Shopy 101 Privacy Policy

Last updated: 6 September 2026

Data controller: SHOPY 101 LTD (company no. 16388100, England and Wales).
Registered address: Suite 8953, 5 Brayford Square, London, E1 0SG, United Kingdom
Contact: help@shopy101.com

This policy covers both the Shopy 101 mobile app and the website at shopy101.com. It is not a generic template; it describes what the service actually does.

1. WHAT WE COLLECT

ACCOUNT

• Your email address and display name (on sign-up or Google sign-in)
• The username you choose
• Your profile photo, if you set one
• When your account was created and last updated

USE AND LIBRARY

• The works you add to your library and when
• Your progress in each work (percentage, last read time); for audiobooks the chapter and exact position
• Your reading streak (current streak, longest streak, last active day)
• Your favourite lists and their contents
• The genres you engage with — this builds the 'For You' shelf
• Ratings and reviews you write (shown publicly with your display name)

PURCHASES

• The products you bought, the amount paid and when
• We do NOT collect or store card details. Payment runs through Stripe and card details are entered on Stripe's own secure screen.

IF YOU ARE A SELLER — ADDITIONAL DATA

• Your store name, description and logo
• The products and files you upload
• Your earnings and payout records via your Stripe account
• Your identity verification data (collected and verified by Stripe)
• Your tax identification details and address — collected because the law requires it (see section 4)

AUTOMATIC

• Firebase Analytics: screens opened, features used, search terms, approximate device and app information
• Firebase Crashlytics: crash reports — device model, OS version, technical state at the time of the crash
• Firebase Cloud Messaging: a notification token if you allow notifications

2. WHY WE COLLECT IT

• To create your account and sign you in (performance of contract)
• To remember your library, position, favourites and streak across devices (performance of contract)
• To deliver and record your purchases (performance of contract)
• To run seller payouts and meet our tax obligations (legal obligation)
• To prevent fraud and abuse (legitimate interest)
• To send notifications if you allow them (consent)
• To find and fix crashes and improve the app (legitimate interest)

3. AI CONTENT REVIEW

When a seller uploads a product, the product's TITLE, DESCRIPTION and CATEGORY are sent to Google's Gemini service for automated pre-publication review, checking for suspected copyright infringement and illegal content.

The product FILE ITSELF is never sent. No buyer data is ever sent.

You can appeal a decision; appeals are reviewed by a person.

4. WHO ELSE PROCESSES YOUR DATA

• Google (Firebase): authentication, database, file storage, analytics, crash reporting, notifications, AI pre-review. Data is held on Google Cloud servers in the United States (us-central1) and Europe (europe-west1, europe-west3).
• Stripe: payment processing and seller identity verification.
• Content sources: opening a work downloads its file from the source, and that service can see the request. Sources: Project Gutenberg, LibriVox, Wikisource, Wikibooks, OpenStax, NASA, The Metropolitan Museum of Art, the Art Institute of Chicago, the Internet Archive, Google Fonts.
• HMRC (UK tax authority): if you are a seller, under the legal obligation below.

SELLER INCOME REPORTING. UK law requires digital platforms to report their sellers' identity and income to HMRC each year. If you are a seller, your name, address, date of birth or tax/company number, bank account details and the income you earned through the platform are reported to HMRC once a year. You are given a copy of what was reported. This is a legal obligation, not an option.

INTERNATIONAL TRANSFERS. Some of your data is processed on servers outside the UK and Europe, in the United States (Google Cloud us-central1, Stripe). These transfers rely on the safeguards required by UK and EU data protection law (standard contractual clauses and equivalent mechanisms). Write to help@shopy101.com if you want details of the safeguard relied on.

We do not sell your data and do not share it for advertising.

5. HOW LONG WE KEEP IT

• Account, library, reading progress, favourites and streak: for as long as your account exists.
• Purchase and sales records: 7 years from the transaction, as tax and accounting law requires. These survive account deletion; personal details in them are minimised.
• Crash and analytics data: subject to Google Firebase's default retention periods.

6. YOUR RIGHTS

You have the right to access, correct, delete, port and object to the processing of your data. Where processing is based on consent, you may withdraw it at any time.

You can delete your account and data in the app: Profile → Delete account. This permanently deletes your account, library, reading progress, favourites and reviews, and cannot be undone. The financial records described above are retained.

You have these rights under UK GDPR, under GDPR in the European Economic Area, and under KVKK in Türkiye. To exercise them, write to help@shopy101.com; we respond within 30 days at the latest.

If you are unhappy with our response you can complain to your national data protection authority (UK: ICO; Türkiye: KVKK Authority).

7. AGE

You must be at least 18, or of legal age in your country, to hold an account. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

8. NOTIFICATIONS

Notifications are optional and off until you allow them. You can turn them off in your device settings at any time without losing any other feature.

9. CHANGES

For a material change we will update the date above and notify you in the app before it takes effect.

10. CONTACT

help@shopy101.com