Twice Loved Tales
Last updated: 6 April 2026
Twice Loved Tales (“we”, “us”, “our”) is an eco-friendly secondhand bookstore based in the United Kingdom. We sell mystery-wrapped pre-loved books through our website at twicelovedtales.com.
This privacy policy explains how we collect, use, store and protect your personal data when you visit our website, use our voice assistant (EllieBot), or make a purchase. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Data Controller: Twice Loved Tales
Website: https://twicelovedtales.com
Contact Email: info@twicelovedtales.com
If you have any questions about this privacy policy or how we handle your data, please contact us at the email address above.
2. What Data We Collect
2.1 When You Visit Our Website
When you browse our website, we collect minimal data:
- A customer identifier — a randomly generated code stored in your browser (via a cookie and local storage) so we can recognise you if you return. This does not contain your name, email, or any personal information.
- Standard server logs — your IP address, browser type, and pages visited may be recorded in standard web server logs.
We do not use third-party analytics services, advertising trackers, or social media tracking pixels.
2.2 When You Speak with EllieBot (Our Voice Assistant)
EllieBot is our AI-powered voice assistant that helps you discover books. When you use EllieBot:
- Voice audio — your voice is streamed in real time to our speech-to-text provider for transcription. Your audio is processed in real time and is not recorded or stored by us.
- Conversation transcript — the text of your conversation (what you said and what EllieBot said) is saved so we can improve our service and assist you in future visits.
- Book preferences — if you tell EllieBot about genres, authors, or moods you enjoy, we save these preferences to help recommend books that match your taste.
- Bookshelf photos — if you choose to upload a photo of your bookshelf, the image is analysed by an AI vision service to identify the books you already own. Both the photo and the list of identified books are saved to your customer profile. This allows us to avoid recommending books you already have and, with your consent, to notify you when new stock arrives that complements your collection.
2.3 When You Share Your Contact Details
If you choose to share your email address, phone number, or name with EllieBot (for example, to reserve a book or join a waitlist), we store this information in our customer database. This is entirely voluntary — EllieBot will ask, but you are never required to provide it.
We collect:
- Email address — to send you notifications about book holds, waitlist availability, and order updates.
- Phone number — to send you SMS notifications (if you provide one).
- First name — to personalise our communications.
2.4 When You Reserve a Book (Hold System)
When you ask EllieBot to hold a book for you:
- We create a 24-hour reservation linked to your contact details.
- We send you a confirmation email and/or SMS with a link to purchase.
- We send reminders before your hold expires.
- We keep a record of your hold history.
2.5 When You Make a Purchase
When you buy a book through our store, we collect standard order information:
- Name, email address, and delivery address.
- Order details (items, quantities, prices).
- Payment information is processed securely by our payment provider — we do not store your card details.
2.6 When You Request a Callback
If you ask EllieBot to schedule a callback, we store your phone number, your preferred date/time, and a brief summary of what you were discussing so we can help you when we call back.
3. How We Use Your Data
We use your data for the following purposes:
| Purpose | Legal Basis (UK GDPR) |
|---|---|
| To process and fulfil your orders | Performance of a contract |
| To manage book holds and waitlists | Legitimate interest |
| To send you notifications about your holds, waitlist items, and orders | Performance of a contract |
| To remember your book preferences and provide personalised recommendations | Legitimate interest |
| To improve EllieBot and our service quality | Legitimate interest |
| To detect and prevent fraud or abuse of our hold system | Legitimate interest |
| To send you marketing communications about new stock matching your interests | Consent (where given) |
We will never sell your personal data to third parties.
4. Who We Share Your Data With
We share your data only with the service providers necessary to operate our store and voice assistant. These providers process your data on our behalf and are contractually required to protect it.
Voice and AI Services
| Category | Data Shared | Purpose | Location |
|---|---|---|---|
| Speech recognition provider | Voice audio stream | Converts your speech to text in real time | USA |
| Voice synthesis provider | EllieBot’s text responses | Converts EllieBot’s responses to natural speech | USA/EU |
| AI language model provider | Conversation text | Powers EllieBot’s understanding and responses | USA |
| AI vision provider | Bookshelf photos, book cover images | Identifies books from photos | USA |
| Real-time communication provider | Voice/audio streams, session data | Manages the real-time voice connection | Germany (EU) |
Communication Services
| Category | Data Shared | Purpose | Location |
|---|---|---|---|
| Email delivery provider | Email address, notification content | Sends email notifications | EU |
| SMS delivery provider | Phone number, SMS content | Sends SMS notifications | USA |
Payment and Hosting
| Category | Data Shared | Purpose | Location |
|---|---|---|---|
| Payment gateway provider | Payment details (processed by them, not stored by us) | Payment processing | EU |
| Cloud hosting provider | All data is hosted on our servers | Web hosting | Germany (EU) |
International Data Transfers
Some of our service providers are based in the United States. Where your data is transferred outside the UK/EEA, it is protected by appropriate safeguards including Standard Contractual Clauses (SCCs) and the providers’ compliance with applicable data protection frameworks. You may request the names of our specific service providers by contacting us at info@twicelovedtales.com.
5. Cookies and Browser Storage
We use minimal cookies and browser storage:
| Name | Type | Purpose | Duration |
|---|---|---|---|
tlt_cid |
Cookie | Recognises returning visitors so EllieBot can recall your preferences | 1 year |
tlt_customer_id |
Local Storage | Backup of visitor identifier (same purpose as above) | Until cleared |
| WordPress session cookies | Cookie | Manages your login and shopping cart | Session |
We do not use advertising cookies, analytics cookies, or third-party tracking cookies. Because we only use strictly necessary and functional cookies, we do not require a cookie consent banner under UK GDPR. However, you can clear these cookies at any time through your browser settings.
6. How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Customer contact details (email, phone, name) | Until you ask us to delete them |
| Conversation transcripts | 12 months, then anonymised |
| Book preferences and interests | Until you ask us to delete them |
| Bookshelf photos and identified books | Until you ask us to delete them |
| Hold and waitlist records | 12 months after completion/expiry |
| Order information | 6 years (UK tax and accounting requirements) |
| Notification records | 12 months |
| Browser identifier (cookie/local storage) | 1 year (auto-expires) |
7. How We Protect Your Data
We take the security of your data seriously:
- All data is transmitted over HTTPS (encrypted in transit).
- Our servers are hosted in Germany (EU), a GDPR-compliant hosting provider.
- API keys and service credentials are encrypted at rest using AES-256 encryption.
- Our admin dashboard is protected by authentication, per-user permissions, and rate limiting.
- We perform daily encrypted backups with 30-day retention.
- We do not store your payment card details — these are handled entirely by our payment provider.
8. Your Rights
Under UK GDPR, you have the following rights:
- Right of access — you can request a copy of the personal data we hold about you.
- Right to rectification — you can ask us to correct any inaccurate data.
- Right to erasure — you can ask us to delete your personal data (subject to legal retention requirements).
- Right to restrict processing — you can ask us to limit how we use your data.
- Right to data portability — you can request your data in a portable format.
- Right to object — you can object to processing based on legitimate interest.
- Right to withdraw consent — where we process data based on your consent (e.g., marketing), you can withdraw it at any time.
To exercise any of these rights, please contact us at info@twicelovedtales.com. We will respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: https://ico.org.uk
- Telephone: 0303 123 1113
9. Children’s Privacy
Our website and voice assistant are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. Marketing Communications
We will only send you marketing communications (such as notifications about new books matching your interests) if you have given us your consent. You can opt out of marketing at any time by:
- Replying to any marketing email with “unsubscribe”.
- Contacting us at info@twicelovedtales.com.
This does not affect transactional messages (hold confirmations, order updates, etc.), which are necessary to fulfil our service to you.
11. Automated Decision-Making
EllieBot uses artificial intelligence to understand your preferences and recommend books. This is not automated decision-making that produces legal or similarly significant effects — it simply helps you discover books you might enjoy. You can always ask EllieBot for different suggestions or browse our store directly.
Our AI-powered book scanning system (used internally by staff) uses image recognition and AI to identify and catalogue books. This does not involve customer data.
12. Changes to This Policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically.
13. Contact Us
If you have any questions, concerns, or requests regarding your personal data or this privacy policy, please contact us:
Twice Loved Tales
Email: info@twicelovedtales.com
Website: https://twicelovedtales.com