Privacy Policy

When you create an account, make a purchase, or interact with this website, we may collect the following categories of personal information:

• Identity Data: Full name, username, or similar identifier.
• Contact Data: Email address.
• Transaction Data: Details of purchases, order numbers, and payment references. We do not store payment card numbers, CVVs, or full bank details — all payment processing is handled exclusively by Razorpay.
• Technical Data: IP address, browser type, device type, operating system, and session identifiers collected automatically via server logs and cookies.
• Usage Data: Pages visited, links clicked, download activity, and time spent on the website.
• Account Data: Your account preferences, purchase history, and download entitlements.

We do not collect sensitive personal data such as government IDs, financial account numbers, health information, or biometric data.

We use your personal information only for the following lawful purposes:

• To create and manage your account.
• To process and fulfil your orders and deliver purchased eBooks.
• To send transactional emails (order confirmations, download links, support responses).
• To provide customer support and resolve disputes.
• To detect, prevent, and investigate fraud, abuse, or security incidents.
• To comply with applicable legal obligations.
• To improve website functionality and user experience (using aggregated, anonymised data).

We do not sell, rent, trade, or share your personal information with third parties for marketing or advertising purposes.

Your data is stored and processed using the following trusted third-party infrastructure providers:

• Firebase / Google Cloud (Firestore & Storage): Account data, order records, and download entitlements are stored in Google Cloud infrastructure. PDF files are stored in private Firebase Storage buckets with no public access.
• Razorpay: All payment processing is handled by Razorpay. We receive only a payment reference ID and status — never raw card or bank data.
• Resend: Transactional emails are sent via Resend. Your email address is shared with Resend solely for the purpose of delivering emails you have requested.
• Vercel: The website is hosted on Vercel. Server logs including IP addresses may be retained by Vercel per their own privacy policy.

Each of these providers operates under their own privacy policies and data processing agreements. We encourage you to review their policies independently.

We use a single, secure HTTP-only session cookie to keep you signed in to your account. This cookie:

• Is set only after you sign in.
• Is marked HttpOnly (inaccessible to JavaScript) and Secure (transmitted only over HTTPS in production).
• Does not contain your password or payment information.
• Expires when you sign out or after a defined inactivity period.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies that identify you personally.

We implement industry-standard technical and organisational security measures to protect your data, including:

• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Passwords are never stored in plain text — authentication is managed by Firebase Authentication using industry-standard hashing.
• PDF files are stored in private cloud storage; download URLs are short-lived, server-generated signed URLs (valid for 1 hour) tied to your verified account.
• Admin access to the platform is restricted to accounts with server-side verified custom claims — no client-side privilege escalation is possible.
• All API routes that handle sensitive operations require server-side authentication verification.
• Payment signatures from Razorpay are cryptographically verified on the server before any order is fulfilled.
• Webhook payloads are verified using HMAC-SHA256 signatures before processing.

While we take all reasonable and commercially practicable steps to protect your personal data, no system connected to the internet can be guaranteed to be completely secure.

By using this website and providing your personal information, you acknowledge and agree that:

• We are not liable for any unauthorised access, data breach, data loss, or data theft that occurs despite our reasonable security measures, including incidents caused by third-party infrastructure providers (Firebase, Razorpay, Vercel, Resend), cyberattacks, zero-day vulnerabilities, or events beyond our reasonable control.
• We are not responsible for the security practices of third-party services linked from or integrated into this website.
• You are responsible for maintaining the confidentiality of your account credentials. We are not liable for any loss or damage arising from your failure to keep your password secure or from unauthorised use of your account.
• In the event of a data security incident that affects your personal data, we will make reasonable efforts to notify you in accordance with applicable law.

Our total liability in connection with any data incident shall not exceed the amount you paid for purchases on this platform in the 12 months preceding the incident.

We retain your personal data for as long as your account is active or as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data is retained until you request deletion.
• Order and transaction records may be retained for up to 7 years for tax and legal compliance purposes, even after account deletion.
• Server logs are retained for a limited period as determined by our hosting provider (Vercel).

Subject to applicable law, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and associated personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your data in certain circumstances.

To exercise any of these rights, contact us via the Contact page. We will respond within 30 days. We may require identity verification before processing your request.

This website is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will take steps to delete such information.

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with an updated "Last Updated" date. Your continued use of the website after any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

This website is operated by an individual based in India and primarily serves users in India. We are committed to compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act).

• Lawful basis for processing: Your personal data is processed on the basis of your consent (given at account creation, checkout, and newsletter subscription) and for the performance of a contract (fulfilling your purchase).
• Purpose limitation: We collect only the personal data strictly necessary for the purposes described in this policy. We do not use your data for any other purpose.
• Data Principal rights: Under the DPDP Act, you (as a "Data Principal") have the right to access, correct, and erase your personal data, and to withdraw consent. To exercise these rights, contact us via the Contact page.
• Cross-border data transfers: Your data may be processed outside India by our infrastructure providers (Google Cloud / Firebase, Vercel, Resend). These transfers are necessary for the operation of the service.
• Grievance Officer: In accordance with applicable Indian law, you may raise a privacy grievance by contacting us via the Contact page. We will acknowledge your grievance within 48 hours and resolve it within 30 days.

For any privacy-related questions, data requests, or grievances, please contact us via the Contact page. We are committed to resolving privacy concerns promptly and in good faith.