Privacy Policy

1. Introduction & Legal Framework

Welcome to Leafsum ("we," "our," or "us"), operated exclusively by Leafsum Digital, a commercial sole proprietorship established and registered under the laws of the Republic of India, having its principal place of operations in Dehradun, Uttarakhand, PIN: 248001, India.

We are committed to maintaining the privacy, confidentiality, and integrity of your personal information. This Privacy Policy sets out our policies and practices regarding the collection, processing, usage, storage, and disclosure of personal data collected through https://leafsum.com (the "Platform" or "Service").

This document is formulated and published pursuant to:

• The Digital Personal Data Protection Act, 2023 (DPDPA), India;
• Section 43A and Section 72A of the Information Technology Act, 2000;
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); and
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. Categories of Information We Collect

We collect only the minimum personal data strictly required to provision, personalize, and secure our book summaries, audio streaming, and billing infrastructure:

• Identity & Profile Data: Full name, email address, profile avatar, and OAuth identity tokens if you register using third-party social authentication providers (such as Google).
• Authentication Secrets: Passwords hashed using industry-standard salted cryptographic hashing algorithms (Argon2 / Bcrypt). We never view, transmit, or store plaintext passwords.
• Reading & Streaming Telemetry: Reading history, listening completion rates, audio playback timestamps, book queue states, bookmarks, favorites, and saved highlight annotations.
• Commercial & Billing Data: Razorpay Order IDs, Payment IDs, subscription tiers (Free, Monthly Pro, Annual Executive), subscription expiration dates, and invoice records.
  Note on Banking Secrets: All payment instruments (credit/debit cards, UPI PINs, CVVs, and net banking credentials) are processed directly by RBI-authorized payment aggregators (Razorpay). Leafsum Digital never collects, handles, processes, or stores your primary card numbers or banking secrets.
• Technical & Device Metadata: IP address, device type, browser engine, display resolution, preferred UI language (leafsum_locale), and visual theme.

3. Purposes of Data Processing & Legal Grounds

We process your personal data under the following legitimate and lawful grounds permitted by the DPDP Act, 2023:

• Contractual Necessity: Authenticating your login sessions, provisioning access to non-fiction summaries, managing cross-device audio queues, and issuing printable tax invoices.
• Consent: Delivering optional editorial notifications, daily free summary recommendations, and weekly reading digests if you have affirmatively enabled them in your preferences.
• Legitimate Business Interests & Security: Preventing brute-force login attacks, defending against automated content scrapers, monitoring API abuse, and optimizing server uptime.
• Legal & Tax Compliance: Preserving commercial transaction ledgers and tax invoice registers as required by statutory financial regulations in India.

4. Cookies, Session Storage & Visual Preferences

Leafsum uses essential cookies and client-side browser storage exclusively for operational stability:

• Strictly Necessary Cookies: We utilize secure HTTP-only cookies (including better-auth.session_token) to maintain authenticated sessions and defend against Cross-Site Request Forgery (CSRF). Disabling these cookies will prevent the web application from logging you in.
• Interface State: Browser storage is utilized to persist your dark/light mode choice, audio volume, playback speed, and reading language.
• Zero Predatory Ad Tracking: We do not sell your telemetry data to third-party advertising brokers or run cross-site behavioral advertising trackers.

5. Sub-Processors & Third-Party Disclosures

We never sell, trade, or monetize your personal data. Personal data is shared strictly on a confidential need-to-know basis with trusted technology partners who maintain strict security standards:

• Payment Aggregation: Razorpay Software Private Limited (India) for payment processing, e-mandates, and billing settlements.
• Transactional Email Infrastructure: Amazon Web Services (AWS SES, Asia Pacific Mumbai / ap-south-1 region) for sending account activations, password resets, and receipts.
• Database Infrastructure: Managed cloud PostgreSQL instances operating with AES-256 encryption at rest and SSL/TLS in transit.
• Law Enforcement: We disclose personal data only when compelled under a formal judicial summons, court order, or statutory directive issued by an authorized Indian law enforcement agency under applicable law.

6. Data Retention & Permanent Account Deletion

We retain your personal records only for as long as your account remains active or as required by law:

• Account Deletion: You have the right to delete your Leafsum account at any time by navigating to Settings > Account or by submitting a written request to support@leafsum.com.
• Purge Timeline: Upon verified account deletion, your reading history, bookmarks, personal highlights, and credentials will be permanently erased from our production databases within thirty (30) business days, except for historical tax invoices retained under Indian statutory accounting mandates.

7. Your Statutory Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you hold the following statutory rights:

• The right to obtain a summary of personal data processed by us;
• The right to correct inaccurate, misleading, or outdated personal information;
• The right to withdraw previously granted consent for editorial notifications;
• The right to nominate an individual to exercise rights in the event of death or incapacity; and
• The right to file a grievance with our designated Grievance Officer via support@leafsum.com.

8. Grievance Redressal Officer & Communication

In compliance with the Information Technology Act, 2000, and the rules framed thereunder, the contact details of the designated Grievance Officer for Leafsum Digital are provided below:

The Grievance Officer will acknowledge your communication within 48 hours and work to resolve the matter within fifteen (15) business days from the date of receipt.