Privacy Policy

We collect only what the service needs to work: your account email and authentication credentials; the metadata of the books you register (title, author, ISBN, publication details, and the optional contact details you give us for DMCA web forms); the piracy evidence our scanners gather (URLs, screenshots, page captures of infringing sites); and the DMCA notices and responses handled on your behalf.

When you approve a notice you attest to it under penalty of perjury. We record the exact wording you attested to, your name, the time, and the IP address and browser identifier of the device you used, because that record is what makes the notice a legally valid declaration.

Payment details are entered on our payment processor’s own checkout and never touch our servers. We do not collect the contents of your manuscripts.

Your data is used for one purpose: finding pirated copies of your registered books and getting them taken down. Book metadata drives the scans; evidence supports the takedown notices; your email receives reports and alerts.

When we dispatch a DMCA notice by email as your authorized agent, the notice carries our contact details, not yours, and is signed by our agent on your behalf — so your personal address is not exposed to the operators of pirate sites. Some recipients (Google and other large platforms) accept complaints only through their own web forms; those forms are pre-filled with the contact details you enter for the book, and the recipient sees those details, not ours.

When a takedown notice is submitted to certain recipients — notably Google — the recipient may forward it to the public Lumen Database of takedown requests. Those published notices identify the copyrighted work and the notices sent on its behalf. This is standard practice across the industry and outside our control; we mention it because we believe you should know where your notices can end up.

We use the following providers to run the service. Each receives only the data its row describes, and only for the function named.

To find where to send a notice we also query public WHOIS/RDAP records and IP geolocation services. Those lookups carry only the infringing site’s domain or address — never anything about you.

These providers operate in several countries, including the United States and India, so your data may be processed outside the country you live in. All data is transmitted exclusively over encrypted HTTPS (TLS) connections — the website, The Book Care mobile app, and our APIs do not accept unencrypted traffic.

We do not sell your data. We do not share it with advertisers. Ever.

Your account, books, evidence, notices, attestations and settings are stored in our database and file storage, hosted by Supabase on Amazon Web Services in Mumbai, India (region ap-south-1). They are processed by our application servers, task queues and scanners, hosted by Google Cloud in Iowa, United States (region us-central1). The providers in the table above process the data their row describes in the countries where they operate, which include the United States and India.

If you are in the United Kingdom, the European Economic Area or another country that restricts international transfers, this means your personal data is transferred outside that country. The mechanism we rely on for those transfers is: {{TRANSFER_MECHANISM}}. You can ask us for a copy of the relevant transfer terms at support@thebookcare.com.

If we learn of a security incident that affects your personal data, we will investigate it under our incident-response procedure, contain it, and tell you without undue delay what happened, what data was involved and what we are doing about it. Where a law requires it, we will also notify the relevant supervisory authority within the period that law sets — for example within 72 hours of becoming aware under the GDPR and UK GDPR, and as the Digital Personal Data Protection Act requires in India. We keep a record of every incident, including those that did not require notification.

Your account, registered books, scan history and settings

For the life of your account. Deleted within 30 days of a verified deletion request (see the account deletion page).

Evidence that has not been used in a notice (URLs, page captures, hashes)

Scheduled to be expired, and its captures deleted, two years after it was gathered — never sooner than one year. You can also clear a book’s unused evidence yourself at any time; clearing evidence keeps anything already cited in a dispatched notice.

Dispatched notices, the evidence they cite, the perjury attestation recorded for each (including the IP address and browser identifier of the device used), and any reply or counter-notice

For as long as the notice can be challenged, and in any case at least three years after dispatch (the limitation period for claims under 17 U.S.C. § 512(f)). These records are excluded from account-deletion requests. Deleting a book, or your account, moves the record of each notice already sent, the exhibit it was sworn on and the attestations behind it into a separate archive keyed by a pseudonymous identifier, no longer linked to you. Replies and other correspondence about those notices are deleted with the book. There is no bulk export of replies in the app today: download the per-case notice record and your enforcement reports from the Removals page, and ask support@thebookcare.com for a copy of any reply correspondence you need before deleting.

Extra notification addresses you add (for notice copies and reports)

Until you remove them or delete your account. An address you remove is not erased at once: we keep the address and its send counters with consent withdrawn, so that removing and re-adding an address cannot reset the limits that stop the service being used to send unwanted mail. Nothing is sent to a removed address.

Contact details of site operators, hosts and registrars gathered while enforcing your rights

As part of the enforcement record for that site, for the same period as the notices sent to it.

Payment records

Held by the payment processor for as long as tax and accounting law requires; we keep only the payment reference and the plan or credits it bought.

Clearing a book’s evidence removes only evidence that has not been cited in a dispatched notice. Deleting the book itself removes its scan history and any replies to its notices; the record of each notice already sent, the exhibit it was sworn on and the attestations behind it are moved under legal hold into a separate archive keyed by a pseudonymous identifier. Deleting a book is confirmed by a one-time code and cannot be undone. Replies cannot be exported in bulk from the app today, so download the per-case notice record and your enforcement reports from the Removals page first, and ask support@thebookcare.com for a copy of any reply correspondence you need. Records of dispatched notices are excluded from account-deletion requests and kept for the period above.

We process your account and book data to provide the service you signed up for. We process data about infringing sites and the people who operate them on the basis of our — and your — legitimate interest in enforcing your copyrights. We keep dispatched notices and their attestations because they are legal declarations we may need to produce in a dispute.

You can request a copy of the data we hold about you, correct it, or ask for your account and its data to be deleted by emailing support@thebookcare.com or protection@thebookcare.com. We respond to verified requests within 30 days. Records that must be retained under “How long we keep it” above are excluded from deletion.

To delete your account and its data, follow the steps on the account deletion page.