A LITTLE CARE GOES A LONG WAY
Privacy
A quiet place to explore, with privacy in mind.
Who looks after your details
Joshua Hall is the individual responsible for Willowwick Books and the personal information collected through this website. Contact requests@willowwickbooks.com about your information or any privacy question. This notice was updated on 27 October 2026.
What we collect and why
If you request a preorder, we ask for an adult’s name, email address, chosen books and quantities. We record when you made the request and the permission you gave us. We may keep brief notes about our replies and the next step for your request. With that permission, we send a confirmation and respond about those books, including price and delivery details when available. A request alone does not sign you up to marketing. We take no payment details and ask for no postal address at this stage.
The voluntary early reader group
Adults can apply by emailing their first name, reading role, preferred book and confirmation that they are 18 or over. With your permission, we use that email conversation to reply about a place, provide a private reading copy and receive optional feedback. Correspondence is held in the owner-controlled inbox described below, with a private record of participation where needed. Joining does not subscribe you to marketing or share your address with other readers. Please do not send children's personal details. Reply to leave or request deletion. We remove group contact details and private feedback within 180 days of your application, or sooner if you withdraw. If you separately approve a public quotation, we retain the agreed quotation, attribution and permission while it is in use; you can ask us to stop using it. The reader-group records are managed manually, separately from the automated preorder and newsletter services.
Optional email updates
You can sign up for email updates without requesting a book, or separately tick the optional box on a book request. We ask for an adult’s email address and, on standalone signup, an optional first name. We rely on your consent for a monthly illustrated newsletter with book samples, future releases and occasional promotions. The box starts unticked and book requests do not require it. We email a private confirmation link; updates start only after you explicitly confirm on that page. We then send a welcome email. When the newsletter schedule is active, the first story note follows three days after confirmation (or activation for already-confirmed readers), then at monthly intervals. Each issue is sent once; when the prepared stories run out, we wait for new content. We store the wording and version you agreed to, its source, request date, confirmation date and current status in the private owner database. We do not add existing requesters automatically.
Changing your email preferences
Use the email-preferences link in your confirmation, welcome or update to unsubscribe without an account, or email requests@willowwickbooks.com from your subscribed address. Unsubscribing removes your name and email from the active marketing record and cancels email that has not begun sending. We keep minimal suppression records using one-way email hashes and consent evidence so we can honour your choice. Delivery-provider unsubscribe, spam-complaint and permanent-failure notifications also stop further marketing. This is separate from withdrawing a book request. Marketing exports must honour withdrawals before any future send; an email already handed to the provider cannot be recalled.
Your preorder request
The request queue is restricted to the owner. Your private link lets you view the book list or withdraw; it never displays your name or email. Keep the link private. Withdrawal removes your name, email and follow-up notes from the active request and cancels any confirmation that has not begun sending. An email already handed to the delivery provider cannot be recalled. If you lose the link, contact us from the email address used for your request.
How long we keep it
No-payment requests and their follow-up notes expire after 180 days. Scheduled cleanup removes expired records every 15 minutes; they are also removed when the request service or owner queue is used. Recovery copies can remain in Cloudflare’s restricted backups for up to 30 further days. Any private exports must follow the same request deadline and withdrawals. Email delivery logs are configured for one month, with deletion taking up to a further day; message previews are disabled. Your own inbox copy is under your control.
Email-update retention
Unconfirmed email-update choices expire after 30 days. Confirmed permission lasts for 24 months from confirmation, unless you unsubscribe sooner. After expiry, scheduled cleanup removes the name and email from that marketing record and retains only the minimum suppression and consent evidence needed to respect the choice. We use this limited evidence for our legitimate interest in preventing unwanted mail and demonstrating how permission was obtained, and review it while we operate email updates. A later book request does not silently renew permission. These are our retention periods, separate from the 180-day book-request period; restricted recovery backups may retain earlier copies for up to 30 further days.
For families
We do not request children’s names, dates of birth, photographs, schools or uploads. Activities are available without signing up. Book requests and optional email updates are intended for adults; the adult checkbox is not identity or age verification.
Services that help us
Cloudflare hosts the website, protects it and stores requests, consent records and optional aggregate measurement. Brevo delivers request confirmations and email updates, receiving the recipient address, name when provided, message content and private management links needed for the email. Messages to our contact address are routed by Cloudflare to an owner-controlled Gmail inbox. These providers may process data outside the UK using applicable data-transfer safeguards. We do not sell your information. No advertising pixels or third-party video embeds run on this site.
Optional website measurement
Only if you allow it, we count public page views, accepted book requests, signup requests and explicit email confirmations by broad source and selected campaign labels. This helps us improve the website and assess tagged advertising links. We rely on your consent. Reports contain daily totals, not names, emails, IP addresses, private links, full referral URLs or advertising click identifiers. For an opted-in signup, we temporarily keep these source categories against a one-way consent-event hash for up to 30 days, so a later email confirmation can be attributed to its original source. That confirmation is counted only if measurement is also allowed then; the temporary categories are removed when it is processed. We retain daily totals for 90 days and one-way action hashes for up to 365 days to prevent duplicate counts. No visitor identifier is stored in the reporting database or shared with advertising platforms. Privacy & storage in the footer lets you stop future measurement and clear that browser session’s data. Existing aggregate totals cannot be linked back to you.
Confirmation emails
Your confirmation includes the books you requested and a private link to view or withdraw the request. If you ticked the optional updates box, it also includes a separate email-preferences link. Opening that link alone does not confirm marketing: you must press the confirmation button. Cover images load from our website. We decline individual open and click tracking in our email settings, although Brevo may still record anonymised opening, click and delivery diagnostics.
Security and correspondence
We use limited technical information, including short-lived rate limits derived from network addresses, to protect the form against abuse. This supports our legitimate interest in running a secure service. We use correspondence to answer your questions and handle requests about your information, and remove it when no longer needed. Children should ask a grown-up to contact us.
Your choices and rights
You can withdraw your permission through your private request link or by emailing us. You can also ask to access or correct your personal information, request deletion or restriction, and exercise applicable portability or objection rights. We may need to check that the request is yours. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.
If you buy a book later
No-payment requests are not sales records. If paid orders open, the privacy notice will explain the payment service and the retention of order and accounting information. Records that must be retained for tax, accounting or a specific legal obligation will be kept separately for the applicable period; the 180-day request cleanup does not delete them.