Last updated 24 October 2026
Privacy Policy
This policy explains what personal data Voracious Club collects, why we collect it, how we share it, and how long we keep it when you browse the storefront, create an account, place an order, or contact us.
Voracious Club is operated by Cognitive Engineering Ltd, trading as Voracious Club. Cognitive Engineering Ltd is the data controller for the personal data described in this policy.
What this means
Plain English version: we collect the data needed to sell and deliver books, support your account, and meet our legal obligations.
0. Who we are
Cognitive Engineering Ltd trading as Voracious Club is the data controller. Our registered office and company registration details are on the Company details section of Contact Us.
For privacy requests, email hello@voracious.club. You can also use our contact form or reply to an existing order email if your request relates to an order.
1. What we collect
We may collect your name, billing and delivery addresses, email address, phone number, account credentials, order history, product preferences, favourites/likes, bag contents, and any messages you send us about an order or listing.
Where payments are made, payment information is handled through our payment providers. We do not needlessly store full payment card details ourselves.
We also collect technical and transactional data needed to run the storefront properly, including IP address, browser data, device/session data, cookie preferences, locale or region selection, login/session cookies, and bag identifiers.
2. How we use it
We use personal data to create and manage your account, process payments, arrange shipping, send order updates, respond to support requests, maintain accounting and tax records, detect fraud, and comply with our legal obligations.
If you choose to subscribe to our newsletter, we use your email address to send book recommendations, new arrivals and occasional offers. This is optional and based on your consent, separate from creating an account or ordering. We send a confirmation link before activating your subscription. You can withdraw consent using the unsubscribe link in a newsletter or Newsletter preferences in your account. Order emails and requested want-list alerts are managed separately.
Our lawful bases include contract where we need data to process and fulfil orders, legal obligation for tax/accounting and compliance records, legitimate interests for fraud prevention and customer support, and consent for optional analytics cookies.
3. Cookies & Local Storage
We use essential cookies to keep your bag, login, locale, and region selection working correctly. Personalised shelves are off until you choose Enable For You or Enable personalised shelves. With this separate consent, this browser remembers up to 24 reading interactions and shelf preferences for up to 90 days. For You sends an author/theme summary in a private request and uses current bag contents and accessible account orders and favourites to select books. We do not use these signals for cross-site tracking. Turning off personalisation clears this browser's reading history and shelf preferences. All Shelves uses the public catalogue. Signup includes an unchecked, optional choice to save a one-time copy of up to 24 recent browsing interactions to your account for personalised recommendations. We record the choice, time and wording version. This does not enable ongoing history uploads or analytics. Only interactions from the last 90 days are used; the saved account copy remains until you remove it in Account → Reading preferences or delete your account. You can remove it and withdraw this choice without deleting your orders, chosen favourite genres or favourites.
If you accept analytics cookies, we load Google Analytics using measurement ID G-M6HH2RPELC. Analytics is optional and should only run where you have consented through the cookie banner or cookie policy page.
You can choose starting interests, hide individual recommendations with an undo option, and include other editions of owned books. These preferences are stored in this browser. With analytics consent, we measure shelf impressions, clicks and subsequent favourites, bag additions and purchases, and compare personalised selection with newest arrivals. Click attribution expires after 24 hours or when the tab session ends. Reading-history profiles are not sent to analytics.
Your current setting
No cookie choice saved on this device yet.
Personalised shelves: off
Optional and separate from analytics. For You remembers books and genres you explore in this browser for up to 90 days, and uses saved favourites and order history when signed in. Turning it off clears this browser's reading history and shelf preferences. Account favourites and orders are kept separately.
4. Who we share data with
We share information only where it is needed to run the shop. This currently includes:
- our payment processors: Stripe for cards and wallets such as Apple Pay and Google Pay, and PayPal if you choose to pay with PayPal;
- our hosting providers: Vercel, which hosts the website, and Railway, which hosts our shop system and its database;
- our email provider, Resend, which sends order and account emails and, if you opt in, newsletter confirmations and newsletters, keeps the newsletter subscriber list and records unsubscribe requests;
- Cloudflare Turnstile, which checks that sign-in, sign-up, contact and checkout forms are used by a person rather than a bot;
- the postcode lookup service used at checkout (postcodes.io or Ideal Postcodes), which receives the postcode you type;
- Google Drive, where we keep backup copies of our shop data, including order and account records;
- AI assistant tools we use to help run the shop (such as Anthropic's Claude), for example to tell us about new orders, which may process the order details involved, including names, addresses and items ordered;
- our analytics provider (Google Analytics, only where you consent) and our customer service tools.
If we add other processors, we will update this list before activating them.
We also share delivery names and addresses with third-party couriers and fulfilment partners, including Royal Mail, Evri, and InPost, where needed to dispatch and deliver orders.
We buy delivery labels and find InPost lockers through Sendcloud, so your delivery details are shared with Sendcloud and the carrier you choose.
We may also disclose information where required by law, regulation, court order, or to protect our legal rights.
5. International transfers
Some service providers may process personal data outside the UK. The applicable transfer arrangements depend on the provider and destination. Contact hello@voracious.club to ask about the destinations, applicable safeguards and how to obtain a copy of relevant transfer documents.
6. Retention and your rights
For newsletters, we record your email address, subscription status, consent wording and version, signup source, and request, confirmation and unsubscribe times. Unconfirmed signup records are removed after 30 days. We retain a minimal unsubscribe and consent record to honour your choices and demonstrate consent. A browser preference remembers a dismissed newsletter invitation for 30 days; confirmation suppresses invitations on that browser for up to a year. Newsletter confirmation emails have open and click tracking disabled.
We keep personal data only for as long as we need it for the purpose it was collected. Order, payment, tax, and accounting records may usually be kept for up to six years. Account details are kept while the account remains open. Contact messages are kept while needed for support, disputes, or legal records.
Under UK GDPR and related law, you may have the right to request access to your data, correction of inaccurate data, deletion, restriction of processing and data portability where applicable. Where processing is based on consent, including analytics, optional personalised shelves and newsletter emails, you can withdraw that consent at any time.
Your right to object: you can object to processing based on legitimate interests. You can object to direct marketing at any time; use the unsubscribe link or contact us.
If you want to make a data request, contact us with enough information to identify the account or order involved. We will review it in line with applicable law and usually respond within one month. You also have the right to complain to the Information Commissioner's Office if you are unhappy with how we handle your personal data.