Privacy policy

Effective 15 October 2026

This policy explains what personal data Tehilla Books (tehillabooks.com) processes, why, for how long, and what rights you have. We keep it as short as we can and collect only what we need to sell and deliver e-books, publish devotionals and answer you.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Tehilla Ministry Books
287C Faulks Road Ariaria Aba
Email: info@tehillabooks.com
Phone: +234(0)8142243075

For any question about your data, write to info@tehillabooks.com.

2. What we process and why

Your account

Name, email address, password (stored only as a secure hash), and what you choose to add: profile picture, preferred reading language, country, time zone, two-step verification. We need this to run your account and your library (Art. 6(1)(b) GDPR, contract). New accounts may be checked by our team before they are opened, to keep out spam and misuse (Art. 6(1)(f), legitimate interest).

Orders and payments

The books you order, prices, currency, coupon, billing country, the payment method, the payment provider's transaction reference and the status of the payment. Card and account details are entered on the payment provider's page and never reach our server. For bank transfers we see the payment on our bank statement. Legal basis: the contract (Art. 6(1)(b)) and our duty to keep accounting records (Art. 6(1)(c)).

Your library and reading

Which books you own, downloads (date, time and IP address, to enforce the download limit and stop abuse), your reading position, bookmarks, wishlist, reading lists, followed authors and download requests for free books. Books you save for offline reading are stored in your own browser on your device, not by us; they are removed when you sign out. Basis: the contract (Art. 6(1)(b)); the download log also our legitimate interest in protecting the authors' work (Art. 6(1)(f)).

Devotionals and prayer requests

If you are signed in, we note which devotionals you have read so you can see your progress. If you send a prayer request, it goes only to our prayer team and is never published. A prayer request can reveal your faith or your health; we process it only with your explicit consent, which you give by sending it (Art. 9(2)(a) GDPR). You may leave out your name. Prayer requests are deleted after 365 days (spam after 30 days), or earlier if you ask.

Support, contact form and reviews

What you write to us, attachments you add, and our answers, to handle your request (Art. 6(1)(b) or (f)). Reviews you publish show your display name.

The website assistant

If you use the AI assistant, your questions and its answers are processed by our AI provider to produce the answer, and kept with your account so you can see the conversation (Art. 6(1)(b) and (f)). Please do not type sensitive personal information into it.

Security and technical data

When you visit the website, the server processes your IP address, browser and the pages requested, to deliver the website and protect it. Sign-in attempts and important actions are logged to detect attacks (Art. 6(1)(f)). Server logs are kept for a short time and then deleted.

Partners (affiliates)

If you join the partner programme, we also process the details needed to pay your commission (Art. 6(1)(b) and (c)).

3. Cookies and storage in your browser

We use only what the website needs to work. No advertising or tracking cookies, no third-party analytics.

• Session cookie and security token: keep you signed in and protect forms; deleted when you close the browser or sign out.
• Language choice (cookies me_dev_lang and me_legal_lang, one year): remember the language you chose for devotionals, the blog, the FAQ and these legal pages.
• Light or dark mode and offline books: stored in your browser's local storage only, never sent to us.

These are strictly necessary or set at your request, so no consent banner is needed (section 165(3) TKG 2021, section 25(2) TTDSG / TDDDG).

4. Who receives your data

We use service providers who process data on our behalf under a data processing agreement (Art. 28 GDPR):

• our web hosting provider (servers, backups) and our email provider (account and order emails);
• the payment provider you choose at checkout, for example Stripe, PayPal or Paystack, who processes your payment as its own controller under its privacy policy; our bank for transfers;
• our AI provider, only if you use the assistant.

We do not sell your data or give it to anyone for advertising. We pass data to authorities only where the law requires it.

Transfers outside the EU

Some providers (for example payment providers) process data in the USA or other countries. We use them only where the transfer is protected: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or the Commission's standard contractual clauses (Art. 45 and 46 GDPR).

5. How long we keep data

• Account, library and reading data: as long as your account exists. When you delete your account (Account → Privacy & data), it is erased after a waiting period of 14 days, in which you can change your mind.
• Orders, receipts and payment records: as long as tax and commercial law requires (in Austria 7 years, section 132 BAO; in Germany up to 10 years). They are kept without your name where possible.
• Prayer requests: 365 days (spam 30 days).
• Download log and security logs: as long as needed to protect the shop, usually not longer than 12 months.

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw a consent at any time with effect for the future. You can download a copy of your data and delete your account yourself under Account → Privacy & data, or write to info@tehillabooks.com.

You may complain to a supervisory authority. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at. You can also contact the authority in your own country (in Germany the data protection authority of your federal state; in the UK the Information Commissioner's Office; in Nigeria the Nigeria Data Protection Commission).

7. Children

The shop is meant for adults. If you are younger than 16 (14 in Austria), please ask a parent or guardian to create the account and make purchases.

8. Security

We use encrypted connections (HTTPS), store passwords only as secure hashes, encrypt saved keys, offer two-step verification, limit access for our staff to what their role needs and keep a record of important actions.

9. Changes

We update this policy when the website or the law changes. The date at the top shows the current version; for important changes we inform account holders by email.