Rishi Katha Books logo Rishi Katha Books

Privacy Policy

This policy applies to Rishi Katha Books — a sole proprietorship firm operating this website and publishing under the name Rishi Katha Books (referred to as "we", "us" or "our" below). We're a small independent press. We collect as little as possible — only what's needed to put a book in your hands, tell you it's on its way, and understand broadly how this little website is used. We don't sell or trade your data. We do advertise on Meta (Facebook and Instagram), which uses a couple of advertising cookies — see "Advertising — Meta (Facebook & Instagram)" below for exactly what that involves. (Last updated: October 2026.)

What we collect, and why

When you place an order, we ask for:

  • Your name, email and phone — to confirm your order, send your receipt, and reach you if the courier has a question.
  • Your shipping address — flat/house no., locality, landmark, city, state and PIN code — so the books reach the right door.
  • What you bought and how much it cost — so we can pack the right books, account for the sale, and honour returns or refunds.

We also check whether your PIN code is serviceable before checkout, so you don't pay for an order we can't deliver.

Payments — handled by Razorpay

All payments are processed by Razorpay, a PCI-DSS compliant payment gateway. Your card, UPI or net-banking details go directly to Razorpay and never reach us. We only receive the payment status and the order reference needed to mark your order paid.

Shipping — handled by Delhivery

Orders are shipped via Delhivery. To create your shipment we share exactly what the label needs: your name, phone number and shipping address. That's the only party your address goes to, and only for getting your books delivered.

Analytics — minimal and aggregate

We keep traffic measurement minimal. We do not build behavioural profiles of visitors, we do not store analytics events in our database, and we set no cookies for analytics. Any traffic statistics we look at are aggregate — how many people saw a page, roughly where they came from — and never identify you as an individual.

Advertising — Meta (Facebook & Instagram)

We run advertising on Meta (Facebook and Instagram) to help new families discover our books. There are two parts to how we measure it: a small Meta Pixel on our pages, and server-side signals sent from our own backend.

The pixel tells Meta which pages you view, which books you look at and add to your cart, and when you start checkout — so our ads can reach people interested in similar books and we can see which ads work. It sets two first-party cookies, _fbp and _fbc, which identify your browser and the ad you clicked.

When you complete an order, our server separately tells Meta that a purchase happened, together with the order value and which books were involved. Before anything is sent, your email address, phone number and name are hashed (one-way SHA-256) so Meta cannot read them — it can only check whether they match an account it already knows. We also send your IP address and browser type to link the event to the ad you clicked. We do not send your shipping address, and we never send your card, UPI or banking details.

Meta processes this information under its own privacy policy and may use it to show you our ads on its platforms; you can limit ad personalisation in your Meta ad settings. The pixel cookies are used only for this advertising measurement.

Emails — sent via Resend

Order receipts are delivered through Resend, our email provider. We email you only about your order — no newsletters you didn't ask for, no marketing blasts. If you ever get mail from us you didn't expect, it's either your own receipt or a reply to something you wrote to us first.

What we never do

  • We never sell, rent or trade your information.
  • We never hand your name, address, email or phone to advertisers in readable form — the ad signals we send are hashed as described above.
  • We never send marketing messages without your explicit sign-up.

Where your data lives, and who can see it

Order records are stored in an encrypted database on Cloudflare's infrastructure (D1), and every connection to this site is over HTTPS. Access to order data is restricted to the founder, and the admin panel sits behind Cloudflare Access authentication. Our books are for children, but our customers are grown-ups — we don't knowingly collect personal information from children.

How long we keep it

Order records are kept as long as we need them for accounting, taxes and dispute resolution. We don't keep analytics records at all. You can ask us to remove your data sooner — see below.

Your rights

Under India's Digital Personal Data Protection Act (2023), and as a matter of simple decency, you may ask us to:

  • Show you the personal data we hold about you,
  • Correct anything that's wrong or incomplete,
  • Erase it, except what we must keep for accounting and legal records,
  • Withdraw consent — you can ask us to stop sending advertising signals about your orders, block or clear the _fbp/_fbc cookies in your browser, and limit ad personalisation in your Meta ad settings.

Grievances

For any question or complaint about how your personal data is handled — or to exercise any right above — write to privacy@rishikatha.com with "Privacy" in the subject line. You'll hear back from a human within a few working days. You may also escalate concerns to the Data Protection Board of India once it is operational.

Changes to this policy

If we ever change what we collect or who we share it with, we'll update this page and change the date at the top. This policy was last reviewed in October 2026.

Related pages: Return & Refund Policy · Contact. Orders are dispatched within 1 day of being placed.