Privacy Policy

Information You Provide Directly

• Account registration: Name, email address, username, and password (stored hashed).
• Author profile: Biography, photo, social links, preferred genres, and publishing history.
• Manuscript submissions: Book files, titles, descriptions, cover images, and ISBNs.
• Contact forms: Messages, enquiry type, phone number, and country you voluntarily submit.
• Newsletter: Email address and reading preferences if you subscribe.
• Payment information: For authors opting into royalty programmes — we use Razorpay and Stripe; we do not store raw card numbers.

Information Collected Automatically

Information from Third Parties

If you register or sign in using Google, Apple, or Facebook OAuth, we receive your name, email, and profile picture from that provider. We do not receive your passwords from these services.

We use your information for the following purposes, each supported by a specific legal basis under GDPR and the DPDP Act 2023:

Cookies are small text files stored on your device. We use them to keep you logged in, remember preferences, and understand how our platform is used.

Managing Cookies

You can manage cookie preferences via our cookie consent banner, your browser settings, or by emailing privacy@aetheria.pub. Disabling essential cookies will affect platform functionality.

Service Providers (Data Processors)

We share data with trusted vendors who process it strictly on our behalf under Data Processing Agreements:

• Cloud hosting: AWS (Mumbai region) — servers, storage, CDN
• Email delivery: Mailgun — transactional emails only
• Payment processing: Razorpay & Stripe — royalty disbursements
• Error monitoring: Sentry — anonymised crash reports
• Analytics: Plausible — aggregate, cookie-free analytics

Legal Disclosure

We may disclose your data if required by law, court order, or government authority — for example under India's IT Act 2000 or DPDP Act 2023. We will notify you of such requests where legally permitted to do so.

Business Transfers

In the event of a merger, acquisition, or asset sale, your data may transfer to the successor entity. We will notify you via email and update this policy before any such transfer occurs.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, comply with legal obligations, or resolve disputes.

After retention periods expire, data is permanently deleted or irreversibly anonymised. We conduct quarterly data audits to ensure compliance.

You have significant rights over your personal data. We honour all valid requests within 30 days at no charge.

Users between 13 and 18 years of age may use the platform with the knowledge and consent of a parent or guardian. We encourage parents to monitor their children's online activities and to contact us if they believe their child has provided personal data without consent.

If we become aware that we have collected personal data from a child under 13 without appropriate consent, we will delete it promptly. To report such a concern, contact us at privacy@aetheria.pub.

We implement industry-standard technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, and disclosure.

• Encryption in transit: All data transmitted between your browser and our servers is protected by TLS 1.3.
• Encryption at rest: All databases and storage buckets are encrypted using AES-256.
• Password security: Passwords are hashed using bcrypt with a minimum cost factor of 12. We never store plain-text passwords.
• Access controls: Staff access to production systems follows the principle of least privilege with mandatory MFA.
• Regular audits: We conduct annual penetration testing and quarterly security reviews.
• Incident response: We have a documented incident response plan. We will notify affected users and relevant authorities within 72 hours of discovering a reportable breach.
• Secure development: All code changes go through security review before deployment to production.

Our primary infrastructure is hosted in AWS Mumbai (ap-south-1). However, some of our service providers (such as Mailgun and Stripe) may process data outside India.

When transferring data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all third-party processors
• Adequacy decisions where applicable
• Compliance with the DPDP Act 2023's cross-border transfer provisions

You may request details of any international transfers and the safeguards in place by contacting our Privacy Team.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will always update the "Last Updated" date at the top of this page.

How We Notify You

• Material changes: We will email registered users at least 30 days before material changes take effect.
• Minor changes: We will post an update notice on our website for 30 days.
• Consent: Where changes require fresh consent, we will present a new consent request before you can continue using affected features.

Your continued use of Aetheria after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree to the changes, you may delete your account before they take effect.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please don't hesitate to get in touch.

We aim to respond to all privacy-related enquiries within 5 business days and to complete formal data subject requests within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with India's Data Protection Board or your local supervisory authority.