This GDPR Privacy Notice explains how WizRead (“Company,” “we,” “us,” and “our”) processes personal data of individuals located in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland (collectively, the “European Region”) when using our website at https://wizread.io and the WizRead Desktop application (collectively, our “Services”).

This notice supplements our Privacy Policy and our Cookie Policy.

1. Who is the data controller?

For the purposes of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP), the data controller responsible for your personal data is:

WizRead
Italy
Email: support@wizread.io

2. What personal data do we process?

We process the following categories of personal data in connection with our Services:

• Local Reading Content (Stored Locally): Your book files (e.g., EPUB, PDF), personal annotations, bookmarks, and private reading notes are stored locally on your device in a local database and are not uploaded to or stored on our servers.
• Account and Authentication Data: Display name, username, email address, password hash, and OAuth profile tokens (when signing in via Google or Apple).
• Reading Statistics, Streaks & Profile Visibility: Reading streaks, reading goals, progress milestones, follow relationships, and notifications synced to your account. When you create a community account, your display profile and reading statistics are public by default to enable social reading features and follower connections. You can change your profile to Private at any time in Profile Settings to restrict your detailed stats and streaks to approved followers or yourself.
• Device, Diagnostics & App Telemetry: IP address, coarse network location (country and broad region derived from IP; no precise GPS coordinates), operating system version, application version, error logs, and anonymous aggregate library metrics (e.g., total count of books in library, EPUB/PDF ratio, total count of highlights/notes created—never the actual files, book titles, or note texts).
• Communication & Support Data: Information submitted via our contact or feedback forms, including name, email address, and message contents.
• Voluntary Donation Records: Records of voluntary project support (transaction ID, contribution amount) handled via Buy Me a Coffee / Stripe. We do not process or store payment card details.

We do not process special categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, or health data).

Children's Privacy (GDPR Art. 8 & Italian Privacy Code): While WizRead Desktop is a general-audience reading tool rated 4+ for offline reading of local books without personal data collection, we do not knowingly collect personal data from or offer online accounts to children under the statutory digital consent age (14 years old in Italy pursuant to Art. 2-quinquies of D.Lgs. 196/2003, or 13–16 in other EU member states) without verified parental or legal guardian authorization.

3. Legal bases for processing under the GDPR

We only process your personal data when we have a lawful legal basis under GDPR Article 6:

• Performance of a Contract (Art. 6(1)(b)): To provide our Services, create and manage your user account, authenticate sessions, and synchronize reading stats across your devices.
• Legitimate Interests (Art. 6(1)(f)): To maintain software stability, secure our systems against unauthorized access and abuse, fix software defects, and measure website usability in aggregate form.
• Consent (Art. 6(1)(a)): Where you have granted explicit consent, such as for optional analytics cookies or voluntary feedback. You may withdraw your consent at any time.
• Legal Obligations (Art. 6(1)(c)): Where required to comply with applicable statutory, tax, or legal requirements.

4. Data Processors and Hosting Locations

We process and store personal data using reputable cloud infrastructure providers with primary data residency in the European Union:

• Primary Backend Infrastructure & APIs: Google Cloud Platform (Cloud Run), hosted in the Milan, Italy region (europe-west8), European Union.
• Database & Feedback Storage: Google Cloud / Firebase Firestore, hosted in European Union data centers.
• Static Website Delivery: GitHub Pages & Cloudflare global Content Delivery Network (CDN) for fast, secure delivery of web assets.
• Website Analytics: Microsoft Clarity (Microsoft Ireland Operations Limited / Microsoft Corporation) for aggregated usability and heatmap analytics.
• Voluntary Donations & Payment Processing: Buy Me a Coffee / Stripe Payments Europe Ltd. for handling voluntary project donations.

We never sell or rent your personal data to any third party.

5. International Data Transfers

Our core backend servers and databases are located within the European Union (Milan, Italy). When personal data is processed by or transferred to service providers located outside the European Economic Area (EEA), UK, or Switzerland (such as third-party analytics or global payment infrastructure in the United States), we ensure that appropriate safeguards are in place in compliance with Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs): We enter into European Commission-approved Standard Contractual Clauses (Article 46 GDPR) with non-EU service providers.
• Adequacy Decisions & Data Privacy Framework: Relying on adequacy decisions and participating certifications (e.g., the EU-U.S. Data Privacy Framework) where applicable.
• Technical Safeguards: Enforcing end-to-end HTTPS/TLS encryption in transit, strict access control, and tokenized authentication.

6. Data Retention & Deletion Timelines

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account Data & Erasure: Retained until you delete your account. When you delete your account in-app, your data is erased from our production database immediately in real time. If you submit a manual erasure request under Art. 17 GDPR by email, we process it within 30 calendar days.
• Disaster Recovery Backups: Routine encrypted database snapshots rotate on an automated lifecycle. Backup records are isolated and never restored to active production.
• Support & Contact Messages: Retained for up to 24 months to resolve requests and assist user inquiries, then securely deleted.
• Server & Security Logs: Retained for security analysis and abuse prevention for 30–90 days, then purged automatically.

7. Your Rights Under the GDPR

As a data subject in the European Region, you have the following rights:

• Right of Access (Art. 15): Obtain confirmation as to whether your data is processed and receive a copy of your personal data.
• Right to Rectification (Art. 16): Have inaccurate or incomplete personal data corrected.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data.
• Right to Restriction of Processing (Art. 18): Request temporary restriction of processing under certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing was based on consent.
• Right to Lodge a Complaint (Art. 77): Lodge a complaint with your local Data Protection Authority (such as the Garante per la protezione dei dati personali in Italy, or your national supervisory authority).

8. How to Exercise Your Rights

To exercise any of your GDPR rights, please email us at support@wizread.io or submit a request via our Contact Form. We will respond within one month of receiving your request.

9. Contact Us

If you have questions about this GDPR Privacy Notice or our data handling practices, please contact us at:

WizRead
Italy
Email: support@wizread.io