Privacy
Privacy policy
What this website collects, why it collects it, how long it is kept and how to make us delete it. Last updated: September 4, 2026.
Who is responsible for your data
BookClubRoster is published by MLJ, SASU, a French company registered in Paris under SIREN 934 769 837. MLJ, SASU decides why and how the personal data described in this policy is handled, which makes it the data controller in the language of the European General Data Protection Regulation and the business in the language of United States state privacy laws. The publication director, Jimenez Julien, answers privacy requests personally at jimenezjulien42@gmail.com.
What the request form collects
The only form on this website is the request form in the contact section of the home page. When you send it, we receive exactly these fields: name, email, company, role, request, size, message and consent. Two hidden fields travel with the submission for routing purposes, subject and recipient, and a honeypot field named bot-field exists to catch automated spam. We do not ask for a postal address, a phone number, a payment card or any information about the members of your club.
You choose what to write in the message field. Please do not paste the names, email addresses or reading records of your members into it. If you need to show us a real member list during a walkthrough, we will look at it together in a call rather than have you send it by email.
Why we may hold it, and on what legal basis
We use your submission for one purpose: to answer your request and, if you become a customer, to set up your club or your reading program. Under the GDPR the legal basis is your consent, given by ticking the consent box, together with steps taken at your request before entering into a contract. Under United States state privacy laws this is a business purpose, specifically providing a service you asked for. We never use these submissions to build an advertising audience, and we never sell or share them for cross context behavioral advertising. We do not sell personal information, and we have not sold or shared it in the previous twelve months.
How long submissions are kept
If you do not become a customer, your submission is deleted twenty four months after our last exchange. If you do, your contact details move into the customer record and are kept for the life of the account plus the periods that French accounting law requires for invoices. You may ask for deletion earlier at any time and we will act on it, keeping only what a legal obligation forces us to keep.
Who processes the data with us
Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, United States, hosts this website and operates Netlify Forms, which receives, stores and forwards your submission. Netlify acts as our processor under a data processing agreement and does not use your submission for its own purposes. Email replies are handled through a standard business mailbox. No other company receives your submission, and no data broker, advertising network or enrichment service is involved at any point.
Cookies and measurement
This website sets no advertising cookie, no third party analytics cookie and no cross site tracking pixel. There is no Google Analytics tag, no advertising platform tag and no social media tracker on any page you can reach here. Netlify records standard server logs, including the IP address making the request, for security and abuse prevention, and those logs are short lived. Because nothing here tracks you, there is no consent banner to dismiss and no preference to opt out of.
Your rights in the United States
Residents of California have the right under the California Consumer Privacy Act, as amended, to know what personal information we hold, to receive a copy of it, to have it corrected, to have it deleted, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights. Residents of Colorado, Connecticut, Utah and Virginia have comparable rights of access, correction, deletion and portability under their own state privacy acts, along with a right to opt out of targeted advertising and profiling, which is already the default here because we do neither.
You may exercise any of these rights, including through an authorized agent, by writing to jimenezjulien42@gmail.com with enough detail for us to find your record. We answer within forty five days and will tell you if we need to extend that period. If we decline a request, we explain why and how to appeal, and a Colorado, Connecticut or Virginia resident may appeal directly to the same address and receive a written decision.
Your rights under the GDPR
If you are in the European Economic Area or the United Kingdom you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability in a machine readable format, and you may object to processing based on our legitimate interests. Where processing rests on consent, you may withdraw that consent at any time without affecting what happened before. You also have the right to lodge a complaint with your supervisory authority, which in France is the Commission Nationale de l'Informatique et des Libertes.
International transfers
MLJ, SASU is established in France and the hosting and form processing take place on infrastructure operated by a company established in the United States. Transfers of personal data outside the European Economic Area rely on the European Commission standard contractual clauses concluded with our processor, together with technical measures including encryption in transit. If you are in the United States your data may equally be handled by staff in France, which we mention so nothing about the route is a surprise.
Security
Traffic to this website is encrypted with HTTPS. Form submissions are stored in an access controlled dashboard, and access is limited to the publication director. We apply security headers on every page, including a strict referrer policy and a permissions policy that denies camera, microphone and geolocation access. No system is perfect, so if we ever discover a breach affecting your data we will tell you and the relevant authority within the deadlines the law sets.
Children's privacy
BookClubRoster is a tool for adults who run reading groups and library programs, and this website is not directed to children. We do not knowingly collect personal information from anyone under sixteen years old through this site. If a library runs a teen reading circle, the coordinator remains responsible for what she records about minors in her own account and should collect only what her institution's policy allows. If you believe a child has sent us information through this form, write to jimenezjulien42@gmail.com and we will delete it promptly.
Changes to this policy
When this policy changes we update the date at the top of the page and keep the previous version on file. If a change materially affects how we handle a submission you already sent, we will contact you at the email address you gave us before the change takes effect. Continuing to use this website after an update means the current version applies to you.
How to contact us
Write to jimenezjulien42@gmail.com for any privacy question, request or complaint, or by post to MLJ, SASU, at the registered office recorded in the legal notice. Requests are handled by a person, not a ticket system, and you will get a written answer.