Privacy policy

Last updated: 12 July 2026

NightlyBundle delivers bundles of e-books to your Kindle by email. To do that we need a small amount of your data. This policy explains exactly what we hold, why, where it lives, and how to make us change or delete it. It is written to comply with the EU General Data Protection Regulation (GDPR) and equivalent laws.

Who is responsible

The data controller is NightlyBundle (operated by Tom Hanlon). For anything in this policy, email hello@nightlybundle.com, where a person reads it and replies.

What we collect, and why

• Account email and name: collected when you subscribe, used to run your subscription and send service emails (your preferences link, delivery problems, receipts). Lawful basis: performance of our contract with you.
• Send-to-Kindle address: the @kindle.com address you give us on the preferences page. Used only to deliver your books. Lawful basis: contract.
• Reading preferences: your delivery mode and any genres you pick. Used to choose your books. Lawful basis: contract.
• Delivery history: which books we sent you and when, so we never send duplicates and can fix failed deliveries. Lawful basis: contract and our legitimate interest in running a reliable service.
• Payment details: handled entirely by our store platform (Shopify) and its payment processors. We never see or store your card number.

We do not run analytics, advertising, or tracking of any kind on this website, and we never sell or share your data for marketing. Standard technical logs (such as error logs) are kept by our hosting providers for at most 30 days, with email addresses masked.

Where your data lives

Our systems run on Amazon Web Services in the United States (us-east-1); subscriptions run on Shopify. Both process data outside the EU under the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses. Those two companies are our only processors.

How long we keep it

While you're subscribed, plus up to 12 months after cancellation (so we can resolve billing questions and honour “never the same book twice” if you return). Ask us to delete sooner and we will, within 30 days.

Your rights

You can ask us at any time to: access a copy of your data, correct it, delete it, restrict or object to processing, or hand it over in a portable format. Email hello@nightlybundle.com from your account address and we'll act within 30 days. You also have the right to complain to your supervisory authority; in Ireland, the Data Protection Commission (dataprotection.ie).

Changes

If this policy changes in a way that matters, we'll email you before it takes effect.