Privacy Policy.

Who we are.

Eilmah (eilmah.com) is run by EILMAH, a sole proprietorship of Nadeem Pasha, registered in Bengaluru, Karnataka, India (GSTIN 29GIFPP9287K1Z4). For anything in this policy, write to contact@eilmah.com.

What we collect, and why.

• Order details — your name, email address, phone number and delivery address, so we can take payment, deliver your books, and send you your invoice and shipping updates.
• Messages — anything you send through our contact form, support email or Instagram, so we can reply and keep a record of how we helped.
• Your Instagram handle — only if you choose to share it after an order, so we can update you where you actually read messages. Saying "stop" always means stop.
• Browsing basics — first-party analytics we keep to ourselves (pages visited, country, how you found us) so we can see what helps readers and what doesn't. We also use Microsoft Clarity to understand, in anonymised form, how visitors scroll and tap around the site.

Payments — what we never see.

All payments are processed by Razorpay, our RBI-regulated payment partner. Your card number, UPI PIN and banking credentials go directly to Razorpay over their secure, 3-D Secure checkout — they never touch our servers and we never store them. We receive only a confirmation of payment and the details we need for your invoice.

Signing in without passwords.

Your account uses one-time email codes instead of a password — so there is no Eilmah password to remember, and none for anyone to steal.

Cookies & local storage.

We keep it minimal, and here is all of it:

• your shopping bag, so it survives a page reload;
• your sign-in session, once you log in;
• a referral code when you arrive through one of our community partners' links, so their recommendation is credited;
• a visitor id for the analytics above — never shared with advertisers;
• Meta's measurement cookie (the Meta pixel), so we can see whether our Instagram and Threads posts lead to orders. It tells Meta (Facebook, Instagram, Threads) about page views, when someone spends a minute or more reading a book's page, when a book is added to the bag, the checkout steps, and the value and currency of an order. We never send it book titles, and never your name, email, phone or address. Like anything a web page loads, Meta can also see the web address of the page you are on (on a book's page, that address includes the book's name).

Your choice about Meta's cookie. In the UK, the EU, Switzerland and Canada — and whenever we can't tell where you are — it runs only if you tap Allow. (We go by the country our site detects for prices, or your device's time zone until it has.) Everywhere else it runs by default, and a small notice lets you choose "No thanks"; you can also use the button below at any time. It never runs if your browser sends a Global Privacy Control signal, and you can also switch it off by opening eilmah.com/?adconsent=no.

Don’t track me

Who we share data with.

Only the services that make the store work, and only what each needs: our payment partner (Razorpay), our courier and logistics partners (your name, address and phone — it's what goes on the shipping label), our email delivery service (your address, to send order emails), and our cloud hosting and database providers (where order records securely live). We never sell your data, and we never hand your name, email, phone or address to advertisers.

Emails from us.

Ordering means we'll email you the essentials: receipts, ebook delivery, shipping and delivery updates, and a reminder if a payment was left unfinished. Very occasionally we send news about the books — if you'd rather not receive those, one reply saying so is enough and we'll stop.

How long we keep things.

Order and invoice records are kept for as long as Indian tax law requires. Everything else we keep only while it's useful for serving you.

Your rights.

It's your data. Email contact@eilmah.com at any time to see what we hold about you, correct it, or have it deleted (we'll keep only what tax law obliges us to). We answer these requests personally, usually within a few days.

Security.

The site runs entirely over HTTPS, payment is handled by Razorpay's PCI-DSS-compliant systems, our databases are access-controlled and encrypted in transit, and ebook files are delivered through expiring, signed links. No system is perfect, but we treat your data the way we'd want ours treated.

Changes to this policy.

If we change this policy meaningfully, we'll update the date at the top of this page. Questions about any of it — just ask.