Privacy Notice

Last updated: September 2026

This notice explains what data WhatToRead collects, why, and your rights. The short version: no account, no email, no tracking — just anonymous quiz answers and optional book feedback.

1. Who is responsible

Anna Tverdovska
E-mail: anna.tverdovska@web.de

2. What data is collected and why

Quiz answers (session only)

When you complete the quiz — your energy state, reading goal, personality colour, and similar — those answers are held in your browser for the duration of your session. They are sent to our API solely to generate your book recommendations. They are not stored on our servers, not linked to any identifier, and not retained after your session ends.

Feedback signals (anonymous, stored)

If you click 👍 or 👎 on a book recommendation, we record:

• Book title and author
• Whether you liked or disliked it
• Your anonymised quiz answers for that session: reading goal, energy state, mood, self-esteem, personality colour, approach, focus area, openness, and reading frequency — all as categorical single-choice values (no free-text fields)
• A timestamp

Mood and self-esteem questions, while more personal in nature, are collected only as fixed multiple-choice options (e.g. "up and down, honestly" / "harder on myself than usual"). There is no free-text input and no combination of these categorical values can identify you as an individual. We treat these fields with additional care: they are never displayed publicly, not processed for any purpose other than improving the recommendation algorithm, and not shared with any third party beyond the HF Dataset storage described below.

This data contains no personal identifiers. We cannot link it to you as an individual. The legal basis is our legitimate interest in improving the recommendation quality (Art. 6(1)(f) GDPR). If new quiz questions are added in the future, they will follow the same anonymous categorical design.

Aggregated visitor statistics (anonymous)

We use Vercel Web Analytics to understand how the site is used. This tool collects aggregated, cookieless statistics including approximate country, device type, browser, and operating system. No IP addresses are stored, no cookies are set, and no individual visitor can be identified. The legal basis is our legitimate interest in understanding site performance (Art. 6(1)(f) GDPR).

3. What we do not collect

• No names, email addresses, or user accounts
• No cookies or tracking pixels
• No individual IP addresses or device fingerprints
• No advertising or behavioural profiling

4. Third-party processors

Vercel, Inc. (340 Pine Street, Suite 701, San Francisco, CA, USA) — hosts the website and API, and provides cookieless aggregated analytics. Vercel is EU–US Data Privacy Framework (DPF) certified; the transfer is lawful under Art. 45 GDPR.

Hugging Face (Coupang, Inc.) (San Francisco, CA, USA) — stores anonymous feedback data (book ratings + quiz answers) used solely to improve the recommendation algorithm. Hugging Face is DPF certified; the transfer is lawful under Art. 45 GDPR.

No other sub-processors receive your data. We do not use advertising networks, social media tracking pixels, or analytics services beyond those listed above.

5. Automated decision-making

The book recommendations are generated entirely by an automated algorithm based on your quiz answers. This constitutes automated processing within the meaning of Art. 22 GDPR. However, no legal or similarly significant effects result from this processing — the recommendations are informational and non-binding, and you are free to disregard them entirely. You are not profiled in a way that produces legal effects or significantly affects you.

6. Retention

Session quiz answers exist only in your browser tab and are discarded when you leave. Anonymous feedback records (👍/👎 clicks) are retained for as long as the recommender service operates and they remain useful for improving recommendations. Because feedback is not linked to any individual, there is no personal data to delete in the technical sense.

7. Your rights

Under the GDPR you have the following rights in relation to any personal data we hold about you:

• Right of access (Art. 15) — to know whether and what data we hold about you.
• Right to rectification (Art. 16) — to correct inaccurate data.
• Right to erasure (Art. 17) — to have your data deleted under certain conditions.
• Right to restriction (Art. 18) — to limit how your data is used.
• Right to data portability (Art. 20) — to receive your data in a structured format.
• Right to object (Art. 21) — to object at any time to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Because we do not collect personal identifiers, we cannot locate data that belongs to you specifically. If you believe feedback you submitted could be identified (e.g. a very unusual combination of answers), contact us at anna.tverdovska@web.de and we will make reasonable efforts to assist.

You have the right to lodge a complaint with a supervisory authority at any time. In Germany, the competent authority is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) at www.bfdi.bund.de. If you reside in another EU member state, you may instead contact your local data protection authority.

8. Third-country transfers

Anonymous feedback data is stored on Hugging Face servers in the United States. Aggregated visitor statistics are processed by Vercel, also based in the United States. Both companies are certified under the EU–US Data Privacy Framework (DPF), which the European Commission has recognised as providing adequate protection under Art. 45 GDPR. No additional transfer mechanisms (such as Standard Contractual Clauses) are required.

9. Changes to this notice

If we materially change how we handle data, we will update the date at the top of this page. We encourage you to review it periodically.

Questions? Write to anna.tverdovska@web.de