This policy explains what personal data StoryForYou collects, how we use it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Data we collect
- Account data: email, display name, password hash, OAuth identifiers (when you sign in with Google), notification preferences.
- Order data: shipping address, child's first name (used to render the book), payment metadata (provider order id, payment id, last-4 of card if your provider returns it; we never store full card details).
- Saved profiles: addresses you choose to save and child profiles you create to reuse across orders.
- Usage data: pages viewed, preview generations, anonymous analytics. Site-wide analytics are cookieless; in-product analytics for signed-in users are off by default and can be opted into.
- Device data: IP address, user-agent, cookies needed to keep you signed in.
2. Why we use it
- To create and personalize the book you ordered.
- To process payment and ship the printed copy.
- To send transactional emails (verify, reset, order updates).
- To detect abuse and meet our legal obligations.
- To send marketing emails only if you opt in. Opt-out at any time
from
/account/profile.
3. Legal bases
Under the DPDP Act we process data based on:
- Contract: to fulfill your order.
- Consent: for marketing emails and product analytics.
- Legal obligation: tax records, payment-provider reconciliation.
- Legitimate interest: fraud detection, account security.
4. Sharing
We share data only with the third-party processors needed to run the service:
- Razorpay (payment processing)
- Resend (transactional email delivery)
- The print fulfillment partner you ship to
- Cloud hosting + storage providers (named in our data processor list, available on request)
We never sell your data.
5. Retention
- Account data: kept while your account is active. Deletion anonymizes the email and clears PII; order records are retained for accounting per Indian tax law (typically 7 years).
- Order data: retained alongside the order for the same accounting window.
- Marketing logs: discarded after 24 months.
6. Your rights
You have the right to:
- Access your data — exportable from
/account(full export coming in a future update). - Correct inaccurate data — most fields are editable in
/account/profile. - Delete your account —
/account/profile→ Delete account. - Withdraw consent for marketing emails at any time.
- Lodge a complaint with the Data Protection Board of India.
7. Cookies
We use:
- Strictly necessary cookies — to keep you signed in and protect against CSRF.
- No advertising cookies. We don't run ad networks.
- Optional product analytics cookies — only when you've opted in.
8. Children's data
StoryForYou is for adults purchasing books for children. We collect a child's first name only as needed to personalize the book and the shipping label. We do not create profiles for children, do not market to them, and do not knowingly collect any other data about them.
9. Changes
Material changes to this policy are notified via email or in-app banner at least 14 days before they take effect.
10. Contact
Privacy questions or rights requests: privacy@example.com.