Privacy policy

Last updated: October 13, 2026

This site, ivymaya.com, exists so that anyone can read Ivy Maya’s books. It was built to collect as little as possible about you. This page explains, in plain language, the little that is collected, why, and what you can do about it.

Who is responsible#

The person responsible for the data processed on this site is the author of the books, who writes under the pseudonym Ivy Maya. There is no company behind the site.

For any matter, including privacy, please use the contact form and leave an email address for the reply.

What we collect#

Reading the book requires no sign-up: there are no accounts and no advertising. Only with your permission, given in the cookie notice, does the site use Google Analytics to measure its audience (see "Cookies and Google Analytics" below); without it, no analytics cookie is set.

Data is only collected if you choose to write — in the guestbook or through the contact form — or if you ask for the book by email.

If you write in the guestbook, we store:

  • the name or nickname you write;
  • your email address, which is never published;
  • your city or country, if you choose to share it;
  • your message;
  • the language of the page you wrote from;
  • the book whose guestbook you wrote in (each book has a single guestbook, shared by all languages);
  • the date it was sent.

If you write through the contact form, we store:

  • the name or nickname you write;
  • your email address, for the reply;
  • your message;
  • the language of the page you wrote from;
  • the date it was sent.

If you ask for the book by email (with the download buttons for the PDF, EPUB or DOCX editions, on the book page and in the table of contents available on every chapter), we use:

  • your email address, only to send the file you asked for;
  • the format you chose and the language of the page, to know which edition to send.

That email address is not stored on this site: it is not saved in any database and is used only for that one sending. Of the request, we keep only a record without the email address: the date, the format, the language, the IP address and the browser.

The guestbook requires an email address, but it is not shown on the site; on the contact form it is also required, and used only for the reply.

In all three cases (guestbook, contact and book request), we also store the IP address and the browser (the user agent, which identifies the program and system used) the request was sent from.

Each of the three forms has an optional, unticked box to receive news from Ivy Maya by email. If you tick it, your email address (and your name, if you gave one) is added to the news list, stored with Resend.

What we use it for#

Each form has a single purpose:

  • Guestbook: publishing your message in the guestbook, after it has been read by the site’s moderator. Your email address is only seen in moderation and is used only to reach you about that message, if needed (for example, to confirm a removal request); it is not published, gets no other mailings (unless you sign up for the news list), and is never shared with anyone.
  • Contact form: letting the author read your message and reply to it. Contact messages are private: they are never published, never used for other mailings (unless you sign up for the news list), and never shared with anyone. If there is a reply, it is sent from the author’s own mailbox, and the conversation continues by email.
  • Book by email: sending you, once, the edition you asked for, as an attachment, in the language of the page. Your email address is used for nothing else — it is only added to the news list if you tick the box —, and the email itself says that, without that sign-up, nothing else will be sent.
  • IP address and browser: security — spotting and stopping abuse, spam and automated submissions. They are only seen in moderation, never published and never shared.
  • News list: sending, now and then, news about new books and letters to those who signed up. Every news email has a link to unsubscribe.

Nothing is used for advertising, profiling or any other purpose, and nothing is sold.

Please remember that, once approved, a guestbook message is public and visible to anyone. So please don’t write sensitive information (about health, religion, sexual orientation, ID documents, home address, etc.), whether about yourself or about anyone else.

For the guestbook and the contact form, processing is based on your consent, which you give by ticking the agreement box before sending (Article 6(1)(a) of the EU GDPR and the UK GDPR; Article 7, I, of Brazil’s LGPD). You can withdraw your consent at any time, free of charge; this does not affect anything done before you withdrew it.

For the book by email, processing serves to carry out your own request: sending the file you asked for (Article 6(1)(b) of the EU GDPR and the UK GDPR, steps taken at the request of the data subject; Article 7, V, of Brazil’s LGPD). Without an email address, the file cannot be sent.

Recording the IP address and browser is based on the legitimate interest in protecting the site and its forms against abuse (Article 6(1)(f) of the EU GDPR and the UK GDPR; Article 7, IX, of Brazil’s LGPD). Signing up for the news list is based on your consent, given by ticking the optional box, and you can unsubscribe at any time.

How long we keep it#

In the guestbook:

  • Approved messages are kept for as long as they are published, and deleted whenever you ask.
  • Messages rejected in moderation are permanently deleted — they are not archived.
  • Messages awaiting moderation are kept only until they have been read.
  • Your email address is stored with the message and deleted along with it.

On the contact form, your message (with your email address) is deleted once the conversation is over and, in any case, no later than 12 months after it was sent. You can also ask for it to be deleted sooner.

For the book by email, the site does not keep your email address: it is used only for that one sending. Resend, which sends the email, keeps technical records of it (recipient, date and delivery status) for a limited period, under its own retention rules.

The IP address and browser are erased 12 months after sending (sooner, if the message is deleted), and the book request record is also deleted after 12 months.

On the news list, your email address is kept until you unsubscribe (with the link in any news email or through the contact form).

Who else is involved#

For the site to work, a few service providers process data on the author’s behalf, each only for its own function:

  • Vercel (website hosting). Like any web server, Vercel’s infrastructure processes technical data about each request — such as the IP address and browser type — in server logs used for security and operation. These logs belong to the hosting infrastructure; the site does not use them to identify anyone. The site also uses Vercel Speed Insights to measure how fast its pages load: it records loading metrics with technical data (page visited, device type, browser, operating system and country), without cookies and without identifying visitors.
  • Neon (the database where guestbook and contact form messages, and the book request records, are stored).
  • Resend (email delivery, resend.com, United States). When you ask for the book by email, Resend receives your email address and the file in order to deliver the message. As a processor, it keeps technical records of the sending (recipient, date and delivery status) for a limited period, under its own retention rules. If you sign up for the news list, Resend also stores your email address (and your name, if given) as a contact on the list.
  • Google reCAPTCHA (bot protection on the guestbook, contact and book-by-email forms). To tell people apart from automated programs, Google’s reCAPTCHA collects your IP address, browser and device data and how you interact with the page, and may use cookies for that check; its use is subject to Google’s Privacy Policy and Terms of Service. It is only loaded on the guestbook and contact pages and, on the book’s pages, when you open the request form.

These providers may process data outside your country, notably in the United States. In those cases, the international transfer relies on the standard contractual clauses and other safeguards adopted by these providers.

The site’s fonts are served by the site itself; your browser does not connect to third-party font services.

Cookies and Google Analytics#

The site only sets analytics cookies with your permission. On your first visit, a notice asks whether you accept Google Analytics (Google LLC, United States), used to understand how the books and letters are read: pages visited, time on page, where the visit came from, device type, browser and approximate location.

  • If you accept, Google Analytics sets the _ga and _ga_<id> cookies, which last up to 2 years.
  • If you decline, or until you choose, no analytics cookie is set. Google receives only cookieless signals without identifiers (Google's "consent mode"), and advertising signals are always off.
  • You can change your mind at any time with the Cookies link in the footer. Declining deletes the Google Analytics cookies.

Your choice is stored in your browser (localStorage), not in a cookie. This processing is based on your consent (Article 6(1)(a) of the EU GDPR and the UK GDPR; Article 7, I, of Brazil’s LGPD). Google Analytics data is kept for the period set in the site’s account, at most 14 months.

Your rights#

Depending on the law that applies where you live, you can:

  • find out whether we hold data about you and access it;
  • correct anything that is wrong;
  • ask for your message (in the guestbook or sent through the contact form) to be deleted;
  • withdraw your consent at any time;
  • receive your data in a portable format;
  • object to the processing;
  • lodge a complaint with a data protection authority — in Brazil, the ANPD; in the European Union or the United Kingdom, the data protection authority of your country.

If you did not sign up for the news list, since the email address used to ask for the book is not stored on the site, there is no record of it here to access or delete; the technical sending records stay with Resend, for the period set by its rules.

California residents (CCPA/CPRA): we do not sell or share personal information, including for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.

How to exercise your rights#

Write through the contact form, leaving an email address for the reply. To help us find your message, please tell us whether it was sent through the guestbook or the contact form, the name you used, the approximate date, a short excerpt and the email address you gave. We reply as soon as possible, within the time required by applicable law and, in any case, within 30 days.

Children#

The guestbook and the contact form are not intended for people under 16. If you are under 16, please do not send a message. If we learn that a message was sent by someone under that age, it will be deleted.

Changes to this policy#

If this policy changes, the new version will be published on this page with an updated date. Significant changes will not apply to messages already sent without fresh consent where consent is required.