Privacy
Privacy policy
What this site collects about you, why it needs it, who else sees it, and how to get it back or get rid of it.
Last updated: 24 August 2026
Who is responsible
This site is run by Sebastian Howarth, a sole proprietor trading under that name, of Unit 6, 6 Protea Place, Morningside Manor, Sandton, Gauteng 2196, South Africa. Sebastian Howarth is the responsible party for the purposes of the Protection of Personal Information Act.
For anything on this page, including a request to see or delete your information, write to seb@sebastianhowarth.com or use the contact form.
What is collected, and why
If you pre-order a book
- Your name and email address — to confirm the order and to reach you about it. If a checkout is left unpaid, that includes a single email asking whether something went wrong; there is never a second.
- Your delivery address — to post the book. Not collected for eBooks or audiobooks.
- Your phone number — optional, and only used if a delivery goes wrong.
- How you would like the book signed — optional, and only offered on South African orders.
- Delivery notes — optional, whatever you tell us about getting the parcel to you.
- Your IP address and browser — recorded with the order, to investigate fraudulent or duplicated orders.
Card details are never collected by this site. Payment happens on PayFast's own pages. Nothing about your card reaches this server — only PayFast's confirmation that a payment succeeded, the amount, and their transaction reference.
Lawful basis: performing the contract you entered into by ordering, and our legitimate interest in keeping records of sales.
If you join the newsletter
- Your email address — held by Brevo, our newsletter provider, until you unsubscribe.
- Your name — only if you joined by ticking the box while pre-ordering, so the newsletter can greet you properly.
The box on the pre-order form is never ticked for you. If you leave it alone, your address is used for your order and nothing else. Ticking it records the date you agreed, which is what allows us to email you later.
Lawful basis: your consent, which you can withdraw at any time using the unsubscribe link on every newsletter.
If you use the contact form
- Your name, email address and message — emailed to the author so he can reply. The message is not stored on the site beyond the queue that delivers it.
The form used to be handled by a third party called FormSubmit, which received every message. It no longer is: messages now go through our own server and out via Resend, so one fewer company sees your mail.
If you just read the site
Ordinary web server logs record the request and the IP address that made it, which is how any web server works, and they are kept only for security and debugging. There is no Google Analytics and no profiling of readers by us.
If you accept cookies, Meta's advertising pixel loads. It tells Facebook that this site was visited, and which page, so that advertising for the book can be measured — how many people who saw an ad went on to pre-order. Meta can connect that to your Facebook or Instagram account if you have one, and it identifies your browser across other sites carrying the same pixel. That is tracking, and it is the reason the cookie notice asks rather than assumes.
Decline and it is never loaded. Nothing is requested from Facebook at all — not the script, not an image, nothing. There is no hidden fallback that reports the visit anyway. You can change your mind either way at any time using the button below.
If you are outside South Africa, the price you are shown may include an estimate in your own currency. Your country is worked out on our own server, from a database that lives on it. Your IP address is not sent to anyone to do this.
Cookies and local storage
This site sets very little of its own. Nothing in the first four rows below tracks you. The two after those are set by other companies and load only if you accept the cookie notice. The last row is listed because it is a third party that stores nothing at all.
| Name | Type | What it does | How long |
|---|---|---|---|
| sh-cookie-choice | Local storage | Remembers your answer to the cookie banner, so it stops asking. | 1 year |
| sh-purchase-reported | Local storage | Remembers which orders have already been counted by the advertising pixel, so a refresh does not report the same sale twice. Only set if you accept cookies. | Until you clear it |
| sh-preorder-ref | Local storage | Remembers your order reference so the thank-you page can show it. | Until you clear it |
| sh.sid | Cookie | Signs the author in to the private order area. Never set for ordinary visitors. | 12 hours |
| _fbp | Third-party cookie (Meta) | Set by the Meta advertising pixel to recognise your browser and measure advertising. Only loaded if you accept. | About 3 months |
| _GRECAPTCHA | Third-party cookie (Google) | Set by reCAPTCHA, which stops bots submitting the newsletter form. Only loaded if you accept. | Set by Google |
| None | No cookie (Cloudflare) | The bot check on the contact form uses Cloudflare Turnstile, which sets no cookie and stores nothing in your browser. It is here for completeness, because it is a third party that loads on the contact page whether or not you accept the notice. | Nothing is stored |
The first four are needed for the site to work and do not track you. The Meta and Google entries belong to those companies and load only if you accept in the banner. Meta's is the one that follows you beyond this site. Decline and neither is fetched, and the newsletter form asks again before it loads anything.
Cloudflare's bot check is the deliberate exception. It loads on the contact page whether or not you accept, because it sets no cookie and stores nothing — and because holding it back would mean the contact form stopped working for exactly the people who declined. It sees the message you submit for checking and nothing else: not your visit, not which pages you read, not anything on the rest of the site. You can change your cookie choice at any time:
Who else sees your information
Only where it is needed to actually get you a book. Nothing is ever sold.
| Who | What they get | Why |
|---|---|---|
| PayFast South Africa |
Your name, email address and the amount | To take the payment. They handle your card details, not us. |
| IngramSpark United States, United Kingdom, Australia |
Your name and delivery address | They print and post orders outside South Africa. South African orders are printed and posted by the author, so nothing about them is sent to Ingram. |
| Resend United States |
Your email address, and the contents of order emails and anything you send through the contact form | To deliver your confirmation, your dispatch notice, and your message to the author. |
| Brevo European Union |
Your email address, only if you subscribe | To send the newsletter. |
| Meta (Facebook, Instagram) United States |
That you visited this site, and which pages — if you accept cookies | To measure advertising for the book. Meta may link this to your Facebook or Instagram account. |
| Google (reCAPTCHA) | Signals about your browser, if you accept cookies | To stop bots subscribing to the newsletter. |
| Cloudflare (Turnstile) United States |
Signals about your browser, and your IP address, when you send a message through the contact form | To check that a message came from a person rather than a bot. It sets no cookie, is not tracking, and does not need you to accept the notice. Only the contact form uses it. |
| DigitalOcean London, United Kingdom |
Hosts the server, so technically holds everything above | The site has to run somewhere. |
Ordering from outside South Africa means your delivery address is sent to whichever IngramSpark print site serves your country, so it leaves South Africa. That is unavoidable if a book is to be printed near you and posted to you.
Where it is kept, and for how long
Orders are stored in a database on our own server, not in a spreadsheet or a shared document. Only the author can read it, over an encrypted connection, after signing in with a password.
That server is in London. So although this is a South African business, your order details are stored in the United Kingdom, and the companies listed above are in the United States and the European Union. Your information therefore leaves South Africa. The UK and the EU have data protection laws comparable to POPIA; the United States does not have a single equivalent law, and those companies are used because there is no practical way to print, post and email without them.
- Orders are kept for five years from the end of the tax year they fall in, because South African tax law requires records supporting a return to be kept that long.
- Newsletter subscriptions last until you unsubscribe.
- Contact messages are kept while the conversation is useful, then deleted.
What you can ask for
You can ask us at any time to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong — a misspelled name or a changed address;
- delete what we hold, unless we are required to keep it as a record of a sale;
- stop sending you the newsletter, which the unsubscribe link also does instantly;
- object to what we are doing with it.
Write to seb@sebastianhowarth.com or use the contact form. We will answer within 30 days. If you are not satisfied, you can complain to the Information Regulator of South Africa, or to your own data protection authority if you are in the EU or UK.
Children
This site is not aimed at children, and we do not knowingly collect information from anyone under 18. If a child has ordered without a parent's permission, tell us and we will refund it and delete the record.
Security
The site runs entirely over an encrypted connection. Card details never reach it. The order database is on our own server and is not published anywhere. The private order area is password-protected. No system is perfect, and we will tell you promptly if anything ever goes wrong that affects you.
Changes
If this policy changes, the date at the top changes with it. If the change is significant and you have an order with us, we will email you.