Privacy Policy

The HeyLibro website at heylibro.com and the HeyLibro web application, including all pages and subdomains of heylibro.com (together, the “Service”), are operated by CYTRIXLABS LTD, a private limited company incorporated in the Republic of Cyprus under registration number HE 498352, with its registered office at Kasandras 7, Flat/Office 101, Strovolos, 2021 Nicosia, Cyprus (“CYTRIXLABS”, “we”, “us”, “our”). We are the controller of the personal data described in this Privacy Policy (“Policy”), except where we state that another company acts as an independent or joint controller.

You can contact us about any privacy matter, including to exercise your rights, at support@heylibro.com (please use the subject line “Privacy request”) or by post at the address above, marked “Attention: Data Protection”.

This Policy applies whenever we process your personal data in connection with HeyLibro, in particular when you:

It also applies after you delete your account, to the limited data we keep for the periods set out in Sections 4 and 11, and to personal data we receive about you from third parties in connection with these activities: Apple or Google when you sign in with them, payment providers when you pay, and Google and Meta where you have consented to analytics or advertising cookies.

This Policy does not apply to:

This Policy covers the Service as defined in Section 1, that is, both the public pages of our website and the web application you use after signing in. If we make HeyLibro available as a mobile application, we will update this Policy before the application is released.

Because we are established in the European Union, we apply the EU General Data Protection Regulation (“GDPR”) and the Cyprus law implementing it to all personal data we process, wherever our users are located. Section 13 contains additional information required by the privacy laws of U.S. states.

This Policy should be read together with our Terms of Service, which govern your use of the Service and form the contract between you and us, and our Cookie Policy, which describes the cookies and similar technologies we use. Please read this Policy before you provide us with any personal data.

We collect personal data in three ways:

Providing your email address is necessary to create an account and use the Service under our Terms of Service; without it, we cannot provide the Service. Other information, such as your name or your goals, is optional. The table below lists the categories of personal data we process.

Some goals you can choose, such as better sleep or less stress, describe what you would like to read about. We use them only to select and recommend content. We do not ask you about your health, we do not use your goals to infer information about your health, and we do not share your goals or quiz answers with advertising partners.

We do not intentionally collect special categories of personal data, such as information about health, religion or political opinions. Please do not include such information in messages to our support team.

We process personal data only where we have a legal basis under Article 6 GDPR. The table below sets out our purposes, the personal data we use for each purpose, the legal basis we rely on and how long we keep the data. Where processing is necessary to perform our contract with you, the table refers to the relevant section of our Terms of Service.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights and freedoms. You can ask us for information about this assessment and object to the processing at any time (see Section 12). Where we rely on consent, you can withdraw it at any time; withdrawal does not affect processing carried out before it.

We use personal data only for the purposes described in this Policy or for purposes compatible with them. Aggregated or de-identified information that cannot reasonably be linked to you is not personal data, and we may use it for analytics and to improve the Service.

Under Section 5.2 of our Terms of Service, free trials are available once per person within any 12-month period. To apply this rule, when you start a free trial we store a keyed cryptographic fingerprint (HMAC) of your email address together with the date of the trial. The fingerprint is created with a secret key that is stored separately from our databases. We cannot recover your email address from the fingerprint; we can only check whether an email address used to sign up matches it.

If you delete your account, we keep only the fingerprint and the date, not your email address or other account details, for 12 months from your most recent free trial, and then delete them automatically. We use the fingerprint solely to determine whether you are eligible for a free trial, and never for marketing, analytics or any other purpose.

Our legal basis is our legitimate interest in preventing misuse of free trials (Art. 6(1)(f) GDPR). You can object to this processing or ask us to delete the fingerprint at any time. We will do so once you confirm that you control the email address concerned, within the time limits set out in Section 12.

We use cookies and similar technologies, such as local storage and pixels. Strictly necessary technologies are always active, because the website cannot work without them. Technologies for analytics (Google Analytics) and for advertising and marketing (Meta Pixel and ContactPigeon) are used only if you consent through our cookie banner. We show the same banner to all visitors.

You can change your choice at any time through the “Cookie Settings” or “Your Privacy Choices” links at the bottom of every page. If your browser sends a Global Privacy Control (GPC) signal, we switch off Targeting cookies for that browser.

If you consent to Targeting cookies, Meta Platforms Ireland Limited and we are joint controllers for the collection of data through the Meta Pixel on our website and its transmission to Meta (Art. 26 GDPR). Meta is an independent controller for its subsequent processing. The essence of our arrangement is set out in the Meta Controller Addendum, and Meta’s own processing is described in the Meta Privacy Policy. The full list of cookies and their durations is in our Cookie Policy.

Some of the content in HeyLibro, including summaries and audio narration (“Generated Content”), is created with the help of third-party artificial intelligence technologies. Generated Content is prepared in advance and is the same for all users; it is not created in response to your requests.

AI providers receive only the material needed to create Generated Content, such as the title and author of a book or other source material, the text to be narrated and our generation settings. They do not receive your name, email address, account information, activity data or the messages you send us. Where our agreements with AI providers allow it, we use settings that exclude the data we send from being used to train their models. We do not use your personal data to train AI models.

We send service messages that are necessary to provide the Service, such as sign-in codes, information about your account and subscription, renewal reminders and changes to our terms. You cannot opt out of these messages while you have an account, because they are part of the Service.

You can decide whether to receive Offers & news, such as recommendations of new content and offers related to HeyLibro:

You can turn off reading reminders with the “Notifications” switch in Profile → Notifications and change their time under “Delivery time”. We process requests to stop marketing messages promptly and in any event within 10 business days.

We do not sell personal data for money. We disclose personal data only as described below and only to the extent necessary for the purposes set out in Section 4.

Service providers (processors). We use service providers that process personal data on our behalf and only on our instructions, under written agreements that meet the requirements of Article 28 GDPR. They may not use the data for their own purposes. They include:

A current list of our service providers is available on request.

Independent controllers. Some companies process personal data for their own purposes under their own privacy policies: Apple (Apple Privacy Policy) and Google (Google Privacy Policy), if you choose to sign in with them; payment providers, for purposes such as fraud prevention and compliance with financial regulation; and Meta, for its processing after it receives data through the Meta Pixel (see Section 6).

Professional advisers and authorities. We may disclose personal data to our lawyers, accountants and auditors, who are bound by confidentiality, and to courts, regulators, law enforcement or other public authorities where the law requires it or where it is necessary to establish, exercise or defend legal claims.

Business transfers. If we are involved in a merger, acquisition, financing or sale of all or part of our business, personal data may be disclosed to the parties involved and transferred to a successor, which will be bound by this Policy or by a policy offering at least the same level of protection.

We do not disclose personal data to AI providers (see Section 7).

Some of our service providers and the independent controllers named above are located outside the European Economic Area (“EEA”), including in the United States. When personal data is transferred outside the EEA, we make sure it is protected by one of the following safeguards:

Where the UK GDPR or Swiss law applies, we use the UK International Data Transfer Addendum or the Swiss amendments to the standard contractual clauses. You can request a copy of the relevant safeguards by contacting us.

We keep personal data only for as long as necessary for the purposes for which we process it. The retention period for each purpose is set out in the table in Section 4. When a retention period ends, we delete or anonymise the data in our active systems; copies in encrypted backups are deleted in the ordinary course of our backup cycle.

When you delete your account, we delete your account data, preferences and activity data within 30 days. We keep only the free trial eligibility record and the records we are required to keep by law, for the periods shown in Section 4.

In some circumstances we are required to keep personal data for longer, for example in connection with legal proceedings, investigations or requests from public authorities. In such cases we keep the data only for as long as necessary to meet these obligations and protect it with appropriate security measures.

Subject to the conditions and exceptions set out in the GDPR, you have the following rights:

Your right to object (Art. 21 GDPR)

You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, including the free trial eligibility record described in Section 5. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

You may also object at any time to the use of your personal data for direct marketing. If you do, we will stop using your data for that purpose.

To exercise your rights, write to support@heylibro.com. To protect your data, we may ask you to confirm that you control the email address linked to your account, for example by entering a verification code we send you. We respond without undue delay and in any event within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, we may extend this period by two further months; in that case we will inform you of the extension and the reasons for the delay within one month of receiving your request. Exercising your rights is free of charge. If a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act on it, and we will explain why.

Where we rectify or erase your personal data or restrict its processing, we inform the recipients to whom the data was disclosed, unless this proves impossible or involves disproportionate effort (Art. 19). If we do not take action on your request, we will tell you why within one month of receiving it and inform you of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy (Art. 12(4)).

This section supplements this Policy for residents of U.S. states with comprehensive privacy laws, including California, Colorado, Connecticut, Oregon, Texas and Virginia, and serves as our notice at collection. Some of these rights apply only where the relevant state law applies to us.

In the past 12 months we have collected the categories of personal information listed below, for the purposes described in Section 4, from the sources described in Section 3. We keep each category for the periods set out in Sections 4 and 11.

We collect account sign-in credentials, meaning your email address together with one-time sign-in codes, only to authenticate you. We do not collect or use sensitive personal information to infer characteristics about you.

We do not sell personal information for money. If you enable Targeting cookies, we use the Meta Pixel to measure and personalise our advertising. Under some state laws this may be considered “sharing” of personal information for cross-context behavioural advertising, “targeted advertising” or a “sale”. You can opt out at any time by clicking “Your Privacy Choices” at the bottom of any page and switching off Targeting. We treat a Global Privacy Control signal as a valid request to opt out for the browser that sends it. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Depending on your state of residence, you may have the right to know and access the personal information we hold about you, to obtain a copy in a portable format, to correct it, to delete it, and to opt out of its sale, sharing or use for targeted advertising. We do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects. We will not discriminate against you for exercising any of these rights.

You can submit a request by email to support@heylibro.com or opt out through “Your Privacy Choices”. We will verify your request by confirming that you control the email address linked to your account. You may use an authorised agent; we will ask the agent for your signed permission and may ask you to verify your identity directly. We confirm receipt of requests to know, access, correct or delete personal information within 10 business days and respond within one month of receiving the request, including the time needed to verify it, in line with Section 12. Where reasonably necessary, we may extend this period by up to 45 further days; in that case we will inform you of the extension and the reasons for it within the first month. We process requests to opt out of sale, sharing or targeted advertising as soon as feasibly possible and no later than 15 business days after receiving them.

If we decline to take action on your request, you may appeal by replying to our decision or by writing to support@heylibro.com with the subject line “Privacy appeal”. We will respond to your appeal in writing within 45 days of receiving it and explain any action taken or not taken and the reasons. Where the law of your state allows, we may extend this period when reasonably necessary, and we will inform you of the extension and the reasons for it. If your appeal is denied, you may contact the Attorney General of your state.

California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes.

Consumer health data. We do not collect consumer health data as defined in Washington’s My Health My Data Act or similar state laws. The goals you can choose describe reading interests; we do not use them to infer your health status and we do not share them with advertising partners.

Do Not Track. Browser “Do Not Track” signals have no common industry standard, so we do not respond to them. We honour Global Privacy Control signals as described in Section 13.2.

HeyLibro is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a person under 18, we will delete it. If you believe that a minor has provided us with personal data, please contact us.

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls based on the principle of least privilege, pseudonymisation such as the keyed fingerprints used for free trial eligibility, logging and monitoring, and regular security reviews. Our staff and service providers are bound by confidentiality obligations.

No method of transmission or storage is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority, and if the risk is high, we will also notify you, as required by Articles 33 and 34 GDPR.

You are responsible for keeping secure the email account and the Apple or Google account you use to sign in, and for telling us promptly if you suspect unauthorised access to your HeyLibro account.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Our systems recommend content automatically and check automatically whether you are eligible for a free trial; neither has such effects. If you believe an eligibility decision is wrong, contact us and a member of our team will review it.

The Service may contain links to websites and services operated by others, such as Apple, Google or Meta. Their processing of your personal data is governed by their own privacy policies, and we are not responsible for their practices.

We may update this Policy to reflect changes in our practices or in the law. We will publish the updated Policy on this page with a new “Last updated” date. If the changes are material, we will tell you in advance by email or through the Service. Where a change requires your consent under applicable law, we will ask for it.

CYTRIXLABS LTD, Kasandras 7, Flat/Office 101, Strovolos, 2021 Nicosia, Cyprus. Email: support@heylibro.com.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. Our lead supervisory authority is the Office of the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus (P.O. Box 23378, 1682 Nicosia); telephone +357 22 818 456; www.dataprotection.gov.cy. We would welcome the opportunity to address your concerns first, so please consider contacting us before you approach the authority.