Scope and controller
This notice governs the website published at www.foliora.com and every request for a manual made through it. It does not govern third-party sites we link to.
Foliora is a press and author-services programme operating with Self-Publishing Review and Independent Review of Books. For the purposes of the General Data Protection Regulation (EU) 2016/679 — the GDPR — Foliora is the data controller for the lead records created when you request a manual, and it applies the same standard to visitors outside the European Union.
The site can be read without supplying any personal data. Personal data reaches us in two ways only: through the request form you complete voluntarily, and through the security metadata described below, which is generated when the form is submitted.
Written requests may be addressed to privacy@foliora.com.
What we collect
We collect only what the request requires:
- Your full name, as entered in the request form.
- Your work or author email address.
- The manuscript stage you select and the edition you download.
- The date and time of consent, verification and download.
- Security metadata: truncated network address, submission timing and rate-limit counters.
We do not collect payment data, postal addresses, telephone numbers or any special category data. We do not buy contact lists and we do not enrich your record with third-party profiles. No account is created and no password is ever requested.
Why we process it
Processing rests on the explicit consent you give before submitting the form, and on our legitimate interest in protecting the platform against automated abuse.
- Delivery: to send the six-digit verification code and release the signed download link.
- Advisory correspondence: to send occasional Foliora guidance on publishing and book marketing, only where consent was given.
- Security: to detect disposable addresses, rate-limit abuse and record administrative access.
- Measurement: to understand, in aggregate, which editions are requested and in which language — never to build an advertising profile.
Withdrawing consent stops advisory email immediately. It does not affect the lawfulness of processing carried out before withdrawal, and it does not cancel a download already released.
Verification and tokens
Every request is confirmed by double opt-in. A six-digit code is issued to the address supplied; the download link is released only after that code is entered correctly. Codes expire after ten minutes, with three requests permitted per quarter hour.
Download links are signed and expire fifteen minutes after issue. The signature is verified before a file is served, so a link cannot be forwarded indefinitely or guessed. Verification exists to keep the manuals out of automated harvesting lists, not to profile you.
Transfers outside the EU
Foliora is established in the European Union. Where a processor handles data outside the Union, the transfer is covered by the European Commission's Standard Contractual Clauses and, where applicable, by an additional assessment of the destination's legal regime. A copy of the safeguards can be requested at the address below.
Retention
- Unverified requests: deleted after seven days.
- Verified lead records: retained for twenty-four months from the last interaction, then deleted.
- Security and audit logs: retained for twelve months.
- Accounting records, where a commercial relationship exists: retained for the statutory period.
We review what we hold on a fixed cycle. When there is no longer a customer, legal or business need to keep a record, it is deleted or irreversibly anonymised. You may ask for earlier deletion at any time, and we will action it within thirty days.
Your rights
You have the right to access your record, to rectify it, to erase it, to restrict or object to processing, to receive it in a portable format, and to withdraw consent at any moment. Write to privacy@foliora.com, stating the address you used for the request; we confirm identity before acting, and we respond within one month.
Automated filtering decides whether a submission is accepted, never what happens to a confirmed record, and no decision with legal effect is taken about you by automated means alone. If you believe your data has been handled unlawfully you may complain to the supervisory authority in your country of residence — in Spain, the Agencia Española de Protección de Datos.
Security measures
- Administrative credentials are stored as salted PBKDF2-SHA-256 digests, never as plain text.
- Five failed sign-ins lock the interface for fifteen minutes and are written to the audit log.
- Administrative sessions expire after thirty minutes without activity.
- All user input is sanitised before storage and rendered as text, never as markup.
- Disposable email domains, honeypot fields, submission time traps and per-address rate limits are enforced on every request.
- Encrypted exports are produced in the browser; the passphrase is never transmitted or stored.
These measures are reviewed whenever the form, the token scheme or the dashboard changes.
Confidentiality and breaches
Everyone with access to lead data is bound by a duty of confidentiality that survives the end of their engagement. Access is granted on a need-to-know basis and is logged.
If a personal data breach occurs, we notify the competent supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it, and we inform affected people without undue delay where the breach is likely to result in a high risk to their rights. Our security address is security@foliora.com.
Minors and data quality
The programme addresses professional and aspiring authors aged sixteen and over. We do not knowingly collect records from children below that age; a record identified as such is deleted on notice.
Data you supply must be accurate. Tell us when it changes and we will correct it. If you provide another person's details — a co-author, for instance — you confirm that you have their consent and that you have shown them this notice.
Changes and contact
Material changes are published on this page with a new version number and effective date. Where a change affects the basis on which we hold your consent, we ask for it again rather than assume it. The current version is 2.0, effective 30 October 2026.
Data protection requests: privacy@foliora.com
General correspondence: hello@foliora.com
Security reports: security@foliora.com