Privacy Notice
Version: 2026-07-04
Overview
This Privacy Notice explains how personal data is collected, used and stored in connection with The Virgin Criterion website, EPUB purchases and delivery, product support, the optional email signup, analytics and cookies.
The Virgin Criterion operates publicly through the publishing imprint Eldorado Publications. Privacy questions and requests can be sent to thevirgincriterion@gmail.com.
Ebook purchases and delivery
Who controls fulfilment data
The Virgin Criterion, operating publicly through the publishing imprint Eldorado Publications, controls the personal data used to fulfil the EPUB order, operate secure delivery, provide product support and keep necessary business records. Contact: thevirgincriterion@gmail.com.
Stripe Managed Payments and Link
Checkout is provided through Stripe Managed Payments and shown as Sold through Link. Stripe/Link collects and uses payment, billing, transaction, tax, fraud-prevention, refund, dispute and support information under its own privacy information. Stripe shares order information needed to fulfil and support the purchase. Do not send card details or identity documents to the product-support email.
Information received and created
Purchase processing may involve your name, email address, billing country or address, order and Checkout Session identifiers, product, amount, currency, payment status, tax and receipt details, timestamps, refund or dispute status, IP or security information made available by the service, delivery-token data, secure-link request records and support communications. Full card details are not stored by this website.
Why the information is used
Order and contact information is used to verify payment, supply the EPUB, send the delivery message, operate the seven-day delivery page and secure-link controls, provide access resets and product support, prevent abuse and fraud, handle refunds and disputes, demonstrate the consent and terms accepted at checkout, and meet accounting, tax and legal obligations.
Lawful bases
Processing needed to supply and support the purchase is based on performance of the contract. Records required for tax, accounting, legal claims or regulatory compliance are based on legal obligation. Security, fraud prevention, service integrity and the defence of claims may be based on legitimate interests, balanced against customer rights. Optional marketing and non-essential analytics use consent where required.
Service providers and recipients
Data may be processed by Stripe/Link for checkout and transaction services; Vercel for website hosting; Cloudflare for the commerce Worker, D1 order records and private R2 file storage; Resend for transactional delivery email; Gmail for support correspondence; and professional advisers or public authorities where legally necessary. Airtable and n8n are used only for the separate optional email signup and do not receive buyer data automatically.
International processing
Some providers may process information outside the United Kingdom. Each provider is responsible for the safeguards described in its privacy information and contractual terms. The services used for the website and fulfilment are required to apply lawful safeguards for the data involved.
Purchase-record retention
Order, payment-status, consent-version and accounting records are kept for the period needed for tax records, disputes and legal claims—normally at least five years after the relevant Self Assessment filing deadline, and longer only where a dispute, legal duty or active support issue requires it. Delivery tokens expire after seven days. Security and secure-link request logs should be deleted or anonymised when no longer needed, normally within 12 months unless an incident or dispute requires longer retention. Support messages are kept only as long as needed for the request and any related record-keeping duty.
Purchase-related rights
Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection and data portability, and a right to complain to the Information Commissioner’s Office. Some information cannot be erased immediately where it must be retained for payment, tax, fraud, dispute or legal reasons. Contact thevirgincriterion@gmail.com to exercise a right relating to fulfilment or product support. Contact Stripe/Link directly for data controlled by Stripe/Link.
Marketing
Buying the EPUB does not subscribe you to marketing. Any book-update or essay signup remains separate, optional and based on its own consent. Transactional receipts, delivery messages and support communications are not marketing.
Optional email signup
If you join an optional email list, we may collect your email address together with records of your consent and content preferences. This may include whether you chose book updates, essays or other communications and the timestamps associated with those choices.
We may also store limited technical or campaign data associated with a signup, such as the page used for signup, referral or campaign information, and workflow metadata used to operate and audit the signup process.
We use this information to manage the optional email list, send communications you agreed to receive, maintain consent records and operate the supporting workflow. Marketing to individuals is based on consent, and you may withdraw that consent at any time.
Signup services and retention
Vercel hosts the website. Oracle Cloud Infrastructure hosts the automation-server environment, n8n routes the signup workflow, and Airtable stores and administers subscriber records. Some providers may process or store data outside the UK using the safeguards applicable to their services.
Signup and consent records are kept for as long as they are needed to manage the mailing list, preserve unsubscribe or suppression choices and demonstrate consent history. If you unsubscribe or request deletion, limited records may be retained where necessary to ensure your preference is respected.
Analytics and cookies
The website stores a small browser-side preference so that your cookie choice is remembered. Necessary storage used for checkout, security, delivery and consent preferences may operate without analytics consent where the applicable legal exception permits.
Google Analytics remains disabled until you accept analytics through the consent interface. If you accept, Google Analytics may set non-essential cookies or use similar technologies to measure site usage. If you reject or later withdraw consent, those non-essential analytics technologies must not load or continue to be used.
A visible Cookie settings control allows you to revisit and change your analytics choice.
Your rights
Depending on the data and circumstances, you may request access, correction, deletion, restriction or portability of your personal data, or object to particular uses. If you object to direct marketing, that use will stop.
You may complain to the Information Commissioner’s Office about the handling of your personal data. You may first contact the support address below so that the issue can be investigated and, where possible, resolved.
Contact and complaints
For privacy questions, rights requests or complaints, contact:
Do not send card details, passwords, identity documents or banking information by email.
Changes to this notice
This Privacy Notice may be updated when the website, fulfilment process, service providers or legal requirements change. The version date shown above will be updated when a material revision is published.