Privacy Policy
Last updated: March 11, 2026
1. Who We Are
Voyage Tracable, LLC (“we”, “us”) operates the PublishOS / IASE platform. We are the data controller for personal data processed through this Service.
Contact: [email protected]
Address: 3478 Caravelle St, Sarasota, FL 34240
2. Data We Collect
| Data | Purpose | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Email address | Authentication, communication | Contract performance |
| Display name | Public profile | Contract performance |
| Date of birth | Age verification (16+) | Legal obligation |
| Reading position, bookmarks | Reading experience | Contract performance |
| Purchase history | Order fulfillment, tax reporting | Contract performance, legal obligation |
| Payment data | Payment processing | Contract (processed by Stripe) |
| IP address | Security, fraud prevention | Legitimate interest |
| Creator KYC data | Identity verification for payouts | Legal obligation (processed by Stripe) |
3. Third-Party Processors
- Stripe — payment processing, KYC, tax reporting
- Cloudflare — CDN, DDoS protection, DNS
- Sentry — error monitoring (no PII transmitted)
We do not sell your personal data. We do not share it with third parties for marketing purposes.
4. Data Retention
- Account data: Retained while account is active. Deleted within 30 days of erasure request.
- Transaction records: 7 years (tax/legal requirement).
- Content: Deleted when creator requests removal.
- Moderation/DMCA records: Retained for legal compliance.
- Audit logs: 3 years.
5. Your Rights
Under GDPR, CCPA, and applicable law, you have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”) — we will comply within 30 days, except where retention is legally required.
- Port your data in a machine-readable format (JSON export).
- Object to processing based on legitimate interest.
- Withdraw consent at any time for consent-based processing.
To exercise these rights, email [email protected] or use the self-service options in your account settings.
6. Cookies
We use a single session HttpOnly cookie for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
7. Data Security
We use encryption in transit (TLS), encrypted database storage, and access controls to protect your data. Passwords are never stored — we use passwordless authentication (email codes + passkeys).
8. Data Breach Notification
In the event of a data breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and notify affected users without undue delay if there is a high risk to your rights (GDPR Art. 34).
9. International Transfers
Our servers are located in the United States. If you access the Service from the EU/EEA, your data will be transferred to the US. We rely on standard contractual clauses (SCCs) as our transfer mechanism.
10. Children
The Service is not directed at children under 16. We do not knowingly collect data from anyone under 16. If we discover that a user is under 16, we will promptly delete their account and data.
11. Changes
We will notify you of material changes to this policy via email at least 30 days before they take effect.
12. Supervisory Authority
If you are in the EU and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local Data Protection Authority.