Privacy Policy

1. Introduction

This Privacy Policy explains how the Shepheard-Walwyn mobile application ("the App", "we", "us") collects, uses, stores, and protects your personal data when you use the App. The App is published at https://shepheard-walwyn.app/.

We are committed to protecting your privacy and to handling your personal data transparently and in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

This policy describes only the data processing that actually takes place within this App. It does not cover services we do not use.

2. Data Controller

The data controller responsible for your personal data processed through the App is:

• Legal entity name: Shepheard-Walwyn Publishers
• Registered address: 20 Mortlake High Street, London SW14 8JN
• Company registration number: 01029102

You can contact us at support@shepheard-walwyn.app.

3. What data we collect and why

To use the App, you need to create an account. Below is a detailed breakdown of each processing activity, the data involved, the purpose, and the GDPR legal basis we rely on.

3.1 Account creation and authentication

• Data collected: Email address, password, and (optionally) a display name.
• Purpose: To create and manage your account and to authenticate you when you log in.
• Legal basis: Contract (Article 6(1)(b) GDPR) — the processing is necessary to provide you with the account and service you have requested.
• Passwords: Authentication credentials are securely managed by the Base44 platform. We do not have access to users' plain-text passwords.

3.2 Profile management

• Data collected: Display name and (optionally) a profile picture.
• Purpose: To display your identity within the App (for example, on your profile and alongside your comments).
• Legal basis: Contract (Article 6(1)(b) GDPR) — managing your profile is part of providing the account you requested.
• Profile picture storage: See Section 7.

3.3 Favourites

• Data collected: The identifier, title, author, and cover image of articles or episodes you favourite, linked to your account.
• Purpose: To let you save and revisit content you enjoy.
• Legal basis: Contract (Article 6(1)(b) GDPR) — the favourites feature is part of the personal-library service you use through your account.

3.4 Reading and listening progress

• Data collected: The content identifier, content type, and your progress percentage for eBooks and episodes.
• Purpose: To remember where you left off so you can resume reading or listening.
• Legal basis: Contract (Article 6(1)(b) GDPR) — the progress feature is part of the service you use through your account.

3.5 Collections

• Data collected: The names and descriptions you give to your collections, and the content items you add to them (identifier, title, author, cover image).
• Purpose: To let you organise saved content into personal lists.
• Legal basis: Contract (Article 6(1)(b) GDPR) — the collections feature is part of the personal-library service you use through your account.

3.6 Comments

• Data collected: The comment text you write, your display name, and your account identifier.
• Purpose: To display your comments on articles as part of a public discussion.
• Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — we have a legitimate interest in operating a public discussion feature. You can edit or delete your own comments at any time from the App.

3.7 Purchases

• Data collected: The item purchased, the price paid, the date, and the transaction status, linked to your account.
• Purpose: To record your purchase and grant you access to the purchased eBook in your personal library.
• Legal basis: Contract (Article 6(1)(b) GDPR) — the processing is necessary to fulfil your purchase and provide access to the content. Anonymised transaction records are also retained for accounting purposes under legal obligation (Article 6(1)(c) GDPR) — see Section 9.

3.8 Contact form

• Data collected: Your name, email address, and the message you write.
• Purpose: To allow you to send us an enquiry and for us to respond.
• Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — we have a legitimate interest in receiving and responding to user enquiries and providing customer support. You are not required to provide this information; you do so voluntarily to contact us. The contact form does not use a consent mechanism because the legal basis is legitimate interests, not consent.

3.9 Newsletter subscription

• Data collected: Your email address, the date and time you consented, and the exact wording of the consent statement you agreed to.
• Purpose: To send you our newsletter by email and to maintain a record of your consent.
• Legal basis: Consent (Article 6(1)(a) GDPR) — you subscribe by entering your email and checking an explicit consent checkbox that is unchecked by default. You can withdraw your consent at any time (see Section 8).

3.10 Account deletion

• Data involved: All data linked to your account.
• Purpose: To carry out your request to delete your account and the associated personal data.
• Legal basis: This is not a separate processing activity; it is the execution of your right to erasure under Article 17 GDPR. See Section 10 for what is deleted and what is retained.

3.11 Fraud and security

We do not carry out automated fraud detection, profiling, or automated decision-making about you. Payment fraud screening is handled by Stripe as part of its payment processing service (see Section 5). Purchase records retained for transaction history may also serve to identify irregular activity; the legal basis for this is legitimate interests (Article 6(1)(f) GDPR), balanced against your rights.

3.12 Legal and accounting records

Anonymised purchase records (with the link to your account severed) are retained for accounting and tax purposes. The legal basis is legal obligation (Article 6(1)(c) GDPR) where applicable law requires the retention of financial records. See Section 9 for details.

3.13 Content engagement analytics

• Data collected: The type and identifier of content you open (author pages, newsletter articles, podcast episodes) and whether playback of an episode began. Each event is linked to your account identifier, which is personal data — it can identify you — even though no email address, IP address, or device identifier is stored with these events. Engagement is recorded only while you are signed in; unauthenticated sessions are not recorded.
• Purpose: To understand which content is popular and to improve our offering. These statistics are first-party (we do not use third-party analytics services) and are viewable only by the account owner.
• Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — we have a legitimate interest in measuring content engagement to improve our content. We minimise the data collected (no profiling, no identifiers beyond your account id) and restrict access to the owner account. This legal basis has been identified for the data controller's review and has not been verified as a legal conclusion.
• Retention: Content engagement events are retained for up to 12 months from the event date, then permanently and automatically deleted by a scheduled process that runs weekly. See Section 9.

4. How we store your data

Your data is stored in the following locations:

5. Third-party services

We use the following third-party services to operate the App. Each service is a separate controller or processor for the data it handles. We describe below what data is shared with each, distinguishing what our App sends from what the third party collects directly.

5.1 Base44

Base44 is the application platform that hosts the App's database, authentication, file storage, and email delivery.

• Data received by Base44: All data stored by the App (see Section 4) is processed by Base44 on our behalf as a data processor.
• Hosting: Base44's servers are located in the United States, and data is stored there by default.
• Transfer mechanism: Base44 states that its vendors are bound by data processing agreements governing transfers to the United States, using approved mechanisms such as adequacy decisions, Standard Contractual Clauses (SCCs), or the EU-US Data Privacy Framework where applicable. Further information is available in Base44's Data Processing Agreement and subprocessor directory.

5.2 Stripe

Stripe processes payments when you purchase an eBook.

Data we send to Stripe:

• The eBook title, description, cover image, and price (to create the checkout session).
• Your email address (to pre-fill the Stripe Checkout form).
• A transaction identifier linking the payment to your account and the purchased item (stored as metadata on the Stripe checkout session).

Data you enter directly into Stripe Checkout:

• Your payment card details and billing address.
• This information is collected and processed entirely by Stripe. We do not receive, see, or store your card details.

Data we receive back from Stripe:

• A confirmation that your payment was successful.
• The transaction metadata we originally sent (the item purchased and the price).
• We do not receive your card details or any additional personal data from Stripe beyond what we sent.

• Transfer mechanism: We have not verified the specific data-transfer mechanism Stripe uses. Stripe's privacy policy and data processing documentation provide information about its data practices and transfer mechanisms.

5.3 Google (sign-in — withdrawn)

Google sign-in is no longer offered. Accounts are created and accessed with an email address and password only. The following is retained as a record of the processing that applied while Google sign-in was available.

• Data received from Google: If you chose Google sign-in while it was offered, the App received your name and email address as provided by your Google account, and used them to create or identify your account. No data is sent to or received from Google when you sign in now.
• Transfer mechanism: We have not verified the specific data-transfer mechanism Google used for this sign-in flow. Google's privacy policy provides information about its data practices and transfer mechanisms.

5.4 Services we do not use

We do not use any advertising services (such as Google Ads or Meta Ads), analytics services (such as Google Analytics), tracking pixels (such as Facebook Pixel), or alternative payment providers (such as PayPal or Worldpay). We do not use any email marketing platform (such as Mailchimp); newsletter emails are sent directly by us.

6. Cookies and local storage

6.1 Cookies

The App itself does not set any cookies. Authentication is handled through a token stored in your browser's local storage (see below), not through cookies.

6.2 Local storage

The App stores an authentication token in your browser's local storage so that you stay logged in between sessions. This token is removed when you log out.

6.3 IndexedDB (offline content)

When you choose to save an article or eBook for offline reading, a copy of that content is stored on your device in an IndexedDB database. This data never leaves your device. You can remove saved content at any time using the save/offline toggle in the App, or by clearing your browser data.

7. Profile pictures

7.1 New profile pictures (current system)

Profile pictures uploaded through the current App are stored privately — they have no public URL. They are accessible only through a short-lived signed link that expires after 24 hours and can only be generated for your own profile picture.

When you delete your account, the reference to your profile picture is removed. Because no new signed link can be generated without that reference, the private file becomes permanently inaccessible. The Base44 platform does not provide a file-deletion API, so the underlying file object cannot be deleted from storage; however, it can no longer be accessed by anyone.

7.2 Legacy profile pictures (previous system)

Profile pictures uploaded before the current private-storage system was introduced were stored publicly and have a permanent public URL. Because the Base44 platform does not provide a file-deletion API, these legacy images remain accessible through their existing public URL even after your account is deleted. Only the reference to the image is removed from your account; the public file itself cannot be deleted by us.

This limitation applies only to images uploaded before the storage change. All new profile pictures are private, as described in Section 7.1.

8. Newsletter consent and withdrawal

8.1 Subscribing

You can subscribe to our newsletter by entering your email address and checking the consent checkbox on the subscription form. The checkbox is unchecked by default. We record your email, the date and time of your consent, and the exact wording of the consent statement you agreed to.

When you subscribe, a notification containing your email address, consent date, and consent wording is sent to our support address by email. This notification is retained in the support mailbox (see Section 9).

We do not add you to any external mailing platform automatically. Your subscription is recorded as proof of consent, and we send you the newsletter directly by email.

8.2 Withdrawing consent

You can withdraw your consent at any time by:

• Using the unsubscribe page at https://shepheard-walwyn-app.base44.app/unsubscribe, or
• Clicking the unsubscribe link in any newsletter email you receive from us.

When you withdraw consent:

• Your consent record is marked as withdrawn and the date of withdrawal is recorded.
• Your email address is added to a suppression (do-not-contact) list so that we do not accidentally send you newsletters in the future. This list is never used as permission to send newsletters — its sole purpose is to prevent unwanted contact.
• The unsubscribe process always returns a success confirmation, regardless of whether the email address was previously subscribed, to prevent email-address enumeration.

Withdrawing consent does not affect the lawfulness of processing based on your consent before its withdrawal.

8.3 Re-subscribing

If you later decide to re-subscribe, you can do so by completing the subscription form and checking the consent checkbox again. When you re-subscribe with fresh consent, your email is removed from the suppression list and a new consent record is created. If you were already subscribed, no duplicate consent record is created and no further notification is sent to support.

9. Data retention

We retain your personal data only for as long as necessary for the purposes described in this policy:

9.1 Why withdrawn consent records are retained for 3 years

Withdrawn consent records are retained for 3 years to demonstrate the history of your consent and withdrawal and to protect against disputes (for example, if a question arises about whether you had consented or when you withdrew). After 3 years, the records are permanently and automatically deleted by a scheduled process that runs weekly. This period is intended to be sufficient for dispute protection while not retaining your personal data longer than necessary.

9.2 Why the suppression list is retained for 3 years

The suppression list is retained for 3 years to ensure we respect your withdrawal of consent and do not accidentally send you newsletters. After 3 years, the records are permanently and automatically deleted. If you re-subscribe with fresh consent before then, your email is removed from the suppression list at that point.

9.3 Why comments are retained and anonymised

Comments form part of public discussions on articles. When you delete your account, we do not delete your comment text, because doing so would remove context from public discussions and make threads difficult to follow. Instead, we anonymise your comments: the author name is replaced with "Deleted user", the avatar is removed, and the link to your account is severed. This means the comment text remains but can no longer be associated with you. This approach is based on our legitimate interests in maintaining coherent public discussions, balanced against your privacy through anonymisation.

9.4 Purchase records and legal retention

When you delete your account, the link between your purchase records and your account is severed, making the records anonymous. The anonymised transaction data (item, price, date, status) is retained for accounting and tax purposes. Whether retention is required by law, and for how long, depends on the applicable jurisdiction (for example, the jurisdiction where the data controller is established or where the transactions are taxable). We have not verified the specific legal retention period applicable to the data controller's jurisdiction. We retain the anonymised records for as long as required by applicable accounting, tax, fraud-prevention, or other legal obligations, and no longer than necessary.

9.5 Contact form messages and notification emails

Contact-form submissions, newsletter subscription notifications, and purchase notification emails are sent by email to our support address. They are not stored in the App's database. These messages are retained in the support mailbox. We have not established a specific documented retention period for these messages. We retain such correspondence only for as long as reasonably necessary to handle the enquiry, provide customer support, maintain appropriate business records, or resolve disputes, subject to applicable legal requirements.

10. Account deletion

You can delete your account at any time from the profile page in the App. When you delete your account:

1. Your account, email address, display name, and role are permanently deleted.
2. Your favourites, reading progress, and collections are permanently deleted.
3. Your comments are anonymised — the author name is replaced with "Deleted user", the avatar is removed, and the link to your account is severed. The comment text is retained (see Section 9.3).
4. Your purchase records are anonymised — the link to your account is severed, but the transaction details are retained for accounting purposes (see Section 9.4).
5. Your profile picture reference is deleted. New (private) profile pictures become inaccessible; legacy (public) profile pictures remain on their public URL (see Section 7).

11. Your rights

Under the GDPR, you have the following rights regarding your personal data. The applicability of some rights depends on the legal basis for the processing:

• Right of access (Article 15): You can request a copy of the personal data we hold about you. This applies to all personal data we process.
• Right to rectification (Article 16): You can ask us to correct inaccurate or incomplete data. You can also update your display name and profile picture directly in the App.
• Right to erasure (Article 17): You can ask us to delete your personal data. You can do this directly by deleting your account in the App. This right does not apply where processing is necessary for compliance with a legal obligation (for example, retaining accounting records) or where anonymisation is used instead of deletion (for example, comments).
• Right to restriction (Article 18): You can ask us to restrict the processing of your data in certain circumstances, for example if you contest the accuracy of the data.
• Right to data portability (Article 20): You can request a copy of the personal data you provided to us in a structured, machine-readable format. This right applies to data processed based on consent or contract and processed by automated means — for example, your account data, favourites, progress, and collections.
• Right to object (Article 21): You can object to processing based on legitimate interests — for example, the posting of comments or the processing of contact-form enquiries. If you object, we will stop the processing unless we have compelling legitimate grounds that override your interests.
• Right to withdraw consent (Article 7(3)): For processing based on consent (the newsletter), you can withdraw your consent at any time without affecting the lawfulness of processing before its withdrawal. See Section 8.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction if you believe our processing of your personal data infringes data protection law.

To exercise any of these rights, contact us at support@shepheard-walwyn.app.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

12. Children

The App is intended for a general audience and is not specifically directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

13. Security

We rely on the following measures to protect your personal data:

• Authentication credentials are managed by the Base44 platform. We do not have access to users' plain-text passwords.
• Profile pictures uploaded through the current system are stored privately and can only be accessed through short-lived signed links.
• Payment card details are handled entirely by Stripe; we do not receive, see, or store card details.
• The authentication token stored in your browser is removed when you log out.

For further information about the security measures provided by the Base44 platform, see the Base44 Security Trust Center.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If we make material changes, we will notify you through the App or by email.

15. Contact

If you have any questions about this Privacy Policy or about your personal data, please contact us at:

• Email: support@shepheard-walwyn.app
• Data controller: Shepheard-Walwyn Publishers, 20 Mortlake High Street, London SW14 8JN (Company registration no. 01029102)