How we collect, use, store, and protect your personal data
At Buymeabook, your privacy is important to us. This policy explains what personal data we collect, why we collect it, how long we retain it, and your rights over it. By using our platform you agree to the practices described below.
Effective date: 1 July 2025 | Last updated: 30 June 2026
Jurisdiction: India — IT Act 2000 & Digital Personal Data Protection Act 2023 (DPDPA).
We do not sell, rent, or lease your personal data to any third party for advertising.
Account & identity data: name, email address, mobile number, and bcrypt-hashed password (never stored in plain text). Profile photo and date of birth are optional.
Transaction & order data: order IDs, book titles, quantities, prices, shipping addresses, delivery PIN codes, payment method type (not card numbers), payment gateway reference IDs (Cashfree), AWB/tracking numbers (NimbusPost), and GST-applicable invoices.
Technical & usage data: IP address, browser type, device identifiers, pages visited, session tokens, and server-side error logs.
Communications data: support tickets, email correspondence, and reviews or ratings you post on the platform.
We never collect or store full card numbers, CVVs, bank credentials, Aadhaar, or PAN numbers. Payment data is handled exclusively by our PCI-DSS compliant gateway (Cashfree).
We process your data to fulfil orders and arrange delivery, process payments, provide customer support, prevent fraud, send transactional notifications, and comply with Indian law (GST Act, IT Act, DPDPA 2023). We do not use your data for profiling or automated decision-making with legal effect.
We retain personal data only as long as necessary for its purpose or as required by law. The schedule below governs all categories:
| Data Category | Retention Period | Basis / Deletion Trigger |
|---|---|---|
| Active customer account (name, email, phone) | Account lifetime + 3 years post last login | Account deletion request or 3-year inactivity |
| Order & transaction records | 8 years from order date | GST Act & accounting standards; auto-archived after 8 years |
| Payment gateway references | 8 years | Financial record-keeping obligation |
| Shipping & AWB records | 3 years from delivery | Logistics dispute window; purged on schedule |
| Support tickets & correspondence | 2 years from ticket closure | Customer service continuity; purged on schedule |
| Server access & error logs | 90 days (rolling) | Security monitoring; cron-based deletion |
| Session data & cookies | Session: browser close; persistent: 30 days | Automatic expiry |
| OTP & verification tokens | 10 min (active) + 24 hr (expired, for audit) | Cron-based cleanup |
| Seller verification documents | Account lifetime + 5 years | Regulatory compliance |
| Deleted account data | 30-day recovery window, then permanent deletion | Irreversible purge (except statutory transaction records) |
| Referral records | 5 years from referral event | Dispute resolution and reward audit trail |
| Anonymised analytics | Indefinite | No personal data; platform improvement only |
Where data is subject to an active legal dispute or court order, normal retention periods are suspended under a legal hold until the matter is resolved. Backups are retained for up to 60 days on a rolling basis and included in purge cycles.
We share personal data only where necessary and with appropriate safeguards. Our service providers — Cashfree (payment processing), NimbusPost (shipping), GoDaddy SMTP (transactional email), and ImageKit (image CDN) — are contractually bound to process data only per our instructions. The relevant seller receives your delivery name, address, phone, and order details solely to fulfil your order; they are prohibited from any other use.
We may disclose data to law enforcement or regulatory bodies when required by Indian law (IT Act 2000, DPDPA 2023, GST Act) or a valid legal order. We do not sell or share your data for marketing purposes.
All data in transit is encrypted via TLS 1.2/1.3. Passwords are stored as one-way bcrypt hashes and never logged. Our servers sit behind a firewall-segmented DMZ network. Sessions are regenerated on login and expire on inactivity. Admin interfaces use PIN-based secondary authentication. In the event of a breach affecting your rights, we will notify you within the timeline prescribed by DPDPA 2023.
We use strictly necessary cookies (login session, cart), functional cookies (UI preferences), and internal analytics cookies (page-view counters). We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers. Disabling cookies in your browser will prevent login and cart features from working.
Under DPDPA 2023 you have the right to access, correct, or erase your personal data; withdraw consent for marketing at any time; and lodge a complaint with our Grievance Officer. To exercise any right, email [email protected] with subject line "Privacy Request – [Your Name]". We will respond within 30 days of a verified request. You may also escalate unresolved complaints to the Data Protection Board of India once constituted.
Our platform is not directed at anyone under 18. If you believe a minor has registered without parental consent, contact us immediately and we will delete the data within 72 hours of verification.
We may update this policy to reflect changes in our practices or applicable law. Material changes will be highlighted on our homepage for 30 days and communicated by email to registered users. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
Grievance Officer: Divyansh Narayanan Singh
Aishbagh, Lucknow, Uttar Pradesh – 226004, India
Email: [email protected]
Phone: +91 94541 13675
Hours: Mon – Fri, 11AM – 5PM IST
