Legal
The short version: by default everything stays in your browser; if you create an account we store your email, your progress and — if you claim a certificate — the name you put on it, and nothing else. A certificate gets a public page only if you turn one on, and you can delete it again in one click. If you tick the box to hear about new editions, we keep that address until you unsubscribe, which takes one click. If you subscribe to the Library, we also keep what Paddle tells us about your payments, never your card details. No ads, no profiling, no selling data. We count page views with a tool that sets no cookies and cannot tell one reader from another.
Effective 7 August 2026 Updated 9 October 2026Updated 1 December 2026
The controller of any personal data processed through this Site is Simple Digital Partners Ltd, a company incorporated in the Republic of Cyprus, of Sotiras, 2, Tziovani Building, Flat/Office 6, Paralimni, 5286, Famagusta, Cyprus (the “Operator”, “we”). To exercise any of your rights or ask questions about this notice, write to chief@solonpress.com.
The Site runs in your browser. Your chosen profile name, theme preference and test scores, with the day you last took each test, are stored in your browser's local storage on your device, and in any progress files you choose to export. This data never reaches us. Clearing your browser data erases it — use the export feature for a backup.
Review (solonpress.com/review.html): the test questions you missed, with their answers and the dates they come back, are kept in this browser's local storage only. They are never sent to us or to anyone.
If you create an account to sync progress across devices, we process: your email address (as your login and account identifier), a securely hashed password (we never see or store the password itself), your progress (chapter and exam scores, and the day you last took each test, which the account page shows as your reading record), and — if you claim a certificate of completion — the name you enter for it and the dates your certificates were issued, held in your account's own metadata. The purpose is solely to provide the sync and certificate features you asked for; the legal basis is performance of a contract — the service you asked us to provide. Creating an account does not put you on our email list: we use your account address only for the account itself, such as confirming it or resetting your password, and we do not share it with anyone.
Every certificate is private: only you can see it, on your account. On the certificate page there is a switch, off unless you turn it on: “Make a public page for this certificate”. Turn it on and we make a page at an address with a random code, such as solonpress.com/c/7F3A-91C2-D04E-8B16, that anyone with the link can open. The page shows only the name on your certificate, the edition, the month and year it was issued, and the code. It never shows your email address, your scores or anything else about your account. If you change the name for your certificates, every public page you have shows the new one.
The page is not listed anywhere and asks search engines not to index it, but anyone you give the link to can pass it on. To remove it, turn the switch off on the certificate page: we delete the page at once and its link stops working. Deleting your account deletes the page too. We keep a row for each public page (the code, your account, the edition, the name and the issue date) only while the page exists. The legal basis is your consent, given by turning the switch on and withdrawn by turning it off.
If a firm pays for your access, it gives us your work email address so that we can open the editions to your account, and we email you to say so. The firm can see which chapter tests and final exams you have passed, and whether you hold a certificate and a record of learning. A law school or university sees counts only, never names or a student's progress. The firm never sees your answers, the time you spent or the pages you read. The legal basis is our legitimate interest, and the firm's, in knowing whether the training it pays for is done.
A firm that buys the Library gets a code. You join the firm's group by entering that code on your account page, from an account with a confirmed email address. Before you join, the page shows you what the firm will see, and you tick a box to say you have read it. We store which version of that wording you were shown.
What the firm's group admin sees, while you are in the group:
What the firm never sees: your answers, your scores, the time you spent, the pages you read, or any result from before you joined.
The legal basis is legitimate interest (UK GDPR and GDPR Article 6(1)(f)): the firm pays for your access and supervises its staff's training, and it needs to know whether that training is done. We have weighed this against your interests in a short written assessment. The firm may use the overview only to supervise training and must tell its staff that it does so (Terms section 7A).
Your right to object
You can object to the firm seeing your progress at any time, by leaving the group on your account page. The firm then stops seeing you at once. You can also write to chief@solonpress.com.
A university licence opens the Library to accounts whose email address is on the university's domain. To decide this, we check the domain of your account's email address. Once a year we ask you to re-confirm that the address is still yours, with a link you ask for on your account page; after 13 months without it, access through the university pauses until you confirm.
The university sees two counts only: how many accounts there are on its domain, and how many of them opened the Library this licence year. Alumni and guest addresses under the domain (such as alumni.<university>) are not covered and not counted. It never sees your name, your email address or your progress. A count from 1 to 4 is shown as “fewer than 5”, so a count cannot point at one student. The legal basis is our legitimate interest, and the university's, in giving its people the access it pays for.
When you send a suggestion we keep the text you quoted, your suggestion and note, the page it is about, your account id, and the name to credit if you ask for credit. We use it to improve the edition. If you ask for credit and we use your suggestion, we print your name on the edition page. The legal basis for that credit is your consent, which you can withdraw at any time: write to us and we remove your name at the next build. We keep a suggestion for as long as the edition it is about is published. A suggestion we decline is deleted 12 months after we decide.
Some pages carry a short form: an email field and a box, never ticked in advance, beside the words “Email me about Solon Press: new editions and chapters, short lessons from the workbooks, and news about free access. One email a month at most; unsubscribe in one click.” Only if you tick that box and send the form do we add your address to our email list, and we then write to you about new editions and chapters, once a month at most. The legal basis is your consent, which you can withdraw at any time. Nothing else about you is added to the list, and it has nothing to do with whether you have an account.
For each address we keep: the email address, the sentence you agreed to and when you agreed (our record of your consent), which page the form was on and, where the form was about one, which edition, and the date you unsubscribed, if you do. The emails are sent through Resend, an email delivery service acting as our processor.
Unsubscribing takes one click. Every email carries a link that takes you off the list at once, with no sign-in and no questions. After that we keep only the address and the date you left, so that it is never emailed again by mistake. If you would rather we erase it altogether — or want to see what we hold — write to chief@solonpress.com from that address and we will delete it.
After some chapter tests we ask a few optional questions: which role is closest to yours, whether anything was hard to follow, what we should write next, and anything else you want to tell us. You can answer without an account. Each answer is stored with the edition it is about and, if you are not signed in, a random code your browser makes when you first send an answer and keeps in its local storage, so that two answers from the same browser can be told apart. The code is not linked to your name, your email address or your IP address. If you are signed in, the answer is linked to your account instead. If you choose to leave an email address for a reply, we use it only to answer you and never add it to our email list. The legal basis is our legitimate interest in making the workbooks better; please leave personal details out of the free-text box.
Payments are handled by Paddle, acting as merchant of record and as an independent controller of the payment data it collects — see Paddle's own privacy notice for that processing. Your card or bank details go to Paddle and never reach us. What we receive is confirmation that the account with your email address bought a particular edition, which we process to switch on your access and keep it on; the legal basis is performance of the contract you chose to enter.
Payments are handled by Paddle, acting as merchant of record and as an independent controller of the payment data it collects — see Paddle's own privacy notice for that processing. Your card or bank details go to Paddle and never reach us. From Paddle we receive: your customer id, the subscription id, the plan, its status, the dates of the billing period, the date of the next payment, the amount and currency, and invoice numbers. We use them to open your access, keep it open while you pay, and close it when the contract ends. The legal basis is performance of the contract you chose to enter. The same applies to an edition bought before 1 February 2027. Paddle Retain, a Paddle tool that would contact you about failed payments, stays switched off.
We send service emails about your subscription through Resend, acting as our processor: confirmations, reminders before a renewal or the end of a Year Pass, and notes about a failed payment. These are not the email list, and you get them whether or not you joined it. For each one we keep a record that it was sent: which letter, its version, a fingerprint of its text and the date. We keep that record for 6 years, as proof of what we told you. The email address is cleared from the record 30 days after the email is sent.
When you send a cancellation or a withdrawal from solonpress.com/cancel, we keep the email address you typed, your name if you gave one, what you asked for, the reason for an extraordinary cancellation if you gave one, and the time we received it. We keep this for 3 years as proof that we received it. We also keep a keyed fingerprint of your IP address, which cannot be turned back into the address, only to limit how many requests one sender can make. The legal basis is our legal obligation to accept and confirm cancellations, and our legitimate interest in preventing abuse.
When a firm or university asks to pay by invoice, we keep the organisation's name, the contact's name and email address, the billing address, and any VAT and purchase order numbers. We delete the request 12 months after we have handled it; Paddle keeps the invoice itself. The legal basis is performance of the contract the organisation asked for.
Account data, the email list and survey answers are hosted for us by Supabase, a cloud database provider acting as our processor. Access to your progress row is technically restricted to your own authenticated session (row-level security). The email list and the survey answers cannot be read from any browser at all: only our own server code writes them, after checking every field. The same goes for public certificate pages: our server gives out one page at a time, and only to someone who has its code. Subscription records, suggestions, cancel-page requests and invoice requests are kept the same way: no browser can read them.
When you send one of our forms, our server looks at your IP address for a few minutes, only to slow down automated abuse. It is held in the server's memory only, and we never store or log it. The one exception is the cancel page, which keeps a keyed fingerprint of it (see The cancel page).
To know whether anyone is reading, we count visits with Cloudflare Web Analytics, acting as our processor. It measures pages viewed, the site or search engine a visit came from, and the country, browser and device type, all in aggregate. It sets no cookies, stores nothing on your device and does not follow you to other sites; it cannot build a profile of you or tell one reader from another. Your IP address is processed briefly by Cloudflare to derive the country and is not stored against you. The legal basis is our legitimate interest in knowing how the Site is used, and because nothing is read from or written to your device, this measurement needs no consent. It is the only measurement tool on the Site, and switching it off would leave us counting nothing.
The Site sets exactly one cookie of its own, and only after you sign in: a short-lived access pass (an hour at most) that lets our server show you the paid chapters your account may read. To work out which editions a launch account keeps, our server reads the date the account was opened, which our account system records anyway, and, for an account opened from 15 October 2026, whether its address was on our email list before then (see Launch access in the Terms). The pass identifies what your account may read, not your behaviour — nothing is tracked, measured or shared with anyone. What the Site keeps in your browser's local storage — your theme, your progress with the day you last took each test, the last chapter you opened (so the home page can offer to take you back to it; it stays on this device and is never sent to us), the questions you missed (so Review can bring them back; they too stay on this device) and, if you sign in, your session token — is likewise stored strictly to provide features you have asked for. Two small entries appear only after you act: a note that this browser has signed up for email, so the form does not ask again, and the random survey code described above, made only when you send an answer. That is why there is no cookie banner: strictly necessary cookies are the only kind here, and they need no consent. The Paddle checkout, where you choose to use it, sets its own strictly necessary cookies for the payment transaction; we deliberately block Paddle's optional analytics component at the browser level, so it never runs on this Site.
Account data is kept while your account exists. Ask us to delete your account and we will remove your email, your progress, any certificate details and any public certificate pages from the database. A public certificate page is deleted as soon as you turn its switch off. An address on the email list is kept until you unsubscribe; after that, only the address and the date you left, unless you ask us to erase it. Survey answers are kept while they help us improve the workbooks, and we delete any we can identify as yours when you ask. Payment records for a subscription or Year Pass are kept for as long as the law requires us to keep accounting records. Suggestions, service emails, cancel-page requests and invoice requests are kept for the times given in section 2. Local-storage data is under your control on your device.
Where EU data protection law applies, you have the usual rights: access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority (in Cyprus: the Office of the Commissioner for Personal Data Protection). Exporting your progress from the profile panel gives you a portable copy at any time without asking us.
If we change how the Site handles data, we will update this notice and flag the change on the Site before it takes effect.