Privacy Policy

Last updated: September 14, 2026

This policy explains what Samuel Jonathan Medrano Zamorano, trading as Best Only Shop and operating from Mexico, collects when you buy from or use bestonly.shop, why, and what you can ask us to do about it. We keep as little as the shop can run on.

We do not sell your personal information. We do share limited data with Meta to measure our advertising — what that is, and how to stop it, is set out under Cookies below.

What We Collect

• Your email address. Required. It is your account, and it is where your receipt and your access links go.
• A password. Stored only as a salted cryptographic hash. We cannot read it and cannot tell it to you.
• A name and a profile photo, if you add one. Both optional. A photo is reviewed by a person before it becomes visible, and you can remove either at any time.
• Your time zone. Reported by your browser, used only to decide when “tomorrow” starts for the audiobook chapters that open one a day.
• Order records. What you bought, when, the amount, the status, and the Stripe reference for it. We need these to give you access and to keep our books.
• Download records. Which file was downloaded, when, and the IP address it was downloaded from. This is how we notice one account being shared by many people, and it is the only place we log an IP.
• Sign-in tokens. Short-lived, single-use, and deleted after use or expiry.

We never see your card details. Card numbers are entered into Stripe’s own fields and go to Stripe, not to us. We receive only the outcome of the payment and a reference for it.

Why We Are Allowed To

We use this information to deliver what you bought, to run and secure your account, to answer you when you write, to prevent fraud and account sharing, and to meet tax and accounting obligations. Where the UK or EU GDPR applies, our lawful bases are performance of our contract with you (delivery and account access), our legitimate interests (security, fraud prevention, and answering support), and legal obligation (financial records).

We do not use your information to make automated decisions with legal effects, and we do not profile you.

Email You Receive

We send transactional email: your receipt, access and password links, notice when your password changes, and replies to what you write to us. These are part of the service and are not marketing. If we ever start a mailing list it will be opt-in, and every message will carry an unsubscribe link.

Who Else Processes It

Only the services the shop is built on, and only for what they do for us. None of them is permitted to use your information for their own purposes.

• Stripe — payment processing and fraud checks.
• Resend — sending email.
• Supabase — the database and the file storage your library is served from.
• Vercel — hosting the site.
• Upstash — rate limiting, to keep the sign-in and checkout endpoints from being hammered.

We will also disclose information if the law requires it, and we would transfer it as part of a sale or reorganisation of the business — in which case this policy would continue to apply until you were told otherwise.

Where It Lives

Our providers operate in the United States and elsewhere, so your information may be stored or processed outside the country you live in, including in a country whose privacy law differs from your own. Where required, our providers rely on standard contractual clauses for those transfers.

Cookies

One cookie, to keep you signed in. It is strictly necessary, so it is set without asking. It lasts up to thirty days, and signing out clears it. We also store your dismissal of the cookie notice in your own browser, which never leaves your device.

We run advertising on Facebook and Instagram, and we use Meta’s pixel to find out which of those ads actually lead to a sale. It sets cookies in your browser (_fbp and _fbc) and reports the pages you open here, along with a purchase if you make one.

When you buy, our server also reports that sale to Meta directly. Your email address is hashed before it is sent — turned into an irreversible string — so Meta can recognise an existing customer without us handing over the address itself. We never send your name, your address, or anything you read in the book.

To stop it: use your browser’s tracking protection or an ad blocker, or turn off off-Meta activity in your Facebook or Instagram settings. Nothing here is required to buy, and blocking it does not affect your purchase, your access, or your refund rights.

Stripe sets its own cookies on the checkout fields for fraud prevention; see Stripe’s privacy policy for those.

How Long We Keep It

Your account and library for as long as you keep the account. Order and payment records for as long as tax and accounting law requires them, typically seven years, even after an account is closed. Download logs for up to twelve months. Sign-in tokens until they are used or expire.

Your Rights

Wherever you live, you may ask us to show you what we hold, correct it, delete it, or send you a copy. Depending on where you live — for example under the GDPR, the UK GDPR, PIPEDA in Canada, or the CCPA/CPRA and similar state laws in the United States — you may also have the right to object to or restrict certain processing, to withdraw consent, and not to be treated differently for exercising any of these rights. We do not sell or share personal information, so there is nothing to opt out of on that front.

Write to hello@bestonly.shop from your account email address and we will answer within thirty days. Deleting your account ends your access to what you bought, so download your files first. We keep the order record itself, as the law requires, with the personal detail stripped out of it.

Samuel Jonathan Medrano Zamorano is the party responsible for your personal data. If you are in Mexico, this notice serves as our aviso de privacidad under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, and you may exercise your ARCO rights — access, rectification, cancellation, and objection — at the address below.

If you are in the EU or UK you may complain to your local data protection authority; in Canada, to the Office of the Privacy Commissioner; in Mexico, to the competent data protection authority. We would rather you wrote to us first.

Security

Traffic is encrypted in transit. Passwords are hashed, never stored in readable form. Files are served through short-lived signed links tied to your account rather than from public URLs. No system is perfectly secure, but if a breach ever affected your information we would tell you and the relevant regulator as the law requires.

Children

This shop is for adults. We do not knowingly collect information from anyone under 18. If you believe a child has given us information, write to us and we will delete it.

Changes

If this policy changes, the new version and its date appear here. Material changes will be announced by email or a notice on the site before they take effect.

Contact

Samuel Jonathan Medrano Zamorano, trading as Best Only Shop. Mexico. Email hello@bestonly.shop. See also our Terms of Service and Refund Policy.