Privacy Policy

1. Effective Date

This Privacy Policy took effect on October 27, 2026. It applies to all accessions, catalog inquiries, communications, and visits across bookshope.click.

2. Data Controller & Operator Identity

The data controller responsible for personal information processed through this website is Bookshope, an Illinois business trading at bookshope.click, situated at 225 North Columbus Drive, Chicago, Illinois 60601, Chicago, Illinois, United States. Telephone contact: +1 (340) 805-3400. Written inquiries: office@bookshope.click.

Bookshope operates an inquiry-only showcase for Smyth-sewn paper books, curated libraries, and turnkey book catalog infrastructure ($5,000–$20,000 USD per site). We do not operate customer login accounts, do not store passwords, and do not process electronic credit card transactions on this domain.

3. Categories of Data Collected

We collect information directly from your communications and automatically through technical website delivery:

• Inquiry Form Submissions (wuju9c3.php): When you request a catalog manifest or quote, we collect your name, telephone number, email address, physical delivery or studio address, inquiry kind, physical specifications, notes, and consent tick.
• Support Chat Dialogues (vafo9b6.php): We record message text, session tokens, and timestamps when you interact with our catalog desk.
• Technical and Server Logs: Internet Protocol (IP) address, browser user-agent string, operating system, referring URL, time of request, and HTTP status codes.
• Consent Verification: A browser record stored under the key site_consent_v2 reflecting whether you accepted or declined tracking storage.
• Advertising Click Identifiers: Alphanumeric click parameters appended to incoming URLs by paid ad networks: gclid from Google Ads, msclkid from Microsoft Advertising, and fbclid from Meta Ads.

4. Purposes of Processing

We process your personal information strictly for deliberate operational tasks:

• Preparing tailored physical book quotations, catalog manifests, and turnkey catalog project agreements.
• Responding to phone, email, and live desk questions regarding paper weights, bindings, and delivery crates.
• Measuring the effectiveness of search and paid advertising campaigns across Google, Microsoft, and Meta.
• Preventing malicious automated form spam, server intrusion attempts, and fraudulent submissions.
• Verifying adherence to statutory privacy standards and maintaining records of consent decisions.

5. Legal Bases for Processing

Under European and international data protection standards, every processing activity rests upon a specified legal basis:

• Consent (GDPR Article 6(1)(a)): Used for non-essential tracking cookies, advertising analytics, and marketing tags governed by Consent Mode v2. You may withdraw consent at any time.
• Contractual Performance & Pre-Contractual Steps (GDPR Article 6(1)(b)): Used for processing your name, address, contact details, and book specifications submitted in manifest requests.
• Legitimate Interests (GDPR Article 6(1)(f)): Used for maintaining network security, defending against automated denial-of-service abuse, and analyzing server traffic volume to optimize catalog indexing speed.
• Legal Obligation (GDPR Article 6(1)(c)): Used for retaining financial tax records and fulfilling formal statutory disclosures.

6. Advertising Platforms & Campaign Traffic

This website is an active destination for digital paid advertising campaigns. Traffic is actively referred to bookshope.click by Google Ads, Microsoft Advertising, and Meta Ads.

When an ad is clicked on these networks, the advertising platform appends a unique alphanumeric click identifier to the landing URL: Google Ads uses gclid, Microsoft Advertising uses msclkid, and Meta Ads uses fbclid. These parameters allow the platforms to match an inquiry or visit to a specific ad auction. No ad network has reviewed, endorsed, or approved this website.

7. Consent Mode v2 Implementation

We implement Google Consent Mode v2 to ensure privacy choices are enforced before any measurement or conversion code executes.

Upon initial page render, four specific consent states are held denied: ad_storage, ad_user_data, ad_personalization, and analytics_storage. If you click “Decline” or ignore the banner, these four parameters remain strictly denied, preventing the storage of advertising identifiers. Only when you click “Accept” are these states updated to granted. If you change your preferences or decline via our banner, the four signals are instantly set back to denied.

8. Third-Party Processors & Service Providers

We disclose personal data to the following external processors solely to maintain website operations and ad measurement:

• Google LLC / Google Ireland Ltd: Web analytics, advertising delivery, and tag measurement via Google Ads.
• Microsoft Ireland Operations Ltd / Microsoft Corporation: Search advertising infrastructure via Microsoft Advertising. For information on Microsoft data governance, review their privacy disclosure at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Campaign referral measurement and conversion API routing.
• Hosting Infrastructure Provider: Encrypted United States cloud servers hosting web files, database tables, and access logs.
• Mail Transport Provider: Enterprise SMTP relays routing inquiry notifications from wuju9c3.php to our Chicago project desk.

9. International Data Transfers

Bookshope operates from Chicago, Illinois, United States. If you access bookshope.click from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to and processed within the United States. Such transfers are safeguarded through Standard Contractual Clauses (SCCs) adopted by the European Commission, the EU-US Data Privacy Framework where certified, and strict encryption during transit and rest.

10. Data Retention Schedules

We maintain rigid retention ceilings and do not store information indefinitely:

• Inquiry Records & Notification Emails: Retained for exactly 24 months to support multi-stage collection curation, then permanently erased.
• Support Chat Transcripts: Retained for 18 months from the last recorded message.
• Web Server Access & Security Logs: Retained for 90 days for network diagnostic and firewall audits, then purged automatically.
• Consent Verification Preference: Stored in local browser storage for 12 months, after which the banner re-prompts for your preference.
• Data Subject Access Inquiries: Correspondence relating to privacy requests is preserved for 36 months to verify statutory compliance.

11. Technical & Operational Security Measures

We protect your correspondence with layered technical safeguards: mandatory TLS 1.3 encryption across all URLs, strict Content Security Policy directives, HTTP honeypot verification on forms, brute-force rate-limiting, and restricted key-based administrative access to our Chicago production server. We store zero raw payment card data on our systems.

12. European Privacy Rights (GDPR)

If you reside in the European Economic Area or United Kingdom, you hold statutory rights under the General Data Protection Regulation (GDPR):

• Right of Access: You may request a copy of all personal information held regarding your identity.
• Right to Rectification: You may request correction of inaccurate addresses, email records, or specifications.
• Right to Erasure (Right to be Forgotten): You may request deletion of your inquiry and chat logs, subject to statutory record-keeping duties.
• Right to Restriction: You may restrict processing while an objection or accuracy dispute is verified.
• Right to Data Portability: You may request an export of your inquiry history in a structured JSON or CSV format.
• Right to Object: You may object at any time to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: You may revoke consent previously given for advertising storage via our cookie controls.

13. United States State Privacy Rights (CCPA / CPRA)

Residents of California under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), as well as residents of Virginia, Colorado, Connecticut, Utah, and other applicable states, have distinct statutory rights:

• Notice of Collection: The categories of personal data collected, purposes, and retention are detailed in Sections 3, 4, and 10 of this policy.
• Right to Opt Out of Sale or Sharing: Bookshope does not sell your personal data for monetary payment. However, transmitting online identifiers to Google, Microsoft, or Meta for targeted advertising may qualify as “sharing” under California law. You may opt out by declining our cookie banner or enabling Global Privacy Control.
• Right to Delete and Correct: You may request that we delete or correct personal data collected directly from you.
• Non-Discrimination: We do not discriminate, deny catalog access, charge differing consultation rates, or alter turnaround times based on your exercise of privacy rights.

14. Global Privacy Control (GPC)

We recognize and respect the Global Privacy Control (GPC) signal broadcast by modern browsers. When our servers detect an active Sec-GPC header, we immediately treat it as an affirmative opt-out of cross-context behavioral advertising and marketing storage, setting all Consent Mode v2 parameters to denied without requiring interaction with our banner.

15. Children’s Privacy

Bookshope is a trade service providing physical books, archival library installations, and catalog platforms for adult collectors, curators, and institutions. We do not knowingly solicit, collect, or process information from individuals under the age of 18. If we learn that a minor has submitted personal information, we immediately purge the record from our active databases.

16. Supervisory Authorities & Complaints

If you believe our data processing violates applicable law, you have the right to lodge a formal complaint with a competent supervisory authority. In the United States, you may contact the Office of the Illinois Attorney General or the California Privacy Protection Agency (CPPA) in California. In the European Union, you may contact the data protection authority in your member state of residence.

17. Exercising Data Subject Requests

To exercise your rights of access, correction, deletion, or portability, submit a written request to office@bookshope.click or complete our dedicated Data Subject Access Request (DSAR) form. You may also call our Chicago project desk at +1 (340) 805-3400.

We acknowledge and answer all verifiable consumer data requests within 10 days of receipt. We verify identity by cross-referencing your name and email address against prior inquiry logs.

18. Changes to this Policy

We review our data handling practices regularly. Any material revisions will be published directly on this page with an updated effective date at the top of the document. We recommend visiting this page periodically when commissioning new catalog projects.

19. Contacting Our Data Desk

For questions concerning this Privacy Policy, Consent Mode v2 implementation, or physical record handling, contact our designated project desk: