Privacy Policy

You came here to read about a book. This page tells you, completely and in plain language, what happens to your data while you do.

1. Who we are

This site is operated by ST Online Marketing, trading as The 16 Laws, Orionstraat 61, 2615 AS Den Haag, the Netherlands, Chamber of Commerce (KvK) 86606743, VAT ID NL004277591B84. For anything in this policy, write to stevan@the16laws.com. We answer ourselves.

2. What we collect, and why

• Ordering. When you buy the book we receive your name, email address and an address (the shipping address for a printed copy, or the billing address our payment processor asks for with the ebook or the audiobook), and your phone number if you give one. We use them to produce, ship and confirm your order and to give you the ebook and the audiobook. Nothing else. Legal basis: performing our contract with you.
• Payment. Payment happens on the secure pages of our payment processor (Stripe). Your card details go to them, never to us. We receive only the confirmation that you paid. Legal basis: performing the contract.
• Printing and delivery. Each copy is printed on order. Your name, shipping address and phone number (if you gave one) go to our print-and-fulfilment partner, which prints your copy at the facility nearest you and hands it to a postal or courier service for delivery. Legal basis: performing the contract.
• The Weekly Breakdown. If you join, we keep your name and email address to send you the weekly emails, and we read what you write back so that we can answer it. A situation you send us is only used in a breakdown with your OK, and then with every detail that could identify you changed. Legal basis: performing our contract with you.
• Your account and the online book. Every order comes with an account on this site, with no password: you log in with your email address, through a link we email you or the personal link in our emails. To run it and keep it secure, we note logins and the login links we send, with your IP address. In the ebook we keep your place, your reading settings, how far you have read and the time spent on each chapter, and any highlights and private notes you write. Your notes are visible only to you. We use this to run your account, to let you carry on reading on any device, to stop misuse (such as one login shared by many people), and to see which chapters get read so we can improve the book. Legal basis: performing our contract with you, and our legitimate interest in keeping the service secure and improving it.
• Email updates. If you sign up for updates on this site, we keep your email address (and your name, if you give it) to send you occasional emails about this book, later editions and related work by the same author. Nothing else. If you buy the book, we may write to you about the same things, because you are a reader of ours. Every such email carries a working unsubscribe link, and replying “stop” works too. Legal basis: your consent when you sign up; when you have bought the book, our legitimate interest in keeping our own readers informed, with your right to object at any time.
• Measurement. With Advertising on, we measure whether an advertisement brought you here, whether you went on to the checkout, and whether you bought. This involves Meta (Facebook and Instagram). We do not use analytics on this site at the moment. In the EU, the EEA and the UK, Advertising stays off until you accept it in the cookie question. Elsewhere it is on unless you switch it off: see the Cookie Policy. Legal basis in the EU, the EEA and the UK: your consent, which you can withdraw at any time.
• Server logs. Our hosting provider keeps standard technical logs (IP address, time, page requested) for security and abuse prevention. Legal basis: legitimate interest.

3. What we do not do

We do not sell or rent your data. We do not build profiles beyond the measurement described in section 2. The only emails we send are the ones about your order and your account (including the login links you ask for), the audiobook when it is out if you ordered it, the Weekly Breakdown if you joined it, and the updates described in section 2. Every update and every Weekly Breakdown email carries a working unsubscribe link. We host our fonts ourselves, so no font network sees your visit.

4. Who receives your data

Only the parties needed to do the work: our payment processor (Stripe), our print-and-fulfilment partner and the delivery services it uses, our hosting provider, our email service provider (MailerLite, based in the EU) for the Weekly Breakdown and the updates described in section 2 (it also holds the personal login link those emails carry), and, for the measurement described in section 2, Meta.

While Advertising is on, a purchase confirmation is also sent from our server to Meta, so the measurement works despite browser restrictions. It carries the order value, the pixel identifiers, your IP address and browser type, and your name, email address, phone number (if you gave one) and the city, region, postal code and country of your address in hashed form, which Meta uses to match the purchase to an account. When you click through to the checkout, our server tells Meta that as well, with the edition and its price, the address of the page you were on, the pixel identifiers, and your IP address and browser type. It does not carry your name, email address or postal address: we do not have them at that point. To stop that channel from being misused, our server keeps a scrambled mark of your IP address, which cannot be read back, for a day at most. For visitors in certain US states, Meta’s Limited Data Use flag is applied where required. There are no other recipients.

5. How long we keep it

Order and invoice data: seven years, because Dutch tax law says so. Your email address on the updates list: until you unsubscribe or ask us to remove you. Your Weekly Breakdown details: for as long as you are subscribed, and what you write to us until you ask us to delete it. Your account’s login records: twelve months, with IP addresses shortened after 30 days. Your reading progress and settings in the ebook: until twelve months after you last read. Your highlights and notes: until you delete them, or ask us to. Your cookie choice: twelve months (six if you declined). Server logs: short-term, on a rolling basis.

6. Your rights

You can ask for access, correction, deletion, restriction or a portable copy of your data, and you can object to processing based on legitimate interest. Withdraw your measurement consent any time via Your Privacy Choices on the cookie page. Write to stevan@the16laws.com and you will get an answer, not a form. If we disappoint you, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

If you are in the United States: state privacy laws such as California’s give some residents rights similar to the ones above. We honour access, deletion and opt-out requests from anyone, wherever you live, and we do not sell your personal information. To stop advertising measurement, use Your Privacy Choices on the cookie page.

7. International transfers

Copies are printed in your own region, and your data stays with the processors named above. Where a processor is based outside the EU (our print partner, Stripe, Meta), transfers happen under the EU–US Data Privacy Framework or standard contractual clauses.

8. Changes

If this policy changes, the change appears here, with the date below adjusted. No silent edits.

Last updated: 14 November 2026