Privacy policy
Last updated: 24 October 2026
This policy explains what personal data louiseshellis.co.uk collects, why, who it's shared with, and what you can do about it. The short version: only what you type into a form is collected, it's never sold, and the site doesn't use cookies to track you.
Who's responsible
The data controller is Louise Shellis, the author running this site. For anything privacy-related, use the contact form.
What's collected and why
Newsletter
When you subscribe, your email address (and first name, if you give it) is stored to send you the newsletter.
- Legal basis: your consent. You can withdraw it any time with the unsubscribe link in every email.
- Kept: until you unsubscribe or ask for it to be deleted.
Contact form
Your name, email address and message are emailed to Louise so she can reply.
- Legal basis: legitimate interest in answering the messages you send.
- Kept: as long as needed to deal with your message, and no longer than 3 years after the last exchange.
ARC (advance reader copy) sign-ups
When you apply for an ARC, your name, email address, the review links and notes you provide, your preferred format and whether you'd like the newsletter are stored. If you're approved, your personal access link, its expiry date, how often it was used, and notes about the ARC (for example whether you've posted a review) are stored too. Approved readers are added to an ARC readers list in the email tool so ARC-related emails can be sent; you only get the newsletter if you ticked that box.
- Legal basis: handling the ARC request you make, and your consent for the newsletter.
- Kept: reader access is deleted 24 months after it ends, and approved applications 24 months after approval once no access remains, so it's possible to see who has read before. Rejected applications are deleted after 6 months.
Downloads and watermarking
Every ebook or PDF downloaded from this site (ARCs and gift or redeem links) is watermarked before it reaches you. It shows who the copy was prepared for, the date and a reference code, and the same reference code is hidden inside the file. Gift and redeem links don't ask for your details, so those copies show only the date and code, plus your name if it was added when the link was made. No copy of your watermarked file is kept.
Each download is logged: the reference code, which file, when, and the name and email address the copy was prepared for. If a copy turns up shared online, this shows which download it came from, even after the link itself has been deleted.
- Legal basis: legitimate interest in protecting the books from unauthorised sharing.
- Kept: 36 months after the download. This log isn't removed by a deletion request, for the same reason.
ARC typo reports
If you report a typo from your ARC page, what you wrote and which ARC access it came from are kept so it can be fixed. If your ARC access is deleted, the report stays but is no longer linked to you.
Book reviews
If you rate or review a book, the name you give, your rating, what you wrote and when are shown publicly on that book and kept until the review is removed. No email address is asked for, so the your data page can't find reviews: to have one changed or removed, say which book and the name you used through the contact form.
Blog comments
If you comment on a blog post, the name you give, what you wrote and when are shown publicly under that post and kept until the comment is removed. Your email address is kept with it but never shown; it lets the your data page find and delete your comments. Deleting a comment also deletes the replies to it.
Data requests
When you use the your data page, your email address, the kind of request and when it was confirmed and carried out are kept as a record that it was handled.
- Legal basis: the legal obligation to answer and document data requests.
- Kept: 12 months.
Spam and abuse protection
To stop form spam, your IP address is held briefly in the server's memory to limit how many requests can be sent. It's never written to a database and is forgotten within about 10 minutes.
Hosting
Like any website, the host receives technical data (such as your IP address and browser) when you load a page, in order to deliver and secure it. Legal basis: legitimate interest.
Analytics and cookies
The site sets no cookies for visitors and doesn't track you across other websites. It uses Vercel Web Analytics to see anonymous, aggregate statistics: which pages are visited, where visitors come from, country, device type and browser. Nothing is stored on your device, and visitors are only told apart within a single day by a hash that is discarded after 24 hours. Legal basis: legitimate interest in improving the site.
The site saves two small things in your browser's local storage, purely for it to work: which news pop-ups and promotion banners you've closed, and your analytics opt-out choice if you make one below. Neither is ever sent anywhere.
You can opt out of the analytics in this browser at any time:
Who your data is shared with
Your data is never sold or shared for advertising. It's only handled by the services that run this site:
- Vercel Inc. (USA): website hosting and analytics.
- Supabase Inc. (USA): database for ARC sign-ups, download links and the download log.
- MailerLite (EU): newsletter and ARC reader emails.
- Resend Inc. (USA): emails sent from the site, such as ARC decisions, data-request links and contact form messages.
Where data is processed outside the UK and EU, it's protected by each provider's data processing agreement and the standard contractual clauses or data-transfer frameworks it relies on.
Your rights
You can:
- access the data held about you, and get a copy of it;
- have it corrected or deleted;
- restrict or object to how it's used;
- withdraw your consent at any time.
You can see or delete your data yourself on the your data page (the emailed link works for 24 hours). For anything else, use the contact form; you'll get a reply within one month. If you're unhappy with how your data is handled, you can complain to the UK Information Commissioner's Office (ICO) or the data protection authority in your own country.
Changes
If this policy changes, the new version will be posted here with a new date at the top.