Data Processing Agreement

Last updated: July 6, 2026

This Data Processing Agreement ("DPA") forms part of the BookArc Terms of Service and applies whenever an author or publisher (the "Controller") uses BookArc, operated by Orpheus Technology Ltd (the "Processor"), to collect or process personal data of their readers. By using BookArc's reader-data features (signup forms, campaigns, gift deliveries, mailing-list integrations) you accept this DPA.

1. Roles

For reader personal data collected through your landing pages, campaigns, and gifts, you are the controller and BookArc is your processor, processing that data only to provide the service. For data BookArc collects for its own purposes (author accounts, platform security, billing, aggregate service analytics), BookArc is an independent controller — see our Privacy Policy.

2. Subject Matter, Duration, Nature and Purpose

BookArc processes reader data for the duration of your account, solely to deliver books and materials, run your reader campaigns, capture and confirm signups, and sync subscribers to the mailing-list services you connect.

3. Categories of Data and Data Subjects

• Data subjects: your readers — signup-form subscribers, campaign recipients, gift recipients.
• Data categories: email address, name, signup consent evidence, IP address and browser user agent (retained 30 days for fraud review), email engagement events (delivered, opened, clicked, bounced, unsubscribed), download and page-open timestamps.
• No special-category data is intended to be processed.

4. Processor Obligations

BookArc will:

• Process reader data only on your documented instructions, as expressed through your use of the service, unless required by law;
• Ensure people authorized to process the data are bound by confidentiality;
• Apply appropriate technical and organizational measures (encryption in transit, encryption of stored credentials, access controls, retention limits — see the Privacy Policy's security section);
• Assist you, taking into account the nature of processing, in responding to data-subject requests (access, erasure, portability, objection);
• Notify you without undue delay after becoming aware of a personal data breach affecting your readers' data;
• Delete your readers' personal data when you delete your account (effective immediately on deletion, and in any event within 60 days), except where law requires retention;
• Make available information reasonably necessary to demonstrate compliance with Article 28 GDPR.

5. Sub-processors

You provide general authorization for the sub-processors listed below. We will update this page before adding or replacing sub-processors; if you object, your remedy is to stop using the affected feature or delete your account.

Sub-processor	Purpose	Location
Microsoft Azure	Hosting, database, and file storage	EU (North Europe) / UK
Twilio SendGrid	Transactional and campaign email delivery, engagement webhooks	US (SCCs)
Stripe	Author subscription billing (author data only, no reader data)	US/EU (SCCs)
OpenAI	Purchase-receipt image validation (receipt images submitted by readers)	US (SCCs)

Author-directed services are not sub-processors. When you connect your own mailing-list provider (Mailchimp, Kit/ConvertKit, MailerLite, ActiveCampaign, AWeber, Constant Contact, EmailOctopus, SendFox, Sendy) or sales platform (Payhip, Gumroad, Lemon Squeezy, Shopify, Fourthwall), you appoint that provider directly under your own agreement with them; BookArc transmits data to them on your instruction.

Geolocation for store links and cookie-consent targeting uses a local MaxMind database on our own servers — no visitor data is sent to MaxMind.

6. International Transfers

Reader data is stored in the UK and EEA. Where a sub-processor processes data outside the UK/EEA, transfers rely on adequacy decisions or Standard Contractual Clauses, supplemented by technical measures.

7. Your Obligations as Controller

• Only collect reader data with a lawful basis, and honor the consent wording shown on your forms;
• Respond to your readers' data-subject requests (BookArc will assist — contact hello@bookarc.app);
• If you add Google Analytics or a Meta pixel to a page, understand that BookArc's consent banner gates them for EEA/UK/Swiss visitors and that you are responsible for your own disclosures to your audience.

8. Contact

Questions about this DPA: hello@bookarc.app.