Privacy Policy
We are a two-person picture-book press, not an advertising company. This page explains exactly what we collect, why, and how to make us stop.
Who we are
The controller of your personal data is Catherine Stephenson, trading as Wooden House Books. You can reach us any time at [email protected].
This policy covers woodenhousebooks.com, librosdelvencejo.com, our landing pages and free printables, and the email we send from either imprint.
Our two imprints
We publish under two names. Wooden House Books is the press. Libros del Vencejo is an imprint of Wooden House Books — the same business, the same legal entity, the same contact database.
That matters for one practical reason: if you subscribe through either name, you may hear from both. New books, free printables and reading ideas can come from either imprint. Because both are the same company, nothing is transferred to a separate organization when that happens — there is no sharing, no sale, and no third party involved. One unsubscribe removes you from both.
What we collect
When you join our mailing list
Your email address, your first name if the form asked for one, and the record of your confirmation — the date, time and IP address of your double opt-in click. We keep that record because we have to be able to prove you asked to hear from us.
When you open our email
Brevo records whether the message was opened and which links were clicked, so we can tell which emails were worth sending. Many mail apps now pre-load images automatically, so these numbers are approximate.
When you browse the site
Strictly necessary cookies keep the site working and remember your cookie choice. Nothing else runs unless you accept it. If you accept analytics cookies, Google Analytics records which pages you visited, roughly where you are, and what kind of device you used. If you accept marketing cookies, advertising tags may measure whether an ad led you here.
When you email us
We keep your message and address so we can reply and follow up. Ordinary correspondence, nothing more.
What we never collect
Payment details. We do not sell books on this site. Every purchase link goes to Amazon, where the transaction is theirs and the card data never touches us.
Why we use it, and on what legal basis
| What we do | Legal basis (UK / EU GDPR) |
|---|---|
| Send you the newsletter and your free printables | Your consent (art. 6(1)(a)) |
| Keep proof that you consented | Legal obligation (art. 6(1)(c)) |
| Measure opens and clicks to improve what we send | Our legitimate interest in running a mailing list competently (art. 6(1)(f)) |
| Analytics and advertising cookies | Your consent (art. 6(1)(a)) |
| Reply to your email | Our legitimate interest in answering people who write to us (art. 6(1)(f)) |
| Keep server logs and block abuse | Our legitimate interest in keeping the site up and secure (art. 6(1)(f)) |
Who else processes your data
We do not sell your personal data, and we do not share it with third parties for their own marketing. We do rely on a handful of service providers who process data on our instructions, under contract, and for no other purpose:
| Provider | Where | What they do for us |
|---|---|---|
| Brevo (Sendinblue SAS) | France — EU | Runs our mailing list and sends our email. Stores your email address, first name if you gave one, your double opt-in confirmation, and whether you opened or clicked an email. |
| Google Ireland Ltd. / Google LLC | Ireland and the United States | Google Tag Manager and Google Analytics, loaded only if you accept analytics cookies. Google Fonts serves the typefaces on some of our pages, which means Google receives the IP address of your request. |
| Meta Platforms Ireland Ltd. | Ireland and the United States | Advertising measurement, loaded only if you accept marketing cookies. If you never accept them, no Meta tag runs on your visit. |
| Hostinger | United States | Serves woodenhousebooks.com and librosdelvencejo.com and keeps standard server logs, including IP addresses, for security and troubleshooting. |
We would also disclose data if a law, a court or a regulator required it — and we would tell you unless we were legally barred from doing so.
Data leaving Europe
Some of these providers are based in, or store data in, the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, and where the provider is certified, on the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply.
How long we keep it
- Mailing list: until you unsubscribe, plus a suppression record kept indefinitely so we never email you again by accident.
- Consent records: for as long as you are subscribed, and for three years afterwards as evidence.
- Email engagement: rolling 24 months.
- Analytics: 14 months in Google Analytics.
- Emails you send us: up to three years after our last exchange.
- Server logs: as retained by our host, typically a few weeks.
If you have been on the list for two years without ever opening an email, we delete you rather than keep sending. It is better for you and better for our deliverability.
Cookies and your choices
The first time you visit we ask before loading anything optional. Until you choose, analytics and advertising storage are denied by default through Google Consent Mode. Your choice is stored in your own browser under whb_consent_v1 and is never sent to us as a profile.
- Strictly necessary — always on. Makes pages work and remembers your cookie decision. No consent required.
- Analytics — off until you allow it. Google Analytics via Google Tag Manager.
- Marketing — off until you allow it. Advertising measurement tags.
You can change your mind whenever you like: use Cookie settings in the footer of any page. Your browser's own controls will also clear or block cookies, and we honor Global Privacy Control signals where your browser sends one.
Your rights
If you are in the UK or the EEA, the GDPR gives you the following rights. We apply them to everyone who writes to us, wherever you live, because maintaining two standards is more work than simply behaving well.
- Access
- Ask what personal data we hold about you and get a copy.
- Rectification
- Have anything inaccurate corrected.
- Erasure
- Ask us to delete your data. If you unsubscribe we keep only the minimum record needed to honor that choice.
- Restriction
- Ask us to pause processing while a dispute is resolved.
- Portability
- Receive the data you gave us in a machine-readable file.
- Objection
- Object to processing based on our legitimate interests.
- Withdraw consent
- Unsubscribe or change your cookie choices at any time. This does not affect anything done before you withdrew.
Email [email protected] and we will respond within one month. We do not charge for this, and we will not ask you why.
If we get it wrong, you can complain to your local supervisory authority. In Spain that is the Agencia Española de Protección de Datos; in the UK, the Information Commissioner's Office. We would rather you told us first, but it is your right either way.
If you are in California
You may request the categories and specific pieces of personal information we hold, ask us to delete or correct it, and opt out of "sale" or "sharing." We do not sell personal information and never have. If you enable marketing cookies, advertising partners may receive identifiers in a way that California law can treat as "sharing" for cross-context behavioral advertising — turning that category off in Cookie settings is your opt-out. We will not discriminate against you for exercising any of these rights.
Children
We make books for children, but this website is written for the grown-ups who buy them. Our site and mailing list are intended for adults only, and we do not knowingly collect personal data from children — under 13 in the United States, under 16 in the EEA and the UK, or the relevant age wherever you live.
We never send email to a child, and we never ask you for a child's name, age, school or photograph. If you believe a child has given us their details, write to [email protected] and we will delete the record promptly.
Links to Amazon and other sites
Our book links go to Amazon, sometimes through a tracking link that tells us an email or an ad led to a visit. Once you land on Amazon you are on their property, under their privacy policy, and we receive only aggregate counts — never your name, your address or what else you bought.
The same goes for any other site we link to. We cannot be responsible for how they behave.
How we protect it
Both sites are served over HTTPS. Access to our mailing list is limited to the two people who run the press, over accounts protected by two-factor authentication. No system is perfect; if a breach ever put your rights at risk, we would notify the supervisory authority within 72 hours and tell you directly.
Changes to this policy
If we change how we handle your data we will update this page and move the date at the top. For anything material — a new purpose, a new category of recipient — we will email subscribers before it takes effect, not after.