Privacy

Who is responsible

What we collect

• Account data: your email address, account status, country, and Stripe connected-account identifier.
• Publisher content: publication and edition details, prices, edition files, and cover images you upload.
• Purchase data: buyer email, edition, amount, currency, payment identifiers and status, refunds, and disputes. We do not store full card details.
• Service and security data: IP address, request and device information, timestamps, session data, and security events.
• Messages: information sent to support or through the illegal-content reporting channel.

We receive this information from you, from your use of Ox & House, and from Stripe when relevant.

Why we use it

We use personal data to provide accounts, publishing, purchases, and support; operate and secure the service; prevent abuse; meet legal obligations; and establish or defend legal claims.

Our legal bases are performance of a contract, compliance with legal obligations, and our legitimate interests in operating and protecting Ox & House (Articles 6(1)(b), 6(1)(c), and 6(1)(f) GDPR).

Who receives data

We share data only as needed with:

• DigitalOcean, for hosting, infrastructure, and private file storage;
• Stripe, for payments and publisher payment accounts;
• Zoho ZeptoMail, for sign-in, purchase, and service emails; and
• the relevant publisher, where needed to complete or support a purchase.

Publishers are separately responsible for personal data they use for their own customer relationships. Where a provider processes data outside the European Economic Area, the provider's applicable adequacy decision or contractual safeguards protect the transfer.

How long we keep it

We keep account and publisher data while the account is active, then delete or retain it only where needed for purchases, legal duties, or claims. Transaction and accounting records are kept for the applicable statutory period, generally seven years and longer where required. Security logs, sign-in records, support messages, and reports are kept only as long as reasonably needed for their purpose.

Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, or portability of your data, or object to processing based on legitimate interests. Email [email protected] to make a request.

You may also complain to the Austrian Data Protection Authority or another competent supervisory authority.

We do not make decisions with legal or similarly significant effects based solely on automated processing.

Necessary cookies

Ox & House uses only cookies and similar technologies needed for sessions, passwordless sign-in, security, and purchase access. The guest purchase-access cookie expires after 30 days. We do not use advertising or optional analytics cookies.