceptance
When you agree to the reading terms for a purchased or subscribed book, we record your email address, the date and time, and which version of the terms you saw, so you are not asked again until they change.
Data collected:
- Email address — Used to contact you and verify your identity.
Purpose: Email marketing.
Legal basis: Contractual necessity (GDPR Art. 6(1)(b)).
How long we keep it: Kept for as long as the purchase or subscription record is kept (it is the evidence of what you agreed to), and is not removed by a forget-me request, which only ends sample access. Ask us directly to remove it; your access to the books ends with it.
Your rights: Right to access your data.
Saved words and reading tools
If you save a word from a book's glossary we keep the word, the book and chapter it came from, and your email address, so your word list is there in your next book in that language. We also keep which tools and notes you have already seen in a book.
Data collected:
- Email address — Used to contact you and verify your identity.
Purpose: Email marketing.
Legal basis: Contractual necessity (GDPR Art. 6(1)(b)).
How long we keep it: Kept while your reading access or word list exists. You can remove a word yourself, and a forget-me request deletes your saved words and the record of what you have seen, including for a purchase or subscription (your access itself is kept, see "Purchases and subscriptions").
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Support enquiries
When you submit a support or contact request, we store the details of your enquiry so we can respond to you.
Data collected:
- Name — Used to address you in correspondence.
- Email address — Used to contact you and verify your identity.
- Message subject — The subject line of your support enquiry.
- Message content — The text of your support enquiry.
- Support topic — The category of your support enquiry (e.g. "General", "Educators").
- IP address (stored as a one-way hash — cannot be reversed) — Recorded at time of submission for security and spam-prevention purposes.
- Consent record — A log of the consent you gave, including the exact wording shown to you, the date and time, and a one-way hash of your IP address.
Purpose: Support contact.
Legal basis: Consent (GDPR Art. 6(1)(a)).
How long we keep it: Your name, email address, and message content are anonymised if you request erasure. The thread structure and reply history are retained for our internal audit log.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
FAQ helpfulness votes
When you click "Was this helpful?" on a FAQ answer, we store a one-way hash of your IP address (not the address itself) so the same visitor can't vote on the same question twice.
Data collected:
- IP address (stored as a one-way hash — cannot be reversed) — Recorded at time of submission for security and spam-prevention purposes.
Purpose: service improvement.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: Automatically deleted after 180 days.
Survey delivery links
When a staff member sends you a survey (for example, after a support conversation), we store your email address and a link to what the survey was about so we can send you a one-time link to it.
Data collected:
- Email address — Used to contact you and verify your identity.
Purpose: service improvement.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: Until an admin deletes the survey it was sent for (which also deletes the delivery record and any response given through it) — an admin can export responses to CSV first. There is no automatic expiry.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Survey responses
Your answers to a survey you were sent a link to, or answered while reading a sample/full book with your email attached to your reading access. Answers to a survey you found or were shown without a personal link are not linked to your email at all.
Data collected:
- Message content — The text of your support enquiry.
- Visitor token — An anonymous identifier stored in a browser cookie. Used to link your assessment results to your signup without storing your identity against your results directly.
Purpose: service improvement.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: Kept indefinitely as anonymous survey data unless you request erasure; a request for erasure anonymizes the link back to you and redacts any freeform written answer, rather than deleting the response itself, so it can still count toward this survey's overall results.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Visitor targeting tags
When you accept cookies, we record a small set of on-site signals (e.g. which language landing page you visited, whether you completed the reading-level assessment) against your anonymous visitor id, so we can show more relevant content on future visits.
Data collected:
- Visitor token — An anonymous identifier stored in a browser cookie. Used to link your assessment results to your signup without storing your identity against your results directly.
Purpose: Email marketing.
Legal basis: Consent (GDPR Art. 6(1)(a)).
How long we keep it: Each signal stops being used after its own freshness window (30–180 days depending on type); all rows are deleted after 400 days regardless.
Your rights: Right to erasure ("right to be forgotten").
Site preferences
We remember your last-viewed language and book filter choices (level, topic, etc.) so the catalog opens the way you left it on your next visit. If you complete our language level assessment, we also save the result here so book pages can highlight the level that matches you and let you know it's based on your recent assessment.
Purpose: Email marketing.
Legal basis: Consent (GDPR Art. 6(1)(a)).
How long we keep it: See each cookie's own duration below, or until you decline cookies in the cookie banner (which deletes both immediately).
Your rights: Right to object to processing.
Cookie consent choice
We remember whether you accepted or declined our cookie banner, so we don't ask again on every page.
Purpose: Email marketing.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)).
How long we keep it: 365 days.
Your rights: Right to object to processing.
Blog comments
When you leave a comment on a blog post, we store your name, email address, and comment text so your comment can be published and so we can reply to you. If you check "Remember my name and email," we also save your name, email, and a one-way hash of your email (used to look up your Gravatar photo) in this browser's local storage — not a cookie — so you don't have to re-enter them next time.
Data collected:
- Name — Used to address you in correspondence.
- Email address — Used to contact you and verify your identity.
- Message content — The text of your support enquiry.
- IP address (stored as a one-way hash — cannot be reversed) — Recorded at time of submission for security and spam-prevention purposes.
Purpose: Support contact.
Legal basis: Consent (GDPR Art. 6(1)(a)).
How long we keep it: Comments are kept indefinitely as part of the public discussion unless you request erasure. The optional "remembered" name/email/hash in your browser is kept until you clear it (the pill's × button) or clear your browser's site data.
Third parties:
- Gravatar — If a Gravatar photo exists for your email address, it's shown next to your comment. We send a one-way hash of your email to Gravatar, never your email address itself.
Your rights: Right to erasure ("right to be forgotten"), Right to access your data.
Cookies
We use the following cookies on this website:
| Cookie | Purpose | Duration |
|---|---|---|
omorphos_token | Anonymous visitor identifier — used to save and retrieve your assessment results without identifying you personally. | 365 days |
omorphos_notify_ok | Remembers, on this browser, that you confirmed an address for a release notification, so a later request for another book does not ask you to confirm again. It holds a signed, one-way hash of the address, not the address itself. | 1 year |
omorphos_notify (browser storage, not a cookie) | Remembers which books you asked to be told about, so the bell on a book shows the right state. It stays in this browser and is never sent to us. | Until you clear this site's data in your browser |
omorphos_portal_session | Keeps you signed in to the reader portal (/read/) after clicking a login link, or any reader link (a sample, purchase, or subscription link) that includes your email — either one proves you own that inbox, and both grant a signed-in session the same way. | 30 days |
omorphos_last_language | Remembers the language you were last browsing, so the catalog opens on it next time. | 365 days |
omorphos_filters | Remembers your active book filter selections (level, topic, etc.). Also stores your most recent language-assessment result, so book pages can highlight the level that matches you. | 7 days |
omorphos_dismissed_catalog_recommended | Remembers that you closed the catalog's "Recommended" panel, so it stays hidden for a couple of days instead of reappearing on your next visit. Cleared early if you retake the level assessment. | 48 hours |
omorphos_consent | Records your cookie-banner choice (accept/decline). | 365 days |
Your rights under GDPR
If you are located in the European Economic Area, you have the following rights regarding your personal data:
- Right to access — Request a copy of the data we hold about you.
- Right to rectification — Ask us to correct inaccurate data.
- Right to erasure — Ask us to delete your data. Use our data deletion form or contact us directly.
- Right to portability — Request your data in a machine-readable format.
- Right to object — Object to processing based on legitimate interest.
- Right to withdraw consent — Withdraw consent at any time where processing is based on consent.
If you have any questions about this policy, or wish to exercise any of your rights, please reach out via our contact form.