Privacy & Data Protection (GDPR)
When you run a store or a library on Publica.la, you collect personal data from your readers and buyers. This page explains who is responsible for that data under the GDPR (RGPD in Spanish), how we sign a Data Processing Agreement with you, how data leaves the EU, and which cookies your store uses.
Publica.la is operated by Queryloop, Inc., a company in the United States. For the security controls behind everything on this page, see Security & Content Protection.
Who is the controller and who is the processor
For the personal data of your store and library users, you are the controller (responsable del tratamiento) and Publica.la is your processor (encargado del tratamiento). You decide why the data is collected and what it is used for. We process it on your behalf, only to provide the service, and only as your agreement with us and the Data Processing Agreement allow.
This covers your end users (readers, buyers, library patrons and students), the members of your team who use the dashboard, and everything the platform does for your store: accounts, catalog access, purchases and entitlements, reading and listening, support conversations, and the reader's AI tools.
Publica.la acts as an independent controller for a small set of data that we need for our own legal duties or to run the platform:
| Data | Why we are the controller |
|---|---|
| Payment, invoicing and tax records, when Publica.la charges your end users | When your store uses Publica.la's payment gateways, we collect the payment and issue the receipt, so tax law obliges us to keep these records. When your store uses its own payment gateway, you hold this relationship and we stay your processor. |
| Security and operations logs | We keep access logs, fraud and abuse signals to protect the platform for every customer. |
| Platform usage analytics | We measure how the platform is used across all stores with Google Analytics. When your store shows the consent banner, this waits for the visitor to accept analytics cookies. |
| Aggregated statistics | We use aggregated, de-identified data to improve the service. It does not identify your users. |
Data Processing Agreement (DPA)
We sign our standard Data Processing Agreement (DPA, contrato de encargo del tratamiento) with any customer who needs one. It covers everything Article 28 GDPR requires: our instructions, confidentiality, security measures, subprocessors, help with data subject requests and data protection impact assessments, breach notification, deletion at the end of the service, and audits. The EU Standard Contractual Clauses are part of it.
To get the DPA, ask your account manager or write to [email protected]. If your organization has its own processor agreement, send it to us and we will review it.
International data transfers
Publica.la hosts your store's data in the United States, on Amazon Web Services. Storefront images and offline download packages are stored with Cloudflare in North America. Requests reach the platform through Cloudflare's global network, so a visitor in the EU is usually served by a Cloudflare data center in the EU.
Transfers of personal data from the EU, the EEA, the UK and Switzerland to the United States rely on the EU Standard Contractual Clauses (SCCs, cláusulas contractuales tipo) adopted by the European Commission in 2021 (Decision (EU) 2021/914), Module Two (controller to processor). The SCCs are included in our DPA, with the UK Addendum and the Swiss adaptations.
Queryloop, Inc. is not certified under the EU-U.S. Data Privacy Framework (DPF).
Our representative in the EU under Article 27 GDPR is Instant EU GDPR Representative Ltd (GDPR Local), in Ireland.
Subprocessors
We use a small set of providers to run the service. Our core providers hold ISO 27001 or SOC 2 attestations.
| Category | What the provider does |
|---|---|
| Cloud hosting and storage | Runs the application and stores files and backups |
| Database | Stores the platform's records |
| Content delivery and security | CDN, web application firewall, DDoS and bot protection |
| Sends transactional email, such as receipts and password resets | |
| Payments | Processes card and local payments through hosted checkout. We never store card data. |
| Monitoring | Tracks errors and performance |
| AI | Powers the support chat in your store and dashboard, and the reader's AI tools (see AI Transparency & Data Handling) |
The named list of subprocessors, with the country where each one processes data, is available on request. It is also Annex III of the DPA. We tell you before we add or replace a subprocessor, and you can object.
Cookies and similar technologies in your store
Your store uses the cookies below. Use this list to write your store's cookie policy. When you add your own tracking (Google Analytics, Google Tag Manager or a Meta Pixel), you are responsible for declaring those cookies too.
Strictly necessary
These are needed for the store to work, so they do not need consent.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
farfalla_session | Publica.la | Keeps the visitor's session | 2 hours |
XSRF-TOKEN | Publica.la | Protects forms against cross-site request forgery | 2 hours |
session_auth_check | Publica.la | Marks a signed-in session, so pages are not served from cache | 2 hours, signed-in users only |
session_refresh_token | Publica.la | Keeps the reader signed in | 30 days, signed-in users only |
cart-session-id | Publica.la | Keeps the shopping cart | 30 days |
gdpr-cookie-consent | Publica.la | Stores the visitor's cookie choices | 1 year, only when the consent banner is on |
cookieconsent_status | Publica.la | Stores that the visitor closed the cookie notice | 1 year, only when the consent banner is off |
__stripe_mid, __stripe_sid | Stripe | Fraud prevention on checkout and reader pages | 1 year, 30 minutes |
__cf_bm | Cloudflare | Bot protection | 30 minutes |
_GRECAPTCHA | Google (reCAPTCHA) | Bot protection, only when a security check is shown | Up to 6 months |
Analytics
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_ga, _ga_ME9C6BTTMM | Google (Publica.la's Google Analytics) | Measures how the platform is used, across all stores | Up to 2 years |
utms | Publica.la | Attributes a visit to the marketing campaign that brought it (UTM parameters and referrer), for your store's sales reports | 7 days |
Publica.la also uses Fathom Analytics, which does not use cookies and does not identify visitors.
Tracking that you add
These load only when you configure them in Dashboard → Settings → Marketing. You are the controller of this data.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_ga, _ga_<your id> | Google Analytics (your property) | Your own analytics | Up to 2 years |
| Cookies set by your container | Google Tag Manager (your container) | Depends on the tags you add | Depends on the tags |
_fbp, _fbc | Meta Pixel | Advertising and conversion measurement | 90 days |
If you configure Meta's Conversions API, the platform sends purchase events to Meta from our servers. The legal basis for those events is your decision.
Browser storage
The store and the reader also keep a few values in the browser's local storage: the cart identifier, an identifier for the current reading session (30 minutes), interface preferences (theme, dismissed notices, text-to-speech voice) and, when the support chat is on, a support chat session identifier.
Consent banner
Your store can show a consent banner. When it is on, the analytics cookies above, and any Google Analytics, Google Tag Manager or Meta Pixel you add, load only after the visitor accepts analytics cookies. The visitor can change the choice at any time from the link in the store's footer. To turn the banner on, ask your account manager.
Requests from your users
When one of your users asks to access, correct, delete or export their data, they can write to you or to [email protected]. We help you answer every request on time. A request that reaches us about your store is forwarded to you, because you decide how to answer it.
Contact
| Topic | Contact |
|---|---|
| DPA, international transfers, subprocessors, questions from a supervisory authority | [email protected] |
| Requests from end users about their data | [email protected] |
| Security vulnerabilities and incidents | [email protected] |
Glossary
| English | Español | Português |
|---|---|---|
| Controller | Responsable del tratamiento | Controlador |
| Processor | Encargado del tratamiento | Operador |
| Subprocessor | Subencargado del tratamiento | Suboperador |
| Data Processing Agreement (DPA) | Contrato de encargo del tratamiento | Acordo de tratamento de dados |
| Standard Contractual Clauses (SCCs) | Cláusulas contractuales tipo | Cláusulas contratuais padrão |
| International transfer | Transferencia internacional de datos | Transferência internacional de dados |
| Data subject request | Solicitud de ejercicio de derechos | Solicitação do titular |
| Data Protection Officer (DPO) | Delegado de Protección de Datos (DPD) | Encarregado (DPO) |