Privacy Policy

The short version

• We collect only what the service needs to work — there is no advertising, no ad SDKs, no tracking for marketing, and we never sell personal information.
• Student accounts are created and managed by schools, never by students themselves.
• Student data is limited to what a school library card would hold: name, school, date of birth, the books assigned to them, and one device identifier used for security.
• Schools control their students' records, including correction and deletion.

Information we collect

From publishers

• Company name, contact name, and email address (account registration)
• Payout and subscription details, handled by Stripe — we never see or store full banking or card numbers
• The books you upload and their sales records

From schools

• School name, country, and administrator contact details
• Payment card details, handled by Stripe — we store only a reference token and the card's brand, last four digits, and expiry for display
• Purchase history and how purchased copies are assigned to students

About students (provided by their school)

• First and last name, date of birth, and (optionally) a school-issued email address
• Current school and, for transferred students, the name of their former school
• The books assigned to them and the reading licenses issued for those books
• One app-scoped device identifierfrom the VTABU Reader app (Android's application-scoped SSAID). It exists so each student account works on a single registered device — a security and anti-sharing measure. It is not an advertising identifier, cannot identify the student across other apps, and we collect no hardware identifiers such as IMEI, MAC address, or serial numbers.

The VTABU Reader app collects nothing else: no location, no contacts, no photos, no microphone or camera access, and no analytics or advertising SDKs.

Children's privacy (COPPA)

Students — including children under 13 — can only use VTABU through an account their school creates. In line with the U.S. Children's Online Privacy Protection Act (COPPA), we rely on the schoolto provide consent for the collection of student information, acting in the parent's stead for the educational context, and we collect from children only the information reasonably necessary to provide the reading service. We do not use student information for advertising or marketing of any kind, we do not build profiles of students for any non-educational purpose, and students cannot make purchases, create accounts, or share content through VTABU. Parents and guardians may review, correct, or request deletion of their child's information at any time through the child's school, or by contacting us directly at info@bazerm.com.

Student education records (FERPA)

For schools in the United States, student information in VTABU may form part of the school's education records under the Family Educational Rights and Privacy Act (FERPA). We act as a service provider to the school with a legitimate educational interest: the school owns and controls its students' records, we use them solely to provide the service to that school, and we do not disclose them to third parties except as described in this policy or as the school directs.

How we use information

• To operate the platform: accounts, catalog, purchases, book assignment, and reading
• To secure content: issuing per-student reading licenses (Readium LCP digital rights management) and enforcing the one-device rule
• To process payments and publisher payouts (via Stripe)
• To send transactional email such as registration decisions and purchase receipts (via Amazon SES) — never marketing email to students
• To provide support and keep the service safe and reliable

Who we share information with

We share information only with the service providers that run the platform, and only what each needs:

• Auth0 (Okta) — sign-in and account security
• Stripe — payments, payouts, and subscriptions
• Amazon Web Services — hosting, book file storage and delivery, and transactional email
• Supabase — database hosting

Schools can see the students they manage, and publishers see aggregate sales of their own books — never individual student identities. We do not sell personal information to anyone, and we do not share it with advertisers or data brokers. We may disclose information if required by law, or to protect the rights and safety of our users.

Data retention and deletion

We keep information for as long as the related account is active. Accounts are created by us or by schools — there is no self-service account creation in the VTABU Reader app — so deletion follows the same path: a school can remove a student's data by contacting us, and any user (or a student's parent or guardian) can request deletion of their personal information by emailing info@bazerm.com. We honor verified requests within 30 days, except for records we must keep by law (for example, payment records required for tax purposes).

Security

All data moves over encrypted connections (TLS). Book files are stored encrypted and delivered through signed, expiring links. Reading licenses use the Readium LCP standard. The reader app blocks screenshots and screen recording of book content. Access to production systems is limited to authorized personnel.

Your rights

Depending on where you live (including under the EU General Data Protection Regulation), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Students and parents can exercise these rights through the student's school or directly with us. Contact info@bazerm.com and we will respond within 30 days.

Changes to this policy

If we make material changes, we will update the effective date above and notify registered publishers and schools by email before the changes take effect. Because students cannot receive marketing email, schools are responsible for informing students and parents of changes where required.

Contact

Bazerm LLC · operator of VTABU
Email: info@bazerm.com
Web: www.bazerm.com