BOOKSTAKEN Privacy Policy
Effective Date: June 10, 2026
Previous Version: March 01, 2026
Bookstaken Pvt. Ltd. ("Bookstaken," "we," "us," or "our") is committed to protecting the privacy of children, parents, and mentors who engage with our 1:1 reading mentorship platform. This Privacy Policy explains what data we collect, why we collect it, how we store it, who we share it with, and what rights you have over it.
By using this Site or enrolling in our services, you consent to the practices described in this Privacy Policy. If you are a parent or guardian enrolling a minor, you consent on their behalf.
1. Who We Are
Bookstaken is an EdTech platform offering 1:1 reading mentorship for children aged 6–14 (Grades 1–8). We connect children with trained college-student mentors to build a love for reading, critical thinking, and confident expression.
Contact: privacy@bookstaken.com | www.bookstaken.com
Address: Bookstaken Pvt. Ltd., India
2. Information You Voluntarily Provide
We collect personal information that you directly submit to us through sign-up forms, inquiry forms, onboarding, or communication with our team.
From parents and guardians:
- Full name, email address, and WhatsApp/mobile number
- Child's name, age, grade level (Grades 1–8), and reading level or goals
- Country, timezone, and language preference
- Payment details — collected and processed through authorised payment processors (Wise); Bookstaken does not store card or bank details directly
From mentors (Book Buddies) during onboarding:
- Full name, email address, and mobile number
- Educational background and institutional affiliations (e.g., VNIT Nagpur, St. Xavier's Mumbai)
- Areas of reading expertise, availability, and bio
- Photo or avatar (displayed on mentor profiles with your consent)
3. Information We Collect Automatically
When you visit our website, our servers and infrastructure automatically process certain technical data. This is derived from standard web request headers and is used for security, routing, and service delivery — not for advertising or profiling.
| Data | Source | Purpose | Retention |
|---|---|---|---|
| IP address | Server request headers | Fraud detection, bot prevention, abuse protection | Anonymised and deleted after 180 days |
| Approximate location (country/region) | Derived from IP via Vercel edge headers | Show correct regional pricing (India / UAE / Singapore / UK) | Not stored beyond the session |
| Timezone and language preference | Browser/server headers | Show correct session times and content language | Not stored beyond the session |
| Referrer URL (traffic source) | HTTP headers | Aggregate analytics only — which channels bring genuine users | Stored in aggregate, non-identifiable form |
Platform Analytics (First-Party, Cookieless):
We measure anonymous engagement across our website using our own custom, in-house system — no third-party advertising tools, no identifying tracking cookies, and no device storage. We track:
- Page views and website navigation
- Scroll depth (how far a reader progresses down a page)
- Call-to-action (CTA) button click rates
This data is collected to improve our product, detect automated bot traffic, and understand user engagement. It cannot be linked to individual identities or accounts unless you actively create an account. Our system natively respects "Do Not Track" (DNT) and "Global Privacy Control" browser signals. All raw event data and anonymised IP hashes are permanently deleted after 90 days.
4. Google Sign-In
If you choose to log in using Google (including Google One Tap), Google shares the following with us:
- Your Google account name, email address, and profile picture
- A unique Google identifier used to link your Google account to your Bookstaken account
We do not receive or store your Google password. Google's own Privacy Policy governs how Google processes your data.
5. Why We Collect This Data
We use the information described above for the following purposes:
- To create and manage your Bookstaken account and deliver mentorship services
- To match students with appropriate mentors based on grade level, reading goals, and availability
- To send session updates, progress reports, and "Dinner Table Cheat Sheets" to parents via WhatsApp or email
- To show correct pricing based on your region (India, UAE, Singapore, UK)
- To detect fraudulent, automated, or abusive traffic and protect our platform and users
- To understand which channels bring genuine users (aggregate, non-personal)
- To improve our blog content and website experience (aggregate analytics only)
- To process payments through authorised processors
- To comply with applicable legal obligations under Indian law
We do not sell, rent, or trade your personal data. We do not use your data for advertising.
6. Children's Data
Because Bookstaken serves children aged 6–14, we apply heightened protections to all data relating to minors.
- We collect a child's data only with verifiable parental or guardian consent, obtained during account sign-up
- Parents may request access to, correction of, or deletion of their child's data at any time by contacting privacy@bookstaken.com
- We do not show advertisements to children
- We do not sell children's data under any circumstances
- We do not use children's data to train AI models or for any purpose beyond delivering and improving mentorship services
- Student data (name, grade, reading progress) is shared only with the assigned mentor and the child's parent or guardian — no one else
- We comply with the Digital Personal Data Protection Act (DPDP), 2023 (India), which requires verifiable parental consent before processing children's personal data
7. Third-Party Service Providers
We share personal data with the following trusted service providers who help us operate the platform. Each is bound by confidentiality obligations and data processing agreements.
| Provider | Role | Data Shared | Their Privacy Policy |
|---|---|---|---|
| Supabase | Database hosting and authentication infrastructure | Account data, session tokens | supabase.com/privacy |
| Vercel | Website hosting and edge infrastructure | Server request logs, IP addresses (anonymised) | vercel.com/legal/privacy-policy |
| OAuth login (sign-in), video sessions via Google Meet | Google account identifier, email (for login only) | policies.google.com/privacy |
We do not share your data with advertisers, data brokers, or any other third parties.
8. Cookies
We use a single strictly necessary session cookie to keep you logged in to your Bookstaken account. We do not use any tracking, analytics, or advertising cookies. You cannot opt out of the session cookie without logging out of your account, as it is required for the platform to function.
9. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (parent, child, mentor) | Retained while account is active; deleted within 30 days of account closure request |
| IP addresses | Anonymised and automatically deleted after 180 days |
| Session recordings (where made for training or quality review) | Retained for a maximum of 90 days, then permanently deleted |
| Blog analytics (aggregate) | Retained indefinitely in aggregate, non-identifiable form |
| Payment records | Retained for 7 years as required under Indian accounting and tax law |
| Referrer/traffic source data | Stored in aggregate form only; raw request logs deleted within 180 days |
10. Data Security
We implement the following technical and organisational measures to protect your data:
- HTTPS encryption across the entire website and platform
- Secure, httpOnly session tokens with CSRF protection
- Access controls: only authorised Bookstaken team members can access personal data, on a need-to-know basis
- Supabase row-level security on database tables
- Vercel edge infrastructure with DDoS protection and automated threat detection
- Regular internal security reviews of our codebase and data handling practices
No online system is 100% secure. If you suspect unauthorised access to your account or a data breach, contact us immediately at privacy@bookstaken.com.
11. Prohibition on Unauthorised Data Collection
You may not collect, harvest, scrape, mine, or otherwise extract personal data from this Site or platform — including mentor profiles, parent contact information, student data, or any other user data — by any automated or manual means without Bookstaken's prior written authorisation. Attempts to do so are a violation of these policies, the Information Technology Act, 2000 (as amended), and the Digital Personal Data Protection Act, 2023, and may result in civil and criminal liability.
12. Your Rights
Under the Digital Personal Data Protection Act, 2023 (India), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or outdated information
- Request erasure of your personal data (subject to legal retention requirements)
- Withdraw consent to specific data processing at any time
- File a grievance — contact privacy@bookstaken.com; we will respond within 30 days
If you are located in the EU or UK, you may also have rights under GDPR/UK GDPR and may contact your local data protection authority.
13. Governing Law
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000 (as amended). For cross-border data transfers involving users outside India (UAE, Singapore, UK), we ensure appropriate contractual safeguards are in place with our service providers.
14. Updates to This Policy
We will notify registered users by email if we make material changes to this Privacy Policy. The "Effective Date" at the top will always reflect the most recent version.
15. Contact
Email: bookstaken.official@gmail.com
Website: www.bookstaken.com
Address: Bookstaken Pvt. Ltd., India
© 2026 Bookstaken Pvt. Ltd. All Rights Reserved.