Privacy Policy
Effective October 20, 2026
This policy explains what personal information Hoang Le (“we”, “us”) collects through https://hoanglebookstore.com, why we collect it, who we share it with, and the choices you have. We have tried to write it in plain English rather than legal boilerplate.
1. Who is responsible for your data
Hoang Le is the data controller for information collected through this site.
Based in Springfield, Virginia 22151, United States. Written notices may be sent to hoangle@pandatheapp.com.
Privacy questions and requests: hoangle@pandatheapp.com.
2. What we collect, and why
| What | When | Why |
|---|---|---|
| Email address, first name (optional) | You join the reader list | To send the newsletter you asked for |
| A one-way hash of your IP address | You join the reader list | Proof that consent was given, and to rate-limit abuse. The hash cannot be reversed to recover your IP. |
| Your account’s name and email, rating, review text | You write a review while signed in | To publish the review after moderation. Your name is shown only if you choose; otherwise the review says “A customer”. Your email is never published. |
| One customer record joining your orders, support questions, reviews and newsletter status, plus our own notes about your requests | You buy, write to us, review, or join the newsletter | To serve you well: answer you with your history in view, and see which products and services help customers most. Only we can see it. |
| The new email address you give us | You change the email on your account | To send a confirmation link to it, then move your orders and downloads to it once you confirm. |
| Name, email, message | You use the contact form | To reply to you |
| What you type in the shopping helper, and the products it shows you | You use the chat box on the shop pages | What you type is sent to Anthropic (Claude) to write the answer. We keep it for 30 days without your name, to fix mistakes and count how often the helper helps, and then delete it. It is never used for marketing and never sold. Please do not share personal details in the chat. |
| Email address, name, country, what you bought and what you paid | You buy a download from the shop | To deliver your files, keep your order history, and work out the free picks and VIP standing you have earned. Card details go to Stripe and never reach us. |
| Which site or link brought you to the shop (such as Pinterest or a search), and your answer if you tell us how you found us | You buy a download from the shop | To learn which of our efforts bring readers and parents, so we can do more of what helps. The shop remembers which site or link brought a buyer. It is kept with the order, only we can see it, and it is never shared. The answer is optional. |
| Your email address, and the fact that you proved it is yours | You sign in to your account | To show you your own orders and nobody else’s. There is no password to store: you sign in with a one-time link, or with Google, which tells us only your email address and name. |
| Your cookie preferences | You answer the cookie banner | To honour your choice on future visits |
We do not buy personal data, we do not build advertising profiles, and we do not run third-party ad networks on this site.
When you download a file you bought, the shop records which file and when, to help with support and payment disputes; the record does not include your IP address. If you pay by card, Stripe’s fingerprint of the card, which is a code for that card and not the card number, may be used to prevent refund abuse. To apply the fair-use rule in our Refund Policy, we also keep a count of the refund requests on an account and any pause or closure, with the dates.
3. Legal bases (UK/EU visitors)
- Consent: the newsletter, and any optional cookies. You may withdraw consent at any time.
- Legitimate interests: replying to your messages, moderating reviews, and keeping the site secure and functional.
- Legal obligation: keeping records of consent.
4. Who we share it with
We share personal data only with service providers who process it on our behalf, under contract, for the purposes above:
- Google Firebase (Google LLC): hosting, database, and sign-in. Data is stored in the United States.
- Resend: delivery of newsletter and notification email.
- Anthropic (Anthropic PBC): software that helps us answer support questions, keep customer records in order, and write the answers in the shopping helper. It processes them for us and does not use them to train its models.
- Stripe: if and when you purchase directly from us. Stripe handles card details; we never see or store your card number.
- YouTube (Google LLC): only if you allow embedded media and press play on an episode.
Links to Amazon and other retailers take you to those companies’ own sites, governed by their privacy policies, not this one. We do not pass them your personal data.
We will disclose information if required by law, and we will tell you unless legally prevented from doing so. If the business is ever sold, your data may transfer with it; you will be notified and may opt out.
5. International transfers
Our providers store data in the United States. Where data is transferred from the UK or EEA, that transfer relies on the providers’ Standard Contractual Clauses.
6. How long we keep it
- Newsletter: until you unsubscribe, then a suppression record so we don’t email you again by mistake.
- Reviews: published reviews stay until you ask us to remove them.
- Contact and sales messages: up to 24 months.
- Shopping helper chats: 30 days, without your name, and then deleted.
- Download records (which file, and when): 2 years, then deleted.
- Orders and your account: for as long as you may want your downloads again, and as long as tax and accounting law requires us to keep sales records. Ask and we will close your account and remove what we are not required to keep.
- Cookie preferences: 12 months, then we ask again.
7. Your rights
Wherever you live, you may ask us to access, correct, delete, or export your data, and to stop using it. UK/EU residents additionally have the right to restrict or object to processing and to complain to a supervisory authority. California residents may request the specific information collected, request deletion, and are entitled not to be discriminated against for exercising those rights.
We do not sell or share personal information as those terms are defined by the CCPA/CPRA.
To exercise any right, email hoangle@pandatheapp.com. We reply within 30 days and never charge for a first request.
8. Children
Some of our books are written for young children, but this website is intended for adults, and is not directed at children. We do not knowingly collect personal information from anyone under 16. Please do not submit an email address, review, or message if you are younger than that. Ask a parent or guardian to do it for you.
If you believe a child has given us personal information, email hoangle@pandatheapp.com and we will delete it promptly.
9. Security
The site is served over HTTPS. Database access is restricted by server-side security rules; the subscriber list cannot be read from the browser at all. Administrative access requires Google sign-in from an approved account. No system is perfectly secure, and we do not claim otherwise: if a breach affects your data, we will notify you and the relevant authority as required by law.
10. Changes
If we make a material change we will update the effective date above and, where the change affects how we use data you already gave us, tell subscribers by email.