Privacy Policy

1. What we collect

• Account data — full name, email, country, optional phone (used in receipts and in the per-buyer PDF watermark).
• Order data — books purchased, amounts, Razorpay order/payment IDs, purchase date.
• Audit logs — sign-in events, preview views (anonymous cookie), every download you initiate (IP, user-agent, country derived from IP).

2. Why we collect it

• To authenticate you (Google OAuth / email OTP via Supabase Auth).
• To process payments via Razorpay.
• To watermark every PDF you download with your name and order id.
• To detect abuse (unusual download patterns).
• To comply with Indian tax and audit requirements.

3. Third parties we share with

• Razorpay — payment processing (your name + email + payment details are shared at checkout).
• Resend — transactional email (receipt + sign-in OTP). Receives your email address only.
• Google — when you sign in with Google OAuth, your basic profile (name, email) is shared with us by Google under your consent.
• Supabase + AWS — our database and storage backend hosted in AWS Mumbai (ap-south-1).
• Cloudflare — edge proxy / DDoS protection / CDN.

4. Retention

• Account + order data: 3 years past your last order, then anonymised.
• Download logs: 1 year, then archived to cold storage; deleted at year 3.
• Audit logs (sign-in events): 1 year.
• Contact submissions: until manually purged by support.

5. Your rights (DPDP Act 2023)

You may request a copy of your personal data, request correction of any inaccuracy, withdraw consent, or request erasure (subject to legal-retention obligations). Contact the grievance officer below.

6. Cookies

We use a small number of cookies: Supabase Auth session, currency preference (bss_currency), and an anonymous preview cookie for usage analytics. We do not run third-party advertising trackers.

7. Grievance officer

Thompson Cherian, Pune, India. Contact via the contact form. We respond within 15 business days.