Privacy Policy
Last updated: 10 November 2026
In short
This site doesn't use tracking or advertising cookies. I only get your personal details if you buy a signed book, email me or subscribe to my newsletter. I use them only to send your book, answer you, send the newsletter you signed up for and keep the records the law requires. I never sell your data.
Who I am
This website is run by Richard Lister, trading as The Hero Soul (“I”, “me”). I'm responsible for your personal data as the data controller. You can contact me at Rich@RichardLister.com.
What I collect and why
| When | What | Why (lawful basis) |
|---|---|---|
| You buy a signed book | Name, email address, delivery address, the name you'd like the book signed to, and what you bought. Card details go straight to Stripe; I never see them. | To take payment, sign and post your book and deal with any problem with your order (performing a contract). To keep sales records for tax (legal obligation). |
| You email me | Your email address and whatever you choose to tell me. | To reply to you (legitimate interests). |
| You subscribe to my newsletter | Your email address, collected and stored by Substack, plus basic information Substack records about which emails you open. | To send you the newsletter you asked for (consent). You can unsubscribe at any time using the link in every email. |
| You visit the site | Standard technical information sent by your browser, such as IP address, browser type and the page requested, recorded in the hosting provider's server logs. | To keep the site running securely (legitimate interests). |
Buying a book or emailing me doesn't add you to my newsletter. You're only subscribed if you sign up yourself.
Who else handles your data
- Stripe processes payments for signed books and stores your order details. See Stripe's privacy policy.
- Substack runs my newsletter and stores subscribers' email addresses. See Substack's privacy policy.
- Royal Mail (or another courier) receives your name and address so your book can be delivered.
- Render hosts this website and keeps short-term server logs.
- Google Fonts supplies the typefaces on this site, so your browser connects to Google, which receives your IP address. See Google's privacy policy.
- Email: if you email me, your message is held by my email provider.
The Buy online buttons go to Books2Read, which sends you to the bookshop of your choice. Those sites have their own privacy policies, and some links may be affiliate links. That means I may earn a small commission at no extra cost to you.
International transfers
Some of these providers (for example Stripe, Substack, Render and Google) may process data outside the UK, including in the United States. Where they do, they rely on legal safeguards approved under UK law, such as the UK International Data Transfer Addendum or the UK–US data bridge.
How long I keep it
- Order records: six years from the end of the tax year of the sale, as HMRC requires.
- Emails: for as long as we're in conversation, then deleted within two years unless they relate to an order.
- Newsletter: until you unsubscribe.
- Server logs: kept by the host for a short period, usually no more than 30 days.
Your rights
Under UK data protection law, you have the right to:
- ask for a copy of the personal data I hold about you;
- ask me to correct anything that's wrong;
- ask me to delete your data, unless I need to keep it by law;
- object to or restrict how I use it;
- ask for your data in a portable format.
Email Rich@RichardLister.com and I'll respond within one month. If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office (ICO).
Cookies
See the Cookie Policy.
Children
This site isn't aimed at children, and I don't knowingly collect children's data.
Changes
I may update this policy from time to time. The date at the top shows when it last changed.
Also see: Terms of Sale · Cookie Policy