Privacy Policy

What data we collect

Depending on how you use BookBridge, we may collect:

• Account details — your username, email address, preferred language, and a securely hashed password (we never see or store your password in plain text).
• Optional profile details you choose to add — for example your full name or city.
• School details (for school and partner-location managers) — school name, type, region, city, address, optional map coordinates, a contact email, opening hours, and any photo you upload.
• Donation records — the beneficiary school, the books you pledge, the delivery method, the partner location (if any), an optional delivery address you provide for handover, notes, and the delivery status over time.
• Notifications — a log of the status emails and in-app messages we send you about your donations.
• Contact messages — anything you send us by email or through a form.
• Limited technical data — security tokens that keep you signed in and protect forms, plus basic request information our hosting and security providers process to deliver and protect the site.

Why we collect it

We use your data only to operate the book-donation service:

• To create, secure, and manage your account.
• To record your donations and route them to the right school, through a partner location where applicable.
• To let a receiving school see confirmed incoming donations and confirm receipt, and to let a partner location manage books it forwards.
• To arrange in-person or courier handover when you provide a delivery address.
• To send you service (transactional) email and in-app notifications — sign-in codes, password resets, and donation status updates.
• To respond to your questions and support requests.
• To keep BookBridge secure, prevent abuse, and meet our legal obligations.

Legal basis for processing

We rely on one or more of the following legal bases:

• Performance of a service you requested — e.g. creating your account and processing a donation you started.
• Your consent — e.g. when you provide a delivery address for handover, or upload a school photo. You can withdraw consent at any time.
• Our legitimate interests — running a safe, working platform, including security and abuse prevention, balanced against your rights.
• Compliance with legal obligations — e.g. retaining certain records where the law requires it.

Where your data is stored and how we protect it

Your data is stored in our managed database and file storage provided by Supabase (PostgreSQL, authentication, and storage), currently hosted in the Asia-Pacific region (Tokyo). Access is restricted to BookBridge administrators and the processors listed below, and is protected by authentication, role-based and row-level access controls, encryption in transit (HTTPS/TLS), and least-privilege server-side access. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data, and we will notify you and the competent authority of a personal-data breach where the law requires.

Who we share it with

We do not sell your personal data and we do not use it for advertising. We share it only with service providers (processors) that help us run BookBridge, each only to the extent needed:

• Supabase — database, authentication, and file storage.
• Maileroo — to send transactional email (sign-in codes, password resets, donation updates).
• Vercel — website and API hosting.
• Cloudflare — DNS, content delivery, and security.
• OpenStreetMap — map tiles, when you view a school on a map.

These providers process data on our behalf under their own security and privacy terms. Some are located outside Georgia and the EEA (for example in the United States or Japan), so your data may be transferred internationally; where required, such transfers rely on appropriate safeguards such as standard contractual clauses. We may also disclose data if required by law or to protect the rights and safety of users.

How long we keep it

We keep your account and profile data while your account is active. Donation and delivery records are kept while your account is active and for up to 2 years afterwards for legitimate record-keeping, then deleted or anonymized, unless a longer period is required by law. Notification and security logs are kept for a short period for troubleshooting and abuse prevention. When you delete your account (see “Your rights”), we remove your personal data except records we are legally required to retain.

Your rights and choices

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or out of date (you can edit much of it yourself in your account).
• Erasure — delete your account and personal data. You can do this yourself at any time from your account settings (“Delete account”), or by emailing us; we erase your data except records we must keep by law.
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive your data in a portable format where applicable.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.

You can exercise most rights directly in your account. We may need to verify your identity first, and we will respond within the timeframe required by law. You also have the right to lodge a complaint with the supervisory authority — in Georgia, the Personal Data Protection Service (personaldata.ge) — or your local data-protection authority.

Children’s privacy

BookBridge serves schools and the children who learn there, but accounts are intended for adults — donors, school staff, and volunteers. You must be at least 16 (or the age of digital consent in your country), or have the consent and supervision of a parent or guardian, to create an account, donate, or arrange a handover. We do not knowingly collect personal data directly from children. If you believe a child has provided us personal data without appropriate consent, contact us and we will delete it.