Privacy policy

Privacy Policy

Last updated: August 5, 2026

This Privacy Policy explains how Reflexio E-Books OÜ ("Reflexio", "we", "us", or "our") collects and uses personal data when you visit reflexio-ebooks.com, create an account, purchase or use a subscription, join our newsletter, use the Reading Passport or personalised-theme features, or contact us (together, the "Services").

1. Data controller

Reflexio E-Books OÜ, registry code 17420048, is the controller of the personal data described in this Policy unless another controller is identified at the point of collection.

Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia
Email: [email protected]
Contact form: /pages/contact

2. Personal data we collect and why

Website, account and technical data

When you browse or sign in, Shopify and enabled storefront services may process your IP address, device and browser information, cookie identifiers, network information, approximate location derived from IP, pages and products viewed, cart activity, login information and security events.

We use this data to operate and secure the Site, maintain sessions and accounts, apply country-specific availability and pricing, prevent fraud, diagnose faults and understand use of the Services.

EEA/UK legal bases: performance of a contract or steps requested before entering a contract; our legitimate interests in operating, securing and improving the Services; and consent where required for non-essential cookies or similar technologies.

Account, order, payment and subscription data

When you create an account or subscribe, we may process your name, email address, billing address, telephone number if provided, customer and order identifiers, product and subscription details, payment status, transaction history, tax location, subscription status and customer-access tags. Payment providers collect and process payment-card or other payment credentials; Reflexio does not receive your complete card number.

We use this data to create and manage your account, process recurring payments, calculate tax, deliver digital content, provide library access, send transactional notices, handle cancellations and refunds, and keep legally required accounting records.

EEA/UK legal bases: performance of our contract with you and compliance with tax, accounting and consumer-protection obligations. Security and fraud-prevention processing is also based on our legitimate interests.

Digital library and content access

To provide EPUB downloads, the web reader and your digital library, we and our digital-delivery provider may process your account and order identifiers, email address, purchased or entitled content, access status, download or viewing events, and technical information needed to deliver and protect the files.

EEA/UK legal basis: performance of our contract with you.

Reading Passport

If you use the Reading Passport, we process your account email, the book title, optional author, your reflection, submission date and a display colour. The submission is sent through Klaviyo so that we can review it and manually add the resulting stamp to a Shopify customer metafield. Your saved Passport may be displayed to you when you are signed in. A deterministic hash of your email or name may be calculated in your browser to select a Passport cover colour; the hash is used for display and is not sent as a separate profile identifier by this feature.

Please do not include health information, religious or political beliefs, sexual-orientation information, or other sensitive personal data in a Passport reflection. The Reading Passport is not a private diary or medical service.

EEA/UK legal basis: performance of the feature you request as part of your subscription.

Personalised theme requests

When a subscriber requests personalised reflections, we process the subscriber's email address, selected theme, theme identifier and request month. We send this information to Klaviyo to fulfil the request and associate the requested theme with the subscriber's profile. The browser also stores a limited record of the current month's request so that the one-request-per-month limit can be applied.

A theme choice is used only to provide the requested editorial content. It is not an emotion-recognition tool, medical assessment or automated decision about you.

EEA/UK legal basis: performance of the feature you request as part of your subscription.

Newsletter

If you subscribe to our free newsletter, Shopify or Klaviyo receives your email address and, where the form offers it, your optional first name. Shopify may record the sign-up as a newsletter-tagged customer contact. Klaviyo manages the subscription, confirmation process, delivery and unsubscribe status and may record delivery, bounce, open or click information generated by the emails.

EEA/UK legal basis: your consent. You can withdraw consent at any time through the unsubscribe link in an email. Withdrawal does not affect processing that occurred before withdrawal. Transactional account or order emails are not marketing messages.

Contact, support, cancellation and rights requests

When you contact us or submit a cancellation request, we may process your name, email address, optional telephone number, message, country, order or subscription identifier, and any information you choose to provide. We use it to answer you, process the request, locate the relevant account, keep evidence of the request and protect legal rights.

EEA/UK legal bases: performance of a contract or steps requested by you; compliance with legal obligations; and our legitimate interests in customer support, recordkeeping and legal claims.

3. Sources of personal data

We receive personal data:

  • directly from you when you use a form, create an account, subscribe, purchase or communicate with us;
  • automatically from your browser or device when you use the Site;
  • from Shopify, payment providers and subscription or digital-delivery services involved in your transaction; and
  • from service providers that report delivery, account, security or support events to us.

4. Service providers and other recipients

We disclose personal data only as needed for the purposes above, including to:

  • Shopify, which hosts the store, customer accounts, checkout, orders, contact forms and customer metafields;
  • Klaviyo, which provides newsletter, customer-profile and event-based email services and receives Passport and personalised-theme requests as described above;
  • Appstle, which supports recurring-subscription selection and administration;
  • Sky Pilot or the enabled digital-delivery provider, which provides the digital library, downloads and web-reader access;
  • payment providers displayed at checkout, which process payment credentials and payment status;
  • professional advisers, auditors and public authorities where disclosure is required by law or necessary to establish, exercise or defend legal claims; and
  • a buyer, investor or successor if our business or assets are reorganised, subject to appropriate confidentiality and legal safeguards.

These providers may process personal data as our processors or, for some payment, fraud, tax or legal functions, as independent controllers under their own privacy notices.

We do not sell personal data for money. We do not use Passport reflections or personalised-theme choices for third-party behavioural advertising.

5. Cookies and browser storage

Shopify and enabled services use cookies and similar technologies that are strictly necessary for account login, security, cart, checkout, country selection and other requested functions. Where required by law, analytics, advertising or other non-essential technologies may be used only after the relevant consent. If a cookie-preference control is displayed on the Site, you can use it to manage the choices it offers. You can also manage browser storage through your browser, although blocking necessary storage may prevent parts of the Services from working.

The personalised-theme feature uses local storage to remember a request for the current calendar month. This prevents duplicate requests. Expired Reflexio request markers are cleared when the feature next runs. Removing browser storage may reset the on-device indicator but does not remove a request already sent for fulfilment.

Our progressive-web-app and mobile-experience features use local storage, session storage and a session marker to remember whether you dismissed an installation or handoff prompt, count a limited number of page views before showing a prompt, and avoid repeating the launch splash during the same session. These values remain on your device and are not used by these features for advertising.

For information about cookies used by Shopify, see Shopify's Cookie Policy.

6. Retention

We keep personal data only for as long as needed for the purposes described above:

  • account and subscription data is kept while the account or subscription is active and afterwards as needed for support, disputes and legal obligations;
  • orders, invoices, transaction records and related contracts are generally retained for seven years after the end of the relevant financial year, as required by Estonian accounting law;
  • Passport entries are kept while the Passport or account remains active, until you ask us to delete them or make another valid erasure request, unless a limited record is required for a legal reason;
  • personalised-theme request data is kept for fulfilment, support and administration of request limits, then deleted or anonymised when no longer needed;
  • newsletter profile data is used until you unsubscribe or withdraw consent; a minimal suppression record may then be kept to ensure that we continue to respect your opt-out;
  • contact, cancellation and complaint records are kept for the time reasonably needed to resolve the request and establish or defend legal claims; and
  • security logs are kept for a limited period appropriate to investigation and protection of the Services.

A longer period may apply where law requires it, a dispute is ongoing, or preservation is reasonably necessary for legal claims. We delete or anonymise data when the applicable period ends.

7. International transfers

Shopify, Klaviyo and other providers may process personal data outside Estonia, the EEA or the UK. Where a transfer requires safeguards, we rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful transfer mechanism. You may contact us for information about the safeguards relevant to your data.

8. Your rights

Subject to applicable law, you may have the right to:

  • access personal data we hold about you and obtain a copy;
  • correct inaccurate or incomplete personal data;
  • request deletion of personal data;
  • restrict or object to processing, including an absolute right to object to direct marketing;
  • receive certain data in a portable format;
  • withdraw consent at any time where processing is based on consent; and
  • complain to a competent data-protection authority.

To exercise a right, email [email protected] or use our contact form. We may request information needed to verify your identity. You will not be discriminated against for exercising a privacy right.

9. Complaints

Please contact us first so we can try to resolve your concern. In Estonia, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). If you live elsewhere, you may also contact the supervisory authority responsible for your location.

10. Children

The Services are not directed to children who cannot lawfully enter into the subscription contract in their jurisdiction. We do not knowingly collect personal data from such children. A parent or guardian who believes a child submitted personal data may contact us to request deletion.

11. Security

We use reasonable technical and organisational measures intended to protect personal data. No internet transmission or storage system is completely secure. Please do not send passwords, complete payment-card details or unnecessary sensitive information through free-text forms.

12. Third-party links

The Site links to services such as Instagram, LinkedIn, Substack and external research sources. Those services process data under their own privacy notices when you choose to visit them. We are not responsible for the privacy practices of independent third-party websites.

13. Changes to this Policy

We may update this Policy to reflect changes to the Services, providers or law. We will post the revised version, change the "Last updated" date and provide any additional notice required by law.