Privacy policy

Last updated: 5 November 2026

Usul Publications (publications.usul.academy) delivers e-books to readers who were given a code. This page explains which personal data it keeps, why, for how long, and what you can ask us to do with it.

Who we are

Usul Publications is run by Usul Academy (usul.academy), which decides what is kept and why. For any question about this page or your data, write to info@usul.academy.

What we keep

• Your e-mail address, when you use a code or ask for a sign-in link. Once you confirm it, it is stored with your licence and your library.
• Your name, only when the order your code belongs to asks for it. It is held with your request until you confirm, then stored with your licence.
• Your licence: its licence number, the copy number, the book, the order the code came from, the day you claimed it and how many downloads you have left.
• Each download: the time, your IP address, the browser identification your browser sends (its user agent) and whether the download counted towards your limit.
• Each link you ask for (to get your book or to sign in): the time and your IP address. The link itself is stored as a one-way hash; only the e-mail waiting to carry it holds the link itself, and only until that e-mail has been sent or given up.
• Your sign-in: a session with your e-mail address, its start, when it was last used to download, and your browser’s user agent.
• Counters against abuse: one-way hashes (SHA-256) of your e-mail address, of the code and of your IP address, with the time, never the values themselves. Wrong codes are counted per IP address in the server’s memory only, for 15 minutes, and never written to disk.
• A log of actions, such as “licence claimed”. It names a reader by an internal number, never by e-mail address, and records the IP address of the request.
• The e-mails we send you: your address, the kind of e-mail, the book’s title and the line of the order it came from.

Why

• To deliver your copy: to send the links, keep your library and let you download your book again.
• To prove the licence: the licence and copy numbers tie each copy to the code it was given for. If a copy is found shared, we use them to find the licence it came from.
• To stop abuse: to limit attempts and downloads and to notice unusual use.

We send no marketing e-mail and we do not sell or share your data.

What is printed in your copy

• At the bottom of every page except the cover (and, for some books, the back cover): the text chosen for the order, for example “A gift from” and the name of the organisation, and the copy number. When the order asks for your name, this text may include it.
• The licence lines, on an added page or on a page of the book: who provided the copy, the copy number and the date, a message from the giver if the order has one, and the notice that the copy is for personal use.
• The file’s properties carry the copy number and the licence number, and a few pages carry the licence number as invisible text.
• Your e-mail address is not printed in the copy.

This text is part of the file. A copy you have downloaded keeps it, even after we erase your data: we cannot reach a file on your device.

Who else sees it

• The Usul Academy staff who run this service, to help you and to deal with misuse. They see your e-mail address, your licence and its downloads. They can also export these records to a spreadsheet file, your e-mail address and name included but no IP addresses, to keep their own copy or to move the service to another system.
• The organisation that gave you the code sees only whether and when the code was used, never who used it.
• Microsoft 365 sends our e-mails, so Microsoft handles your e-mail address and the message to deliver it. We ask it not to keep a copy in a sent-items folder.
• The company that hosts our server, where the site and its data are stored.

No one else. There are no analytics, no advertising and no tracking: every page and picture comes from this site, and our e-mails contain no tracking images.

Cookies

One cookie, set only when you confirm a code or sign in: it keeps you signed in to your library for 30 days, or until you sign out. It holds a random value; the server keeps only a hash of it. There are no analytics or advertising cookies. (Usul Academy staff get their own sign-in cookies on the staff pages.)

How long we keep it

• Your e-mail address, your name (if given) and your licence: until you ask us to erase them, so that you can download again and a copy can be traced. Licences themselves are never deleted.
• IP addresses and browser identification (downloads, link requests, sign-ins, the log of actions): cleared after 12 months. The time of each download stays, without them.
• Link requests: deleted by the nightly clean-up once the link has expired. A link to get your book works for 24 hours, a sign-in link for 20 minutes.
• Sign-in sessions: deleted when they expire after 30 days, or one day after you sign out.
• The hashed counters against abuse: deleted after one day.
• Records of the e-mails we sent: deleted 30 days after sending. A record of an e-mail that could not be sent is kept until you ask us to erase your data.
• The log of actions is never deleted. It keeps the internal reader number and the licence, without your e-mail address.
• Backups of the database: a nightly copy is kept for 14 days; a copy is also made each time staff issue or change codes, and the last 30 of those are kept; encrypted copies kept away from the server are deleted after 8 weeks. Your data stay in a backup until that backup is deleted.

Your rights

You can ask what we keep about you, ask us to correct it, or ask us to erase it. Write to info@usul.academy from the e-mail address concerned, so that we can tell the request is yours.

Erasure revokes your licences, so your library and your downloads stop, and ends your sign-in sessions. Your e-mail address is replaced by a random placeholder; your name, the IP addresses and browser identification of your downloads, the browser identification of your sessions and the IP addresses in the log of your own actions are removed. Your links, the records of your e-mails and the counters kept for your e-mail address are deleted, and the copies stored on our server that carry your name are deleted. The licence and copy numbers stay, without anything that names you, so that the codes and the records stay complete. An address given as the contact of an order belongs to that order and is not changed. Backups, and any export staff made before, keep the old data until they are deleted. A copy you already downloaded keeps everything printed in it.

If you are not satisfied with our answer, you can complain to the data protection authority where you live.