What we hold, and why.

The form that sends you the first week is protected by Cloudflare Turnstile, because otherwise robots fill it in all day, and every invented address they leave behind makes it a little more likely that a real email of ours lands in somebody’s spam folder.

It runs only on the two pages that carry that form, and it is the only thing on this entire website that contacts a company other than the one hosting it. It sets no cookie. It looks at the request itself, decides whether it came from a person, and almost always decides silently. If it ever wants something from you, a small box appears and asks; most people will never see one.

We do count how many people arrive and which pages they read, because a small publisher that cannot see which page loses people cannot fix it. The counting is done by Vercel Web Analytics, which is part of the company that hosts the site.

It sets no cookie. A visitor is a number worked out from the request itself, and that number is thrown away after twenty four hours, so there is nothing that can follow you from one day to the next or from here to anywhere else.

What is recorded with each page view is the time, the address of the page, the site you came from if you followed a link, roughly where in the world the request came from, and which browser and kind of device you used. That is the whole list. It arrives as a count rather than as a person, and there is nothing in it we could use to work out who you are, even if we wanted to.

One thing is deliberately taken out before it is sent. When you buy, the page you land on carries the reference number of your order in its address. That reference is stripped out on the way, so the visit is counted as an ordinary page view and the number stays between you and us.

For a limited period we also record how the pages are used: where people scroll, what they tap, and where they stop. The recording is made by PostHog, on servers in the European Union, and it is the only way a small publisher can find out why a page that a hundred people read is one that nobody acts on.

It sets no cookie and writes nothing to your machine, so it cannot recognise you if you come back tomorrow. Anything you type is blanked out before it leaves your browser: the recording shows that a field was filled in, never what was written in it. It cannot see other tabs or other websites. We keep these recordings for thirty days and switch the recording off once it has answered the question, and this page will say so when it has.

Habeeya is a trading name of Geokits Limited, registered in England and Wales, company number 16306007. Registered office: Office 9650, 321-323 High Road, Chadwell Heath, Romford, Essex, England, RM6 6AX.

For anything to do with your data, write to salam@habeeya.com.

We hold your email address, the date you gave it, and which page you gave it on. The lawful basis is your consent, given when you typed the address into the form. There is no confirmation email to click, because the files are the point and they arrive at once. The line under that form says plainly that asking for the first week also starts the series, and that line is the whole of what you agreed to.

The list is held by Brevo, which sends the emails on our behalf. Every email carries an unsubscribe link that works in one click, and unsubscribing removes you from every list we hold.

We keep the address until you unsubscribe or ask for it to be deleted. If you have not opened anything from us in two years, we delete it without being asked.

Card payments are processed by Stripe, which holds your name, your email address, your billing country and the details of the transaction. We see the order and the email address. We never see your card number and it is never stored on this website. The files you download carry your email address printed inside them, so that each copy is personal to you.

The lawful basis is the contract between us. Records of a sale are kept for as long as tax law requires, which in the United Kingdom is six years, and we cannot delete those earlier even if you ask, although we can remove you from every list at once.

When we run an advert on Instagram or Facebook, Meta adds an identifier to the link you follow. If you then claim the free week or buy a term, our own server tells Meta that it happened, so that we can tell which advert paid for itself and stop the ones that did not. We would rather do that than guess and keep spending.

What is sent is your email address turned into a hash, which is a fixed length string of letters and numbers. Meta compares it against a hash of an address it already holds, and that is how a match is made, but the address itself never travels. Alongside it goes the identifier from the link you followed and, for a purchase, the amount and the currency. Your name, your postal address, and what you read while you were here are not sent.

All of this happens on our server after the fact. No pixel runs in your browser, nothing is stored on your machine, and the identifier is read from the address bar at the moment you submit and then forgotten. If you did not arrive from an advert, there is no identifier and only the hashed address is sent.

Meta decides for itself what it does with this, so for that part it is a controller in its own right and not merely our processor. If you would rather we sent nothing at all about you, write to salam@habeeya.com and we will exclude your address.

Your email address is shared with Brevo so that emails can be sent to you, your order details with Stripe so that the payment works, and, if you came from one of our adverts, a hash of your address with Meta as described above. It is not sold, rented, or passed to anybody else for any purpose. These providers may process data outside the United Kingdom under the safeguards their own agreements require.

The site itself is hosted by Vercel, which means every page you open passes through their servers and is logged there the way any web request is logged. When you ask for the free week we also hold your network address in memory for one minute, and only so that the same address cannot ask five hundred times in a row. It is written nowhere and it is gone a minute later.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop using it, or object to how it is used. Write to salam@habeeya.com and we will act within a few days.

If you are not satisfied with how we have handled something, you can complain to the Information Commissioner’s Office at ico.org.uk.

These books are for children, but this website is for their parents. We do not knowingly collect anything from a child, and nothing on this site asks a child for information.

This page was last changed on 4 September 2026. If it changes in a way that affects you, we will say so rather than leaving you to notice.