Privacy Notice

Ulysses Companion is operated by Riverrun Labs, which is the data controller for the personal data described in this notice. You can contact us about privacy at any time via the contact details on our About page.

We collect the following categories of personal data:

• Account data — your name and email address, and your login credentials, used to create your account, sign you in, and provide the service (legal basis: performance of a contract).
• Reading data — your Reading Room progress and email preferences, used to personalise your experience and, if you opt in, to send you updates (legal basis: performance of a contract, and consent for optional emails).
• Support messages — if you contact us, we keep the correspondence to help you and improve the service (legal basis: legitimate interests).
• Usage and device data — IP address, device and browser identifiers, and basic usage telemetry, used to keep the service secure, prevent fraud, and improve the product (legal basis: legitimate interests).

We do not collect or store your payment card details — payments are handled entirely by Paddle (see below).

We share personal data only with:

• Service providers that host and run the service for us (cloud hosting, database, email delivery, and AI services that generate audio summaries), each acting under contract.
• Paddle, our Merchant of Record, for the sale of the Library Pass, subscription and payment management, tax compliance, and invoicing. When you buy, Paddle processes your payment data as an independent controller under its own privacy policy.
• Professional advisers (legal, accounting) where needed.
• Authorities where we are required to do so by law (legal basis: legal obligation).

Some of our service providers process data outside the UK/EEA. Where that happens, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

We keep your personal data only for as long as needed to provide the service and meet legal obligations (for example, tax and accounting records). When data is no longer needed, it is deleted or anonymised.

Under data protection law you have the right to access, rectify, or erase your personal data; to restrict or object to processing; to data portability; and to withdraw consent at any time (for example, by unsubscribing from emails). We respond to requests within one month. You also have the right to complain to your supervisory authority — in Ireland, the Data Protection Commission.

We apply appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security on our database.

We use essential cookies and local storage to keep you signed in and remember your reading preferences. We do not use marketing or advertising cookies. You can clear cookies and site data at any time in your browser settings; doing so will sign you out.

If we change this notice we will update the date above and, for significant changes, let registered readers know by email.