Privacy policy and data notice.

Effective Date

This Privacy Policy and Data Notice takes effect on November 10, 2026. All interactions initiated on or after this date—including physical showroom hold requests, support chat conversations, and automated HTTP connections—are governed by this document.

Data Controller & Operator Identification

The data controller responsible for the processing of personal information under this policy is Whisperingshelfs, trading at whisperingshelfs.com.

Categories of Data Collected

We record only information required to fulfill physical title inquiries, maintain store operations, and measure website performance. We collect:

• Inquiry Form Records (cotu86a.php): Name, telephone number, email address, physical or neighborhood address, requested edition kind, specific media format, freeform title or edition notes, and recorded consent confirmation.
• Automated Request Telemetry: Internet Protocol (IP) address, browser user-agent string, referring URL, timestamp of form render, and timestamp of form submission.
• Support Chat Logs (jura8c1.php): Customer name, submitted question text, manager replies, and a cryptographic session token stored in browser localStorage.
• Cookie & State Preferences: Consent choice flag recorded in browser localStorage under site_consent_v2.
• Advertising Click Identifiers: Inbound query strings containing gclid (Google), msclkid (Microsoft), or fbclid (Meta) appended when visiting via paid promotional links.

Whisperingshelfs does not collect account passwords, login credentials, or credit card payment data through this website. The catalogue is inquiry-only, and all payments are transacted in person at our physical store register.

Purposes of Processing

Each category of information collected by our systems is utilized for specific operational functions:

• Hold Reservation Fulfillment: Contacting readers via email or phone to confirm title availability on College Ave shelves and coordinate same-day in-store pickup.
• Customer Inquiries & Chat: Resolving questions regarding rare volumes, spine condition, upcoming 1-day sales events, or academic sourcing.
• Fraud Prevention & Abuse Mitigation: Analyzing server logs and submission timestamps to prevent automated form spam and denial-of-service attempts.
• Campaign Measurement: Evaluating marketing traffic performance across Google Ads, Microsoft Advertising, and Meta Ads to gauge interest in specific book formats.

Legal Bases for Processing

Where data protection legislation (such as the GDPR or analogous state frameworks) requires an explicit legal basis for data handling, Whisperingshelfs processes personal data under the following legal grounds:

Advertising Platforms & Click Identifiers

Whisperingshelfs runs active paid advertising campaigns. Our website is a live destination for commercial traffic originating from major advertising networks. These networks append unique query string identifiers when a visitor clicks an advertisement:

• Google Ads: Uses the gclid (Google Click Identifier) parameter to evaluate campaign performance, search query attribution, and bookstore visitation patterns.
• Microsoft Advertising: Uses the msclkid (Microsoft Advertising Click Identifier) parameter to measure Bing and partner network performance.
• Meta Ads: Uses the fbclid (Facebook Click Identifier) parameter where social media campaigns across Facebook or Instagram direct readers to our inventory pages.

We declare that these advertising networks operate on our web properties today. No promotional platform has endorsed, certified, or reviewed The Whispering Shelf.

Consent Mode v2 Implementation

To respect visitor privacy choices while running digital campaigns, our website integrates Google Consent Mode v2. Before any user makes an explicit choice via our banner, four core consent parameters are held strictly denied by default:

• ad_storage: Denied
• ad_user_data: Denied
• ad_personalization: Denied
• analytics_storage: Denied

These signals remain in the denied state until the visitor explicitly clicks “Allow” on our banner. If the visitor clicks “Decline” or alters their choices at any time, all four signals are immediately reset to denied, preventing tracking cookies from persisting and restricting marketing pings to cookieless signals.

Third-Party Data Processors & Recipients

We share personal information only with vetted third-party service providers acting on our strict instructions:

• Google LLC / Google Ireland Ltd: Advertising delivery, conversion measurement via Google Ads, and consent signaling.
• Microsoft Ireland Operations Ltd: Digital advertising delivery through Microsoft Advertising, which attaches msclkid. Its own handling is covered by the Microsoft privacy statement at privacy.microsoft.com (available at https://privacy.microsoft.com/privacystatement).
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Advertising delivery and attribution tracking via Meta Ads, which attaches fbclid where a campaign runs there.
• Web Hosting Infrastructure: Cloud hosting provider that serves this site and stores the enquiry database and backups.
• Mail Transport Relay: Mail provider that carries the notification from cotu86a.php to the operator’s inbox.

International Data Transfers

Whisperingshelfs operates within the United States. If you access our website from outside the United States, your communications and inquiry data will be transferred to, processed, and stored on servers located in the United States. We ensure transfers comply with applicable data protection requirements through the use of Standard Contractual Clauses (SCCs) and adequacy frameworks adopted by our processors.

Data Retention Periods

We reject open-ended data retention. Whisperingshelfs enforces strict disposal windows across all record types:

• Inquiries and Email Records: Retained for exactly 24 months from submission date to resolve past title requests and tax accounting audits.
• Support Chat Transcripts: Retained for exactly 12 months following the last recorded customer interaction.
• Server & Access Log Files: Retained for exactly 90 days before automatic purge cycles.
• Browser Consent Choices (site_consent_v2): Stored locally in the user’s browser for 12 months before re-prompting.
• Data Subject Access Requests (DSAR): All inquiries exercising legal privacy rights are investigated and answered within 14 days of verified receipt.

Information Security Measures

We maintain technical, administrative, and physical safeguards designed to prevent unauthorized access, alteration, or disclosure of customer records:

• Transport Layer Security: All connections use forced HTTPS with high-grade TLS encryption and modern cipher suites.
• Honeypot & Sanitization Defense: Inbound forms filter out automated injection via honeypot traps and parameter sanitization.
• Access Restriction: Store reservation databases are accessible only by authorized bookstore management on site.

European Visitor Rights (GDPR)

For individuals accessing our website from the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) grants specific statutory rights:

• Right to Access: The right to obtain confirmation and a readable copy of your personal data processed by us.
• Right to Rectification: The right to demand correction of inaccurate or incomplete contact records.
• Right to Erasure (“Right to be Forgotten”): The right to request permanent deletion of your inquiry and chat logs where statutory retention exceptions do not apply.
• Right to Restriction of Processing: The right to temporarily freeze data processing during dispute resolution.
• Right to Data Portability: The right to receive your provided personal data in a structured, commonly used, machine-readable format.
• Right to Object: The right to object at any time to data processing carried out under our legitimate interests.
• Right to Withdraw Consent: The right to withdraw consent at any time without affecting the lawfulness of prior processing.

United States State Privacy Rights (CCPA / CPRA)

Residents of California (under the California Consumer Privacy Act as amended by the CPRA) and consumers residing in other US states with active comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, and Indiana) hold statutory rights regarding personal data:

• Right to Know & Access: You may request disclosure of categories of personal information collected, sources, business purposes, and specific pieces of data held.
• Right to Delete: You have the right to request deletion of personal information collected directly from you.
• Right to Correct: You may request correction of inaccurate personal records.
• Right to Opt-Out of Sale or Sharing: Whisperingshelfs does not sell personal data for monetary compensation. To the extent digital ad tags may constitute “sharing” under California law, you may opt out via our cookie preferences or browser-level signals.
• Right to Non-Discrimination: We do not deny goods, charge differing rates, or provide altered service levels to readers exercising statutory rights.

Global Privacy Control (GPC)

Whisperingshelfs honours Global Privacy Control signals. When your browser transmits the valid Sec-GPC header, our scripts recognize this as an automatic, universal opt-out request for targeted advertising cookies and data sharing across all sessions, without requiring you to manually navigate banner prompts.

Children’s Privacy Protection

Whisperingshelfs does not intentionally target, market to, or collect personal data from individuals under 16 years of age. If a parent or guardian discovers that a child has provided contact details through our inquiry form, contact us at [email protected] to ensure immediate deletion.

Supervisory Complaints & Regulatory Recourse

You have the right to lodge a formal complaint with an appropriate regulatory authority if you believe our data handling infringes statutory rights:

• United States: File inquiries with your state Attorney General (in Indiana, the Office of the Indiana Attorney General). California residents may file directly with the California Privacy Protection Agency (CPPA) at cppa.ca.gov.
• European Union / UK: Lodge complaints with your local data protection supervisory authority (e.g. the Information Commissioner’s Office in the UK or relevant EU national DPA).

Data Subject Access Requests (DSAR) Protocol

To exercise any statutory privacy right described in this policy, submit a written request containing your name and the contact channel previously utilized:

Policy Amendments & Notifications

We reserve the right to amend this Privacy Policy to reflect evolving showroom procedures or regulatory requirements. Any update will be posted directly to this URL with a revised effective date at the top of the document. We recommend checking this page periodically.

Direct Privacy Contact

If you have questions, comments, or concerns regarding our privacy governance or data handling, reach out directly to our store management:

Accessibility Statement

The Whispering Shelf is committed to digital accessibility, ensuring that our showroom inventory and inquiry channels conform to the Web Content Accessibility Guidelines (WCAG 2.1 Level AA).

Our static code maintains semantic landmark roles, keyboard-operable drawer navigation, high-contrast OKLCH color palettes (exceeding 7.6:1 for secondary copy and 13.2:1 for body copy), fluid type clamp sizing, explicit form labels, and focus rings. If you encounter any accessibility barrier on our website, please email [email protected] or telephone 317-708-6090.