Privacy policy

Who we are

The controller of your personal data is Antoine Magaud, Naxxar Gardens, Triq Il-Markiz Censu Depiro, Naxxar, Malta ("bibalerts", "we"). Contact: hello@bibalerts.com. Full details on the legal notice.

What we collect

• Your email address — to send alerts.
• Your event and alert choices — which events, and which kinds of alert.
• Your timezone (e.g. "Europe/London"), detected by your browser at signup — so emails show times in your local time.
• Your language (e.g. "fr"), taken from the page you signed up on — so emails and the pages they link to are in that language.
• Consent records — when you signed up and when you confirmed, to show you asked for the emails.
• A log of alerts sent to you — so we never send the same alert twice.
• Correction reports — if you use "Report a correction", your message, any link and (only if you give it) your email reach our inbox by email so we can check and reply. They aren't stored on the site.

We don't ask for your name, and we don't build profiles, sell or share your data for marketing, or use advertising trackers.

Why, and on what legal basis

We process this data to send the alerts you requested, based on your consent (GDPR Art. 6(1)(a)). We use double opt-in: nothing is sent (except the confirmation email) until you click the link. You can withdraw consent at any time with the one-click unsubscribe link in every email.

Cookies and analytics

We don't set non-essential cookies, so there's no cookie banner. We use Vercel Web Analytics, which is cookieless and counts page views without identifying you. If this ever changes, we'll ask for consent first.

Who processes your data for us

• Supabase — database hosting, in the EU. Stores subscribers, subscriptions and the alert log.
• Resend — email delivery. Processes your email address and message content to deliver emails.
• Vercel — website hosting and cookieless analytics. Processes technical data such as IP addresses in server logs.

Some of these providers are based in, or use sub-processors in, the United States. Where data leaves the EEA, transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, under each provider's data processing agreement.

How long we keep it

• Unconfirmed signups are deleted after 7 days.
• Correction reports are kept in our inbox only as long as needed to handle them, and at most 12 months.
• Confirmed subscriptions are kept until you unsubscribe or delete your data.
• When you unsubscribe from everything, we delete your email and choices within 30 days, keeping only a one-way hash of your email so we can prove the unsubscribe and never email you by mistake.

Your rights

You can access, export, correct or delete your data, restrict or object to processing, and withdraw consent at any time. Use the "Manage alerts" link in any email (or request one at /alerts) to change choices, download your data or delete everything instantly. Or email hello@bibalerts.com — we reply within one month.

You also have the right to complain to a supervisory authority. In Malta that's the Information and Data Protection Commissioner (IDPC); you can also contact the authority where you live.

Changes

If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell subscribers by email.