Privacy Policy
1. Data Controller
BeyondBSR ("we", "us", "our") is the data controller responsible for processing your personal data. For any inquiries, please contact us at: [email protected]
2. Data We Collect
We collect the following categories of personal data:
2.1 Account Data
When you create an account, we collect:
- Email address
- Password (stored in hashed form using industry-standard algorithms)
- Display name (optional)
2.2 Usage Data
When you use our services, we automatically collect:
- Search queries and filters applied
- Saved searches and portfolios
- Login timestamps and session information
2.3 Search Activity Logs
When you perform searches on our platform, we log detailed search activity data including:
- Your user ID (linked to your account)
- Timestamp of each search
- Marketplace searched (e.g., Amazon domain)
- Structured search criteria (filters, categories, keyword parameters stored in JSONB format)
- Number of results returned
- Search execution duration (in milliseconds)
This data is collected for the purposes of: service improvement, performance monitoring, usage analytics, and enforcing subscription-based search limits.
Detailed search logs are automatically compressed after 30 days and permanently deleted after 12 months. We also maintain daily aggregated statistics (total searches, average results, average duration per user per marketplace) which are retained for 12 months and then automatically deleted.
2.4 Book Analysis Data
We store the results of your book searches and profitability analyses based on your user inputs.
2.5 Consent and Compliance Data
To maintain records of your consent to our Terms of Service and Privacy Policy, we collect:
- IP address at the time of registration and consent acceptance
- Timestamp of consent acceptance
- Version of the Terms of Service and Privacy Policy accepted
This data is collected to demonstrate your consent as required by applicable data protection laws and to protect both you and BeyondBSR in the event of disputes regarding consent.
3. Data Sharing
We do not share your personal data with third parties. Your account information, search history, and usage data remain exclusively within our systems and are not transmitted to external services or partners.
4. Cookie Policy
We use only essential cookies required for the operation of our service. These cookies are strictly necessary for the website to function and cannot be disabled.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| BeyondBSR.Identity | Authentication session (HTTP-only) | 14 days (sliding) | Essential |
| BeyondBSR.Culture | Language preference | 1 year | Essential |
| BeyondBSR.Antiforgery | CSRF protection | Session | Essential |
We do NOT use:
- Marketing or advertising cookies
- Analytics cookies (e.g., Google Analytics)
- Third-party tracking cookies
5. How We Use Your Data
We process your personal data for the following purposes:
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Provide and maintain our service | Contract performance (6(1)(b)) |
| User authentication and security | Contract performance (6(1)(b)) |
| Save your searches and portfolios | Contract performance (6(1)(b)) |
| Record and analyze search activity | Legitimate interest (6(1)(f)) |
| Enforce subscription usage limits based on search activity | Contract performance (6(1)(b)) |
| Service improvement and debugging | Legitimate interest (6(1)(f)) |
| Security monitoring | Legitimate interest (6(1)(f)) |
| Record consent to Terms of Service and Privacy Policy | Legal obligation (6(1)(c)) and Legitimate interest (6(1)(f)) |
6. Data Retention
We retain your personal data according to the following schedule:
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after deletion |
| Search activity logs (detailed) | 12 months (compressed after 30 days, then auto-deleted) |
| Search activity daily aggregates | 12 months (auto-deleted) |
| Saved portfolios | Duration of account |
| Server logs | 90 days |
| Consent records (including IP address) | Duration of account + 6 years after deletion |
7. Your Rights (GDPR)
Under the General Data Protection Regulation, you have the following rights:
- Right of Access (Art. 15) - Request a copy of your personal data
- Right to Rectification (Art. 16) - Correct inaccurate data
- Right to Erasure (Art. 17) - Request deletion of your data ("right to be forgotten")
- Right to Restriction (Art. 18) - Limit how we process your data
- Right to Portability (Art. 20) - Receive your data in a machine-readable format
- Right to Object (Art. 21) - Object to certain types of processing
- Right to Withdraw Consent (Art. 7) - Where consent is the legal basis
To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with your local supervisory authority.
8. Data Security
We implement appropriate technical and organizational measures to protect your data:
- HTTPS encryption for all data in transit
- HTTP-only cookies to prevent XSS attacks
- Passwords hashed using industry-standard algorithms
- CSRF protection on all forms
- Regular security updates and monitoring
- Access controls and audit logging
9. International Data Transfers
Your data is primarily processed within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
10. Children's Privacy
Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] and we will delete such information.
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.
12. Contact Us
If you have any questions about this privacy policy or our data practices, please contact us at:
- Email: [email protected]