Privacy Policy

1. Information we collect

Depending on how you use the Library, we may collect information including:

• Account information, such as your name, email address, account type and login credentials. Passwords are stored as secure password hashes rather than readable passwords.
• Subscription and licence information, including subscription status, access period, corporate organisation, seat entitlement and related payment or activation records.
• Library activity, such as books opened, reading sessions, session timestamps and access status needed to operate and secure the Library.
• Technical information, such as IP address, browser or device information and security or audit logs.
• Google account information used by an authorised administrator to connect the Library to Google Drive, including the connected Google account email and OAuth credentials required to maintain that connection.

2. How Google Drive data is used

The Library uses Google OAuth and the Google Drive API so an authorised HB administrator can connect a Google Drive account and make selected private PDF publications available through the Library’s controlled online reader.

When Google Drive is connected, the Library may use read-only access to retrieve the PDF files registered by the administrator. The Library does not use this connection to edit or delete the original files in Google Drive.

Google Drive access is used only to provide and maintain the Library service, including retrieving authorised publications, preparing secure reading pages, testing file availability and maintaining the administrator’s connection.

3. OAuth credentials and temporary file storage

Google OAuth credentials needed to maintain the administrator-authorised Drive connection are stored on the Library server. Refresh-token information is protected by application encryption, and short-lived access tokens may be cached temporarily to operate the service.

PDF files retrieved from Google Drive may also be cached temporarily on the Library server to support page rendering and improve performance. These files remain within protected server storage and are not intended to be exposed as direct public download links.

4. How we use information

We use collected information only where reasonably necessary to:

• create and manage Library accounts;
• verify individual subscriptions and corporate licences;
• provide access to authorised publications;
• operate secure reading sessions and personalised watermarking;
• manage Google Drive connectivity and book availability;
• maintain security, prevent misuse and investigate technical issues;
• maintain records required for administration, reporting and compliance; and
• communicate about the Library where necessary.

5. Sharing of information

We do not sell personal information or Google user data. Information may be processed by service providers that are necessary to operate the Library, such as website hosting, database, internet infrastructure or Google services, and may be disclosed where required by law or to protect the security and integrity of the service.

6. Data security

We apply reasonable technical and organisational safeguards appropriate to the nature of the service. These include access controls, secure password hashing, HTTPS, protected server storage, administrator controls and audit logging. No internet service can guarantee absolute security, but we work to reduce unauthorised access, disclosure, alteration and loss.

7. Retention and deletion

Information is retained for as long as reasonably necessary to provide the Library, maintain legitimate administrative or legal records, resolve disputes and protect the service. When the administrator disconnects Google Drive, the Library is designed to revoke the stored Google OAuth refresh token where possible and remove locally cached Google access-token information.

Users may contact us to request correction or deletion of their personal information, subject to any information we are required or permitted to retain for legal, security, accounting or contractual reasons.

8. Corporate users

Where access is provided through a corporate licence, an organisation may provide or manage information necessary to establish employee access. Corporate users should also refer to their organisation’s own privacy policies regarding information supplied by that organisation.

9. Third-party services and links

The Library may rely on third-party services such as Google Drive and the hosting environment. Their own privacy policies and terms apply to their services. External links displayed by the Library are outside our control.

10. Changes to this policy

We may update this Privacy Policy when the Library, applicable law or our service arrangements change. The latest version will be published on this page with an updated effective date.

11. Contact

For privacy questions, data requests or concerns about the HB Corporate Digital Library, contact humanotorial@gmail.com.