Privacy
Privacy Policy
This policy is being finalised with our legal advisor.
Lovetopus makes picture books about feelings for children aged 3–6 and the grown-ups who read with them. This website and our emails are for adults. This policy explains in plain language what personal information we collect, why, how long we keep it, and what choices you have.
Who we are
The controller responsible for your personal information is:
Customico Prosta Spółka Akcyjna (simple joint-stock company)
ul. Zamknięta 10/1.5, 30-554 Kraków, Poland
KRS 0001228366 · NIP (EU VAT) PL6793360712
Contact: hello@lovetopus.com
We are based in the European Union, so we apply the EU General Data Protection Regulation (GDPR) to everyone who uses lovetopus.com and our emails, wherever they live. We have not appointed a data protection officer. For any privacy question or request, write to hello@lovetopus.com.
The short version
- If you sign up, we keep your email address and a record of what you agreed to. We email you only what you agreed to. We also note how you signed up and which links in our emails you click, so we can send you what’s useful.
- We count visits to our website without cookies and without storing IP addresses.
- lovetopus.com sets no cookies. No advertising or tracking cookies.
- We never sell or rent your personal information, never share it for advertising, and never send you offers from other companies.
- We do not collect information about your child.
- You can unsubscribe from any email, and you can ask us to delete your data at any time.
What we collect and why
1. When you sign up for emails
When you enter your email on one of our forms, we store:
- your email address;
- which form you used and what you asked for (for example, the Starter Kit, one email when Finley’s book is out, or a note about a planned book and which books you picked);
- which consent wording you saw (by version), when you agreed, and your confirmation that you are 18 or older;
- for each planned book you pick: when you picked it, and later whether we sent that book’s email or the request ended;
- dates of your sign-ups and, if you unsubscribe, of unsubscribing; and
- a random code that powers your personal unsubscribe link.
What you can choose (each form shows exactly which of these it covers):
- A launch email for Finley’s book: one email when Finley and the Shadow of Fear launches. Nothing else from that form, unless you also tick its box for free activities and updates.
- A note about a planned book: one email when each book you picked comes out (for example, Spike’s book). Nothing else from that form, unless you also tick its box for free pages and book news. If the book hasn’t come out within 24 months of your latest selection, that one-time request expires. Any separate email choices you’ve made still apply.
- Free pages and book news: new free printable pages and activities, and news about Lovetopus books: when a book comes out, when it becomes available, and where to get it. It doesn’t include discounts or other promotions, products other than our books, or offers from other companies.
- Free activities and updates (the box on the Finley launch form): new free pages and activities. We don’t use this box to announce new books.
If you signed up earlier, the wording you saw then still decides what we send you. For example, the earlier Starter Kit form covered news about Finley’s book only, so we don’t use it to announce our other books. We never stretch a choice beyond the wording you agreed to.
We have not sent any emails yet. Before we send our first email, we will name here the provider that sends our emails for us.
Legal basis: your consent (GDPR Art. 6(1)(a); in Poland also Art. 398 of the Electronic Communications Law). Keeping a record of your consent, of your opt-out and of how each book request ended is based on our legitimate interest in being able to prove that we follow the law and respect your choices (Art. 6(1)(f)). We also look at which planned books people pick to decide which books to make next, based on our legitimate interest in planning our books (Art. 6(1)(f)). The book choices describe the book (for example, “about anger”), not you or your child.
You can withdraw your consent at any time with the unsubscribe link in any email, or by writing to hello@lovetopus.com. Unsubscribing cancels all of your choices at once, including any book notes. We don’t send a confirmation email for this request. If it’s your only email choice, you won’t hear from us before the book comes out. To cancel the request before then, write to hello@lovetopus.com and we’ll cancel it. Withdrawing doesn’t make earlier emails unlawful, but we stop at once.
What we note about subscribers. While you are on our email list, we also keep:
- a record of each sign-up: which form and choice, the consent wording, the section of our site the form was on (for example “/feelings/”, never the specific article), and how you found us if you came from one of our emails or a printed code;
- the date of your last sign-up or click;
- clicks on links in our own emails: each link carries a random code that tells us the click came from you. We note which free page you downloaded or which link you followed (for example, to a book’s Amazon page), and when. For a download, we also note the feeling the material is about (for example, “fear” for a Finley page). We don’t record anything about your child;
- if you sign up through a link from another subscriber’s email, which subscriber’s link it was; and
- a scrambled form of your email address that links your records across our own databases. It is not your address in readable form, but it is still personal information about you (pseudonymous, not anonymous).
We use this to see which of our materials are useful and to choose which of our emails to send you. To do that, we may put subscribers into groups, for example people who downloaded a Finley page or haven’t been active for a while. This is a form of profiling. It only affects which of our emails you get, nothing else. We do not use tracking pixels, and we don’t record what you do on other websites.
If you aren’t on our list, or you don’t click a link from our email, we only count downloads and clicks in totals (by day, item and the page or campaign link they came from), with nothing that identifies you.
Legal basis: our legitimate interest in knowing which materials are useful and in sending relevant emails (Art. 6(1)(f)). You can object at any time by writing to hello@lovetopus.com. We always honor an objection to direct marketing and to the profiling connected with it.
2. Cookies
lovetopus.com sets no cookies. We don’t use advertising, social media or cross-site tracking cookies.
3. Visitor statistics
We count visits to the pages of lovetopus.com with Counterscale, a simple statistics tool that runs on our own Cloudflare account. It does not use cookies and does not store your IP address. For each page view it records the page, the website or campaign link that sent you, your country (from Cloudflare’s network data), and your browser and device type, taken from the technical description your browser sends (its “user agent”). To tell a first visit of the day from a repeat visit, it uses a date that your browser keeps in its normal cache for our site. We see only totals. These records are kept for up to 90 days.
Legal basis: our legitimate interest in knowing which pages are useful (Art. 6(1)(f)). You can object at any time. Most browsers also let you clear or block the cache for a site.
3a. QR codes in our printed materials
When you scan one of our QR codes, our server adds one to a count for that code and sends you on to the page. To place the count on a map, we use the approximate location that Cloudflare estimates from your internet connection. We keep only the country and, in the United States and Canada, the state or province. In the United States we also keep the city, but only if it is on our fixed list of large cities. In Quebec we keep only the province. We don’t save your IP address, your device details or your precise location, and scans are never linked to you or to your email address.
Daily counts per code are combined into weekly totals and then deleted, at the latest after 14 days. In the weekly totals, any city, state or province with fewer than 10 scans is merged into a larger area (at most, the whole country) before we look at it. These weekly totals can’t be linked to anyone.
Legal basis: our legitimate interest in knowing which printed materials work, and where (Art. 6(1)(f)).
4. Protection against abuse
To stop automated or repeated sign-ups we briefly use:
- your IP address and your browser’s technical description (user agent), only for a moment, to limit how many requests one connection can make and to filter out automated traffic. We do not save either in our databases; and
- a scrambled (hashed) form of your email address, to count sign-up attempts. These records are deleted automatically after 2 days.
Legal basis: our legitimate interest in keeping our forms secure (Art. 6(1)(f)).
5. Website hosting
Our website runs on Cloudflare, which hosts and delivers the pages and protects them from attacks. Like any web server, Cloudflare processes technical data when you visit, such as your IP address, browser type and the page requested. Cloudflare does this on our behalf.
Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f)).
6. When you email us
If you write to hello@lovetopus.com, we use your message and address to reply, and keep the correspondence only as long as needed to handle your request.
Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or steps you ask us to take (Art. 6(1)(b)).
Who we share information with
Only with service providers that process it for us under a written data processing agreement, and only as needed:
- Cloudflare, Inc. (USA): hosting, content delivery, security, our database and our visitor statistics.
We may also disclose information if the law requires it, or to protect our rights.
We do not sell your personal information, share it for cross-context behavioral advertising, or give it to other companies for their own marketing.
Amazon and other websites
Our books are sold on Amazon. When you click a link to Amazon, you leave our site and Amazon’s privacy notice applies. We don’t receive any personal information about you from Amazon.
International transfers
Cloudflare is a US company and may process data in the United States and other countries. Where personal data leaves the European Economic Area, we rely on recognized safeguards: the EU–US Data Privacy Framework (for certified providers) or the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
How long we keep information
| Information | How long |
|---|---|
| Email list record | Until you unsubscribe or ask us to delete it |
| A note about a planned book | Until we send that book’s email, you unsubscribe, or 24 months pass since you last picked that book without it coming out |
| After a book note ends (email sent or 24 months passed) | Your email address, which books you picked and the record of your request, until you ask us to delete them, so that we can show we emailed you only as agreed |
| Clicks and downloads linked to you, and your group memberships | 13 months; deleted within 24 hours after you unsubscribe |
| After you unsubscribe | Your email address, your consent record, the date you unsubscribed, and the details of your sign-ups (which forms, what you asked for, how you found us), so that we never email you by mistake |
| Abuse-prevention counters | 2 days |
| Visitor statistics (Counterscale) | Up to 90 days |
| Download, click, sign-up and QR scan totals that can’t be linked to anyone | Kept indefinitely |
Children’s privacy
Our website and emails are for parents, caregivers and other adults. Sign-up requires confirming that you are 18 or older. We do not ask for, and do not want, any information about your child: no names, ages or photos. We do not knowingly collect personal information from children under 13 (or under 16 in the EU). If you believe a child has given us personal information, contact hello@lovetopus.com and we will delete it.
Your rights
Everyone, wherever you live, can unsubscribe from our emails and ask us to see, correct or delete the personal information we hold about them.
Under the GDPR, you also have the right to: access your data and get a copy; correct inaccurate data; have your data erased; restrict how we use it; object to processing based on our legitimate interests, and object at any time to direct marketing; receive your data in a portable format; withdraw your consent at any time; and lodge a complaint with a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain to the authority where you live or work.
US residents: depending on your state, you may have rights to know, access, correct and delete your personal information, and to opt out of its sale, targeted advertising or certain profiling. We do not sell personal information or use it for targeted advertising. We honor access, correction and deletion requests from any US resident, and we will not treat you differently for exercising your rights. We treat a Global Privacy Control signal as a request not to sell or share your data, which we don’t do anyway.
How to make a request: email hello@lovetopus.com. We may ask you to confirm the request from the email address it concerns, so we can verify it’s you. We respond within one month (we may extend this by two more months for complex requests, and will tell you if so). An authorized agent may contact us on your behalf.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Our emails
Every marketing email we send, including a one-time launch email or book note, will identify Lovetopus and Customico PSA, include our postal address, and have a working unsubscribe link. We act on unsubscribes immediately (and always within 10 business days, as US law requires).
Security
We collect as little as possible. We use encrypted connections (HTTPS), limit access to our data to the owner, and keep no IP addresses in our databases. No system is perfectly secure, but we take reasonable steps to protect your information.
Changes to this policy
If we change this policy, we will post the new version here and update the date at the top. If a change is significant, for example a new purpose for your email address, we will tell you by email and ask for your consent again where required.
Contact
Questions or requests: hello@lovetopus.com
Customico Prosta Spółka Akcyjna, ul. Zamknięta 10/1.5, 30-554 Kraków, Poland.