Oakbridge Publishing
Legal

Privacy Policy

Last updated: 19 October 2026

This Privacy Notice explains how Oakbridge Publishing Pvt. Ltd. ("we", "us"), as the Data Fiduciary, collects, uses, shares and protects your personal data when you use https://oakbridge.in, buy from us, or hear from us by email or WhatsApp. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution by writing to info@oakbridge.in.

1. Who is responsible

Oakbridge Publishing Pvt. Ltd., 934, Tower B3, Sohna–Gurgaon Rd, Sector 49, Spaze iTech Park, Gurugram, Haryana 122018, India. GSTIN 06AACCO5406D1ZW. Questions about your data: Bhupendra Yadav (Grievance Officer), info@oakbridge.in, +91 88003 37299.

2. What we collect, why, and on what basis

We collect only what each purpose needs. Each item below lists the data, the purpose, and the basis under the DPDP Act: your consent, or a legitimate use under section 7 (for example, data you give us voluntarily for a specific purpose, or that we must keep by law).

2.1 Your account. Name, email address, mobile number, password (stored only as a one-way hash) and whether your email or mobile has been verified with a one-time code. *Purpose:* create and run your account, sign you in, keep it secure. *Basis:* consent, which you give when you register.

2.2 Orders and invoices. Billing and shipping name, phone, address, GSTIN (if you give one), the items and amounts, and the payment reference from our payment partner. *Purpose:* take payment, deliver your order, issue invoices, handle returns and support. *Basis:* legitimate use (you gave the data to buy from us) and our legal obligations under tax and company law.

2.3 Order messages. Your email address and mobile number. *Purpose:* order confirmation, dispatch and tracking, delivery updates, password and verification codes. On WhatsApp only if you ticked "WhatsApp me order updates" at checkout. *Basis:* legitimate use for email/SMS service messages; consent for WhatsApp.

2.4 Marketing email. Your email address and name, and a record of your consent (when, where and how you agreed, for example the checkout tick-box, our newsletter form with a confirmation email, or a sign-up sheet at one of our events). We also record what happens to the emails we send you: whether each one was delivered, bounced or opened, which links you clicked, whether you unsubscribed, and whether an order followed (we tag our own links so a purchase can be linked to the email). *Purpose:* tell you about new titles, events and offers, and send only what is useful. *Basis:* consent, which you can withdraw at any time (section 3).

2.5 Marketing WhatsApp. Your mobile number and name, your consent record, and delivery/read status of our messages. *Purpose:* cart reminders and new-release news, only if you ticked "Also WhatsApp me cart reminders and new-release news". *Basis:* consent.

2.6 Checking email addresses before we send marketing. To avoid emailing addresses that do not work, we check the address format, whether its domain receives email and whether it is a throwaway address; we ask Amazon Web Services (Amazon SES Email Validation) whether the mailbox is likely to exist; and we keep a confidence score from these checks and from past delivery results. If an address shows no opens or clicks across 12 of our campaign emails, we stop sending it marketing. These checks decide only whether we send you marketing email. We make no other decision about you from them. *Basis:* the consent you gave to receive marketing.

2.7 Contacts we receive from events or partners. If you gave your details at an event, fair or seminar run by us or with a partner and agreed to hear from us, we record where and how you agreed. Every message lets you unsubscribe in one click, and we may first ask you to confirm that you still want to hear from us. If you did not agree, we do not send you marketing.

2.8 Submissions, reviews and requests. Manuscript submissions (name, contact, affiliation, synopsis, bio), product reviews (shown publicly with the name you give), waitlist and "notify me when in stock" requests, and contact-form messages. *Purpose:* respond to you and do what you asked. *Basis:* legitimate use (you gave the data for that purpose); consent where we ask for it.

2.9 Our AI assistant. Your messages and, if you are signed in, a summary of your own orders. *Purpose:* answer your question. *Basis:* consent (you choose to use it).

2.10 Analytics and session recording. Only if you allow them in our cookie banner: pages viewed, titles browsed and where people get stuck (analytics), the link or email you first came to us from, remembered in your browser for up to 30 days so a later order can be credited to it (analytics), and, separately, a recording of how pages were used with everything you type and all personal details masked (session recording). *Basis:* consent. See our Cookie Policy.

Without your consent we still keep simple counts of visits and shopping steps (for example "a visit from a search engine, on a phone, that opened checkout"). These use no cookies, store nothing in your browser beyond the current tab, and record nothing that identifies you — not your IP address, not your account. *Basis:* legitimate use, to run and improve the Site.

2.11 Security logs. IP address, device/browser details and actions taken, to keep the Site and your data safe and to investigate misuse. *Basis:* legitimate use and the security duties in the DPDP Rules.

2.12 Job applications. Name, mobile number, email address, the role you apply for and your CV, from our Careers page. *Purpose:* consider your application and contact you about it and similar roles. *Basis:* consent, which you give with the tick-box on the form. Only the people hiring can open CVs.

Payments: card, UPI and bank details are entered on and processed by Razorpay. We never receive or store your full payment credentials.

3. Withdrawing consent — as easy as giving it

  • Marketing email: the "Unsubscribe" link at the bottom of every email (one click, effective immediately), or email info@oakbridge.in.
  • Marketing WhatsApp: reply STOP, or email info@oakbridge.in; we act on your request within 48 hours.
  • Analytics / session recording: "Cookie preferences" at the bottom of any page.
  • Your account and everything else: email info@oakbridge.in.

Withdrawing consent does not affect what was done before, and we then stop that processing unless the law requires us to keep the data. You may also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India once such services are available.

4. Who we share your data with

We never sell personal data. We share it only with service providers who process it on our instructions, under contracts with confidentiality and security obligations:

  • Razorpay — payments.
  • Resend — order, account and verification emails, and their delivery status.
  • Amazon Web Services — Amazon SES (marketing emails and their delivery, bounce and complaint reports; email-address validation) and Amazon S3 (file storage, including invoices).
  • Interakt, with Meta (WhatsApp) — WhatsApp order updates and, if you opted in, marketing messages.
  • MSG91 — one-time verification codes by SMS.
  • Groq — the AI provider behind our assistant.
  • PostHog — analytics and session recording, only with your consent.
  • MongoDB Atlas — our database; Render and Vercel — hosting for our servers and website.
  • DTDC and other courier partners — delivering your orders.
  • Government authorities, regulators or courts, where the law requires it.

5. Where your data is processed

Some of these providers store or process data outside India, including in the United States. We transfer data only as the DPDP Act permits and comply with any restrictions the Government of India notifies on transfers to particular countries.

6. How long we keep it

  • Account data: while your account is open; deleted or anonymised within 90 days of an erasure request, unless the law requires us to keep part of it.
  • Orders and invoices: for 8 years, as tax and company law require.
  • Marketing data: until you unsubscribe, your consent lapses, or we stop mailing an inactive address. After that we keep only a minimal "do not contact" record so we never message you again by mistake. If you ask us to erase you, we keep only a one-way fingerprint of your email address for the same reason — not the address.
  • Submissions and enquiries: as long as needed to respond and to follow up, then deleted.
  • Job applications: while we consider you for the role and similar openings, then deleted; sooner if you ask us at info@oakbridge.in.
  • Security logs: at least one year, as the DPDP Rules require.

7. Security and data breaches

We protect your data with encrypted connections (HTTPS), password hashing, access controls with role-based permissions and audit logs, private file storage, and limits on who can see what. No system is perfectly secure. If a personal data breach affects you, we will tell you without delay — what happened, the likely consequences, what we are doing, and what you can do — and we will report it to the Data Protection Board of India within 72 hours of becoming aware of it, as the DPDP Rules require.

8. Your rights

Under the DPDP Act you can:

  • Access — a summary of the personal data we process about you, what we do with it, and who we have shared it with;
  • Correct, complete or update it;
  • Erase it, unless the law requires us to keep it;
  • Withdraw consent at any time (section 3);
  • Grievance redressal — complain to us (section 10) and then, if unresolved, to the Data Protection Board of India;
  • Nominate someone to exercise these rights if you die or become unable to.

Email info@oakbridge.in from the address we hold for you (or tell us how to verify you). We may ask for proof of identity before acting. We acknowledge requests within 48 hours and respond within 30 days, and in any case within the period the DPDP Rules allow.

9. Children

The Site is not directed at children, and accounts, orders and subscriptions are for adults (18+) only; a parent or guardian may buy for a child in their own name. We do not knowingly process a child's personal data without verifiable parental consent, and we never track, monitor the behaviour of, or target advertising at children. If we learn that we hold a child's data without such consent, we delete it.

10. Grievance Officer and complaints

Bhupendra Yadav, Grievance Officer, Oakbridge Publishing Pvt. Ltd., 934, Tower B3, Sohna–Gurgaon Rd, Sector 49, Spaze iTech Park, Gurugram, Haryana 122018, India. Email: info@oakbridge.in. Phone: +91 88003 37299. We acknowledge complaints within 48 hours and aim to resolve them within one month, in line with the DPDP Rules and the Consumer Protection (E-Commerce) Rules, 2020. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Changes to this notice

We will update this notice when what we do changes, with a new "Last updated" date. If we want to use your data for a new purpose, we will tell you first and, where the law requires, ask for your consent again — an earlier "yes" will not be stretched to cover it.

12. Contact

Oakbridge Publishing Pvt. Ltd., 934, Tower B3, Sohna–Gurgaon Rd, Sector 49, Spaze iTech Park, Gurugram, Haryana 122018, India. info@oakbridge.in · +91 88003 37299.