The short version

We hold as little about your readers as the product allows. We have no advertising business and no data business. Nothing is ever sold, shared for marketing, or used to train anything.

1 · Who holds what

When an organisation runs a library on DITA, that organisation decides what happens to its readers' data. We — AM Consulting LLC, doing business as DITA ("DITA") — hold and process it on their behalf. If you are a reader with a question, ask your library first — they can answer, export and delete without involving us.

2 · What we hold about readers

Readers with accounts

• Whatever identifier the library uses — usually an email address, or a directory identity if they signed in through their school or employer.
• What they have borrowed, and when they returned it.
• Reading position, bookmarks and notes, so a book resumes across devices.
• Basic technical logs needed to run and secure the service.

Readers who joined from a printed code

• The code they used and the device they used it on.
• Their loans and reading position.
• No name, no email, no record number, nothing tied to a chart, a case file or a student record.

Access from a code expires on its date. When it does, the associated record is removed.

3 · What we never collect

• Clinical records, student information system records, or case files. We have no integration with any of them and never request them.
• Location. The product does not ask for or use device location.
• Behavioural profiles. We don't infer interests or recommend by them. What's on a shelf is what a librarian put there.
• Anything for advertising. There is no advertising anywhere in the product and no advertising business behind it.

4 · Where data lives

Each library chooses its hosting region when it is set up. Reader data stays in that region. Changing region is a migration and is done with us rather than by a toggle.

5 · Rights

Readers can ask for a copy of what is held about them, ask for it to be corrected, or ask for it to be deleted. Libraries can do all three from their admin screens without contacting us, and deleting a reader removes their loan history with them.

Where the request comes to us directly, we pass it to the library and support them in answering it.

6 · Children

Where a library serves under-13s, child accounts are created by the institution or a guardian, with consent recorded. A child's reading is visible to their guardian and to nobody else — not to other staff, and not to us.

7 · Who else touches it

We use infrastructure providers for hosting, storage and payments. They process data on our instructions and cannot use it for their own purposes. The current list is available on request and will be published here once the review is complete.

8 · Security

Data is encrypted in transit and at rest. Administrative access requires two-factor authentication. Protected titles are encrypted per loan using the open Readium LCP standard. See the security page for detail.

9 · Retention

Loan history is kept while the reader's access exists. Code-based access and its records expire on their date. After a library cancels, everything is kept for 30 days so an accident can be undone, then removed.

10 · Contact

Use our contact form. If you are a reader, your library can usually answer faster.