PRIVACY POLICY

Last Updated: 5/1/25

Bookshop.org, including all of its features and content and related or commonly-owned or controlled websites (“Website”), is a service made available by Bookshop, Inc. (“Bookshop.org”), a Virginia benefit corporation that provides independently owned booksellers, industry partners, and conscious consumers with a direct-to-consumer e-commerce solution competitive to that of major retailers.

Quick Guide to Contents
1. How This Privacy Policy Applies
2. What Information Bookshop.org Collects and Receives
3. How Bookshop.org Uses the Information It Collects
4. How Bookshop.org Shares the Information It Collects
5. Tracking and Other Technologies
6. Your Rights
7. Links to Other Websites and Services
8. Data Retention
9. Cross-Border Data Transfers
10. Children’s Privacy
11. Security
12. Updates to this Privacy Policy
13. Contact Us

1. How This Privacy Policy Applies


By using the Website and any SMS Service you opt into to receive messages via text (“SMS Service”), you are accepting the practices described in this Privacy Policy (including new versions of this Privacy Policy when and as they go into effect) and Bookshop.org’s Terms of Use (“Terms of Use”), which governs this Privacy Policy applies to those persons or entities who (i) purchase products on the Website or the Bookshop.org ebook apps, (ii) receive communications from Bookshop.org, (iii) sell products on the Website through Bookshop.org’s Platform Seller Program (each, a “Seller” or “Bookstore Affiliate”), and (vi) participate in Bookshop.org’s Affiliate Program (each, an “Affiliate”)(collectively (i)-(iv) above, “Users,” and each, a “User”, “you” or “your”). Capitalized words not defined in this Privacy Policy are defined in the Terms of Use. In the event of a conflict between this Privacy Policy and the terms and conditions applicable to the Platform Seller Program and the Affiliate Program, respectively, such terms and conditions applicable to the Platform Seller Program and the Affiliate Program, respectively, shall apply.

This Privacy Policy describes the information Bookshop.org collects from you through the Website and SMS Service, how Bookshop.org uses that information, and its legal basis for doing so. It also covers whether and how that information may be shared and your rights and choices regarding such information. For residents of the UK and the European Economic Area, Bookshop.org is the data controller responsible for your information.

2. What Information Bookshop.org Collects and Receives

In order for you to use the Website or the SMS Service, Bookshop.org needs to collect and process certain information, which depending on how you use the Website, may include the following.

A. Information You Provide

Bookshop.org collects information you provide by:
(i) using the Website, such as when:
• Bookstore Affiliates post Content (as such terms are defined in the Terms of Use).
• Users complete forms on or through the Website (including gift messages) or subscribe to our newsletters or emails. The information you provide may include your name, email address, mailing address, or telephone number.
• Users make a request or transaction through the Website. Bookshop.org and Bookstore Affiliates offer products for sale through the Website, and Bookshop.org and its payment processor will need to collect and use information such as your name, mailing address, billing address, email address, telephone number, and payment card information to process these requests and transactions.
• Users communicate with Bookshop.org, such as when you request support, submit comments or questions, or report a problem to Bookshop.org.

(ii) purchasing a gift order or using our “Refer-a-Friend” feature:
• When purchasing a gift order for a friend or family member, we ask for the gift recipient’s email address in order to process the gift order. You may also provide information in a gift message you complete.
• The Website also may include a “Refer-a-Friend” feature that allows you to easily forward information about Bookshop.org to friends or family. If you elect to refer a friend or family member to the Website, we will ask for that person’s email address. We also may send that friend or family member a message on your behalf. We may store this information for the purpose of sending this message and to manage and improve our “Refer-a-Friend” program. You are responsible for notifying and, where necessary, obtaining the consent of your family member or friend before providing us with their information.
• If you provide us with any personal information relating to other individuals, you represent that you have the authority to do so and acknowledge that it will be used in accordance with this Privacy Policy.

(iii) through the use of the SMS Service, Bookshop.org will receive the following personal information:
• Your mobile phone number when you send a text message to us.
• Any user or screen name you select in connection with the SMS Service.
• The text of messages that you send to other users of the SMS Service.
• Any comments or feedback regarding the SMS Service or other personal information you send to Bookshop.org.

B. Information Automatically Collected

Bookshop.org also automatically or passively collects information that relates to your usage of the Website or that is necessary for the proper functioning or improvement of the Website, including:
• Times and dates and the extent of your usage of the Website.
• Time zone, language, screen resolution, and other usage preferences you select when using the Website.
• Device keyboard settings.
• Usage history such as areas and pages within the Website that you access or use and/or which buttons on the Website you click on.
• The search terms you entered into a search engine that may have led you to the Website.
• The Internet service provider (ISP) or mobile platform you use.
• Other device and Website access information such as your browser type, operating system, Internet Protocol (IP) address, referring/exit pages, another unique device identifiers.

Bookshop.org also collects and maintains aggregated, anonymized, or pseudonymized information to protect the safety and security of the Website, improve the Website, or comply with its legal obligations.

You may decline to provide Bookshop.org with some or all of your information. However, doing so will limit your ability to use the Website.

3. How Bookshop.org Uses the Information It Collects

(i) Bookshop.org uses the information it collects from and about you for the following purposes:
• To enable Bookshop.org to provide you and other Users with the Website, and to improve, protect, and promote the Website and Bookshop.org’s services;
• To promote Bookshop.org’s Bookstore Affiliates;
• To address inquiries and respond to customer service requests, questions, and comments;
• To contact you with newsletters, offers, promotions, and other product specials or to customize your experience on the Website;
• To communicate about, and administer your participation in, special programs, surveys, contests, online campaigns, online programs, sweepstakes, prize draws and other offers or promotions;
• To track and analyze use of the Website and Bookshop.org’s services, such as to identify trends, conduct data analysis, and determine the effectiveness of marketing and promotion efforts, and other service offerings, so that Bookshop.org can improve its performance and provide Users with the best experience possible;
• To maintain security and to enforce the Terms of Use and comply with applicable law; and
• For other purposes that Bookshop.org believes are necessary to protect its rights and the rights of others, or as otherwise described to you at the time of collection.

(ii) With respect to the SMS Service, Bookshop.org uses personal information to (a) provide you with the SMS Service, (b) process and respond to inquiries, (c) improve the SMS Service, (d) if necessary, contact you with important announcements, or messages, (e) conduct research, and (f) provide anonymous reporting for internal and external clients and partners.

Each message that you send through the SMS Service is stored on our servers. We retain these messages on our servers.  Bookshop.org utilizes servers owned by third parties.

4. How Bookshop.org Shares the Information It Collects

Bookshop.org may share the information it collects from and about you in the following ways:

• Service Providers: Bookshop.org may share your information with certain service providers to help provide, improve, promote, or protect the Website, promote Bookshop.org’s Bookstore Affiliates and process payments. Bookshop.org requires those service providers to use your information only for the purposes Bookshop.org has authorized and to protect your personal information at least to the same standards as Bookshop.org does.
• Affiliates and Platform Sellers: Bookshop.org may share your contact information with an Affiliate if you visited Bookshop.org’s website via that Affiliate’s referral link, or you shopped from the Affiliate’s book lists or a Bookstore Affiliates’ page on our Website. We will only share your information with the Bookstore Affiliate from whom you purchase.
• Legal Matters; Safety: Bookshop.org reserves the right to disclose information Bookshop.org collects from or about you when doing so is reasonably necessary to comply with the law or law enforcement, to prevent fraud or abuse, or to protect the legal rights, property, or the safety of Bookshop.org, Users, or others.
• Sale or Transfer of Assets: In the event that Bookshop.org is acquired by or merged with a third-party entity, or sells all or substantially all of its assets, Bookshop.org reserves the right, in any of these circumstances, to transfer or assign the information it has collected from and about Users as part of such merger, acquisition, sale, or other change of control. In the unlikely event of bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditors’ rights generally, Bookshop.org may not be able to control how your personal information is treated, transferred, or used.
• Aggregate or Anonymous Information: Bookshop.org may also share information that is aggregated or anonymized in a way that it does not directly identify you.
• Publicly Available Information: When Platform Sellers post Content, all Users will be able to view such Content. Platform Sellers should not post any information, including personal information, that they do not want to be publicly accessible.

The above excludes the sharing of any personal information collected by the SMS Service, which shall not be shared with any third parties.

5. Tracking and Other Technologies

A. Types of Cookies Bookshop.org Utilizes

Bookshop.org uses the following types of cookies and other technologies:
• User Information: Bookshop.org will store a logged-in User’s information to remember the customer information you gave us so that you do not have to re-enter it when making additional purchases.
• Shopping Cart Contents: Bookshop.org also uses cookies to keep track of items you put into your shopping cart including when you have abandoned your cart and this information is used to determine when to send cart reminder messages via the SMS Service.
• Security: Bookshop.org secures the Website with cookies that facilitate security features and allow Bookshop.org to detect activity that might violate the Terms of Use, such as unauthorized access or activity.
• Localization: Some cookies help Bookshop.org provide localized experiences, such as displaying the Website in the local language.
• Site Features and Services: Certain cookies provide greater functionality to the Website and help Bookshop.org deliver our products and services.
• Performance: Bookshop.org uses performance cookies to help route traffic between servers and understand how the Website is performing so Bookshop.org can provide Users with the best experience possible.
• Analytics and Research: Cookies and other technologies also help Bookshop.org to understand, improve, and research features and content on the Website. These types of cookies include Google Analytics, which you can opt out of at https://tools.google.com/dlpage/gaoptout.

B. Limiting or Blocking Cookies and Our Do Not Track Policy
‍
Your browser may give you the ability to control cookies, which may depend on the type of cookie, and browsers can be set to reject browser cookies. However, blocking or deleting cookies may prevent you from using most of the Website. Some browsers have “do not track” features that allow you to tell a website not to track you. These features are not all uniform. If you block cookies, certain features on the Website may not work. If you block or reject cookies, not all of the tracking described in this Privacy Policy will necessarily stop. Note that certain options you select are specific to certain browsers and devices. Our system may not recognize Do Not Track requests or headers from some or all browsers.

C. Web Beacons
‍
The Website may contain electronic images known as web beacons (sometimes called single-pixel gifs) and are used along with cookies to compile aggregated statistics to analyze how the Website is used. Bookshop.org uses third parties to gather information about how you and others use the Website. For example, Bookshop.org will know how many Users access a specific page and what Website Content they clicked on. Bookshop.org uses this aggregated information to understand and optimize how the Website is used.

D. Social Media Plug-Ins

Bookshop.org may use certain social media plug-ins (e.g., Facebook, Bluesky, Instagram, Threads, etc.) to allow you to communicate with such services and interact (e.g., “like “or “comment”) with various Website content. The social media plug-in will enable a direct communication between your end user device and the servers of the applicable social media provider, allowing the applicable social media provider to communicate with you and collect information about you browsing the Website. If you decide to use a social media plug-in, Bookshop.org may transfer your information to the social media provider, whether or not you have a registered user account with the applicable social media provider. Bookshop.org is not responsible for the content and the data collection on respective third-party websites or apps and that Bookshop.org neither controls the extent of personally information collected by the respective plug-in provider nor knows the processing’s purpose or the period your personal information will be retained. For further information as to how and for what purpose certain social network providers process your data, please see the relevant privacy policies of the applicable social media provider.

6. Your Rights

A. Information for California Residents

California residents may also take advantage of the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Subject to certain limitations, the CCPA and CPRA provide you with the following rights:

The Right to Know.
You may request that we disclose to you the categories of personal information we have collected, used, disclosed, or “sold” within the meaning of the CCPA, including:
• Specific pieces of information that we have collected about you
• Categories of personal information we have collected about you
• Categories of sources from which the personal information is collected
• Categories of personal information about you that we have sold, shared, or disclosed for a business purpose·      Categories of third parties to whom the personal information was sold, shared or disclosed for a business purpose
• The business or commercial purpose for collecting, selling, or sharing personal information (collectively, the “Right to Know”)

The Right to Delete.
You have the right to request that we delete personal information about you that we have collected from you (the “Right to Delete”).

The Right to Correct.
You have the right to request that we correct any incorrect personal information that we collect or retain about you, subject to certain exceptions.

Exercising Your Rights.
To exercise your Right to Know, Right to Delete, or Right to Correct contact us at [email protected] or (800) 484-6309.

Right to Opt Out.
You have the right to direct us to not sell or share your personal information at any time (the “Right to Opt Out”). To exercise your Right to Opt Out contact us at [email protected] or (800) 484-6309.

Verification.
In order to exercise these rights, you will need to verify your identity to protect your security and personal information, which may include providing certain information. Note that even if we honor your request to delete your information, we may retain certain information as required or permitted by law.

Authorized Agent.
You may elect to have an agent exercise your rights for you. Even if you choose to use an agent, we may, as permitted by law, require:
• The authorized agent to provide proof that the consumer gave the authorized agent signed permission to submit the request;
• The consumer to verify their identity directly with the business;
• The consumer to directly confirm with us that they provided the authorized agent permission to submit the request.

Non-Discrimination.
We may not discriminate against you because of your exercise of any of your privacy rights, or any other rights under the CCPA, including by:
• Denying you goods or services
• Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties
• Providing you a different level or quality of goods or services
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services

In addition to the information provided throughout this Privacy Policy, we make the following disclosures:
• We collected the following categories of personal information within the previous 12 months: identifiers/contact information, commercial information, internet or other electronic network activity information, geolocation, and inferences drawn from the above.
• We disclosed the following categories of personal information for a business purpose within the previous 12 months: identifiers/contact information, commercial information, internet or other electronic network activity information, geolocation, and inferences drawn from the above. We disclosed this personal information to the service providers, Affiliates and Bookstore Affiliates described in Section 4, above.

B. Virginia, Colorado, Connecticut, and Utah Privacy Rights

This section is applicable to residents of Virginia, Colorado, Connecticut, or Utah. If you are a resident of Virginia, Colorado, Connecticut, or Utah, you have certain rights described below. The following do not apply to individuals who do not live in Virginia, Colorado, Connecticut, or Utah on a permanent basis, individuals we do not collect personal information about, or individuals for whom all of the information we collect is exempt from the statutes. “Personal Data,” for purposes of this section regarding the rights of residents, means any information that is linked or reasonably linkable to an identified or identifiable natural person and does not include de-identified information or publicly available information.

This section applies only to Virginia, Colorado, Connecticut residents to the extent their Personal Data is subject to the Virginia Consumer Data Protection Act (VCDPA), or the Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA) or any amendments or acts thereto upon their effective dates.  The categories of personal information processed, the purposes of processing, the categories of personal information shared, and the categories of third parties to which personal information is shared are provided in the above sections of this Privacy Policy.

Rights under VCDPA, CPA, CTDPA, and UCPA

Virginia, Colorado, Connecticut, and Utah privacy law provides residents with specific rights regarding personal information, including:
• Right to Access. You have the right to confirm whether or not we are processing your Personal Data and to access such information.
• Right to Correction. You have the right to correct inaccuracies in your Personal Data which we have collected, taking into account the nature of the Personal Data and the purposes of processing the Personal Data.
• Right to Deletion. You have the right to request deletion of Personal Data provided by or obtained about you, subject to legal exemptions.
• Right to Data Portability. You have the right to obtain a copy of your Personal Data.
• Right to Opt-Out. You have the right to opt out of the processing of Personal Data for purposes of (1) targeted advertising; (2) the sale of Personal Data; or, if you are in Virginia or Colorado (3) profiling in furtherance of decisions that produce legal or similarly significant effects.

If you would like to exercise any of the rights provided, contact us at [email protected] or (800) 484-6309.

Right to Non-Discrimination
We may not discriminate against you because you exercise any of your privacy rights contained in this Privacy Policy including, but not limited to:
• Denying goods or services to you;
• Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Providing a different level or quality of goods or services to you; or
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Virginia and Connecticut Appeal Process
‍
If you have made a request to access, correct, or delete your Personal Data under VCDPA and CTDPA, and we have declined to take action, you may appeal our decision within 45 days of the denial. When you make such an appeal, you can expect the following:
• We will verify your identity. You will need to provide us with your email address and full name. We may ask for additional information if needed.
• We will review your appeal and respond in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision, within 45 days upon receipt of your appeal. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In certain cases, an appeal may be denied. For example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as providing Services or completing an order. If we deny your appeal, we will explain why we denied it and provide you with a method to contact your state’s Attorney General to submit a complaint.

C. Information for Nevada Residents

Under Nevada law (SB 220), Nevada residents are permitted to opt-out of the sale of certain kinds of personal information. The term “sale” is used here to mean the transfer of your personal information to third parties for monetary consideration so the third parties can then re-sell or license the sold personal information. If you are a Nevada resident, you have the right to request that we not sell your personal information for monetary consideration to certain other parties.  This right applies even if your personal information is not currently being sold.  If you are a Nevada resident and wish to exercise this right, please contact us at [email protected] or (800) 484-6309.  We value your privacy and will not discriminate in response to your exercise of your privacy rights.

Information for UK and European Economic Area Residents

If you are a resident of the United Kingdom (UK) or the European Economic Area (EAA) and would like to gain access to, update, erase, or restrict or withdraw any consent to the processing of certain information collected from and about you through the Website, please contact us at [email protected].

In addition, residents of the UK and the EAA also have the right to object to the processing of such information and, in some instances, the right to request that we export, in a structured, commonly used, machine readable, and interoperable format, and transmit to another controller, such information.

The European Union’s General Data Protection Regulation (GDPR), and the UK Data Protection Act of 2018 (UK GDPR) require a “lawful basis” for collecting and retaining personal information from citizens or residents of the UK or the EAA as applicable. Bookshop.org’s lawful bases include:
• Consent: In certain cases, you have affirmatively provided Bookshop.org with your consent to collect your personal information for a specific purpose, such as providing your name and email address when you register for an Account.
• Contract: Bookshop.org may need your personal information to comply with contractual obligations to deliver the Website, such as fulfilling transactions for Merchandise.
• Legal Obligations: Sometimes the law requires the collection and use of your information. For example, applicable tax laws may require Bookshop.org to retain records of payments made through the Website.
• Legitimate Interests: This is a technical term that means Bookshop.org has a good and fair reason to use your information and in ways that do not harm your interests and rights, such as in a way that might reasonably be expected as part of running our business and that does not materially impact your rights, freedom, or interests. For example, Bookshop.org uses identity, device, and location information to prevent fraud and abuse and to keep the Website secure. We may also send you promotional communications about the Website and services subject to your right to opt out, as well as analyze how Users interact with the Website so Bookshop.org can understand better what elements do or do not work well, thereby facilitating improvements and developments in the quality of the online experience for all Users.

C. Email Notifications

Bookshop.org wants to communicate with you only if you want to hear from us.Bookshop.org will send you emails relating to your transactions on or through the Website, as well as service-related announcements when necessary. You may also elect to receive marketing emails, in accordance with your preferences, and from which you may opt out at any time by adjusting your notification settings. Bookshop.org will try to keep emails to a minimum and give you the ability to opt in to any marketing communications.

7. Links to Other Websites and Services

The Website may include links to other websites or services whose privacy practices may differ from the privacy practices as described in this Privacy Policy. When you click or otherwise use a link to an external website or service, the privacy policy and data processing disclosures for that website or service govern.
‍
8. Data Retention

Bookshop.org will retain the information collected from or about you as long as necessary to provide you with the Website or Bookshop.org’s services, as otherwise set forth in this Privacy Policy, and to the extent necessary to comply with Bookshop.org’s legal obligations, resolve disputes, enforce our agreements, and protect our legal rights. Additionally, Bookshop.org may retain indefinitely any aggregated or anonymized information, and may from time to time transfer or merge your information collected off-line to our online databases or store off-line information in an electronic format.

9. Cross-Border Data Transfers

Bookshop.org is based in the United States so your information will be collected and processed in the United States, which has its own laws governing data protection and access to it, including by the government. If you reside outside of the United States, be advised that the rules that protect your personal information under United States federal, state, and local law may differ from those of your home country. With respect to any personal information that may be originally collected and stored in the UK or the EAA, if and when Bookshop.org transfers your personal information to countries outside the UK or the EAA, it will do so in compliance with safeguards as required by relevant law. By using the Website or our services, you consent to the collection, international transfer, storage, and processing of your data.

10. Children’s Privacy

The privacy of children is of the utmost importance, and Bookshop.org is committed to complying with applicable privacy law, including the federal Children’s Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), and the GDPR or the UK GDPR. Bookshop.org does not knowingly collect or process personal information from children under the age of sixteen (16). If a child has provided us with personal information, a parent or guardian of that child may contact us to have the information deleted from our records. If you believe that we might have any information from a child under age sixteen (16), please contact us at [email protected]. If we learn that we have inadvertently collected the personal information of a child under 16, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible and cease the use of that information in accordance with applicable law.

11. Security

Bookshop.org takes security seriously, and the security of your personal data is important to us. Bookshop.org follows industry-standard practices to protect the data Bookshop.org collects and maintains, including using Transport Layer Security (TLS) to encrypt information as it travels over the Internet. However, the nature of security risks is constantly evolving, as are the technical and organizational industry standards relating to management of those risks, and Bookshop.org cannot guarantee the complete security of any information it collects, stores, or uses. We are not responsible for the acts of those who gain unauthorized access, and we make no warranty, express, implied or otherwise, that we will prevent such access, and we are not responsible for any damages or liabilities relating to any such incidents to the fullest extent permitted by law. Where required under law, we will notify you of any such loss, misuse or alteration of personal information that may affect you so that you can take the appropriate actions.

For your own privacy protection, we urge you to keep all passwords confidential. We also recommend that you do not include sensitive information such as passwords or payment information, in any emails that you send to us. If you become aware of any breach of the terms of this Privacy Policy or of the security of our services, please notify us by email at [email protected].

12. Updates to this Privacy Policy

Bookshop.org may change the terms of this Privacy Policy at any time. Whenever Bookshop.org makes a material change, Bookshop.org will provide appropriate notice to you. The effective date of the most recent version of this Privacy Policy will appear at the top of this page.

13. Contact Us

Questions or comments about this Privacy Policy should be sent by email to [email protected] or mail to Bookshop.org, 463 Lincoln Place#200 Brooklyn, NY 11238. You also have the right to submit feedback to the applicable supervisory authority in your jurisdiction of residence.
Privacy Notice
‍
© 2025 Bookshop.org. All rights reserved