Privacy policy

readolia is the name of the publishing service, not proof of the legal identity of the data controller. The verified operating entity and direct privacy contact must be disclosed before public commercial launch.

Logged-in users may raise privacy requests through Account → Help & support. An accessible contact method for people without an account must also be added.

The app uses email/identity and role information for account login. It may store optional display name, job title, profile image URL, language, timezone and onboarding progress.

Publisher profiles may include imprint name, description, logo, country, category, website and public visibility settings. Users also upload PDF and cover files, and the system records publication titles, metadata, file sizes and hashes.

The service records support tickets, replies and optional early-access interest in future paid plans, including contact email. After activation, publication analytics store an anonymous per-open event ID, publication ID, publisher-owner ID, UTC date and whether the PDF was read on readolia or in an embed. No persistent viewer identifier, IP, referrer or device fingerprint is stored in these analytics records. Billing and card handling are not active.

Data is used to run authenticated publisher accounts, enable publishing and sharing, show opted-in public publisher pages, deliver support, help detect duplicate uploads and respond to explicit early-access requests.

The final controller must document the lawful basis for each processing activity, such as providing the requested service, applicable legal obligations, legitimate security interests or consent when required. These bases have not all been formally verified for this beta.

Personal account settings and support tickets are not intended for display on public publisher pages. Public publisher profiles appear only after the owner enables their visibility.

All uploaded PDFs currently use publicly accessible file URLs — even when their publication listing is a Draft. Do not use the beta to store confidential documents or sensitive personal data.

Base44 supplies application authentication, data records, hosting and uploaded-file delivery. readolia currently requests typography from Google Fonts, which can cause browser requests to Google's servers. An optional Google Analytics 4 integration is prepared but remains inactive unless a verified Measurement ID is configured and the visitor accepts optional analytics.

The identity and locations of all processors, subprocessors, international transfers and safeguards still require verification. This notice does not assert that all data stays in the EU.

Data remains in app records unless edited or deleted using available functions. A comprehensive retention schedule, provider-backup rules and complete self-service account/file deletion are not yet available.

Unpublishing or deleting a publication record does not by itself guarantee deletion of its uploaded PDF from public storage or caches. The final notice must include accurate retention and erasure criteria.

Depending on applicable law, people may seek access, rectification, erasure, restriction, portability, object to processing, withdraw consent where applicable and complain to a competent data protection authority.

Account → Security allows export of some readolia metadata, not the underlying PDF bytes or all provider information. Use the support desk for further account-related requests.

Authentication/session storage is used to make the app function. Basic publication-open statistics are recorded only after a PDF loads, with a single-use random event key for retry deduplication; they do not install analytics cookies or identify unique people. Publisher previews and known crawlers are excluded, and authenticated owners can see only their own aggregate counts. This is separate from optional Google Analytics 4, whose tag is not loaded without a verified Measurement ID and visitor consent. Visitors can reject or withdraw GA4 consent through Cookie Settings. Client-side Base44 SDK analytics remain disabled.

That code scan does not establish all cookies or telemetry used by Base44, other providers or the hosting environment. See Cookie Policy for known details and pending verification.

The final privacy notice must identify the controller and direct contact, exact processors, purposes and lawful bases, retention, international transfers, storage technologies and data rights channels. These facts require operational confirmation and legal review.