Privacy notice.

You give us: your email, and — for paid orders — the billing details Razorpay needs to take payment. For merch (physical) orders we also collect your name, shipping address, and phone number so the item can be printed and delivered. If you sign up for PLOS, we store the responsibilities, persons, and notes you create inside the app.

We log automatically: request IP, user agent, and timing — used for security, fraud prevention, and to keep the service honest. We don’t use this for advertising.

We do not knowingly collect sensitive categories such as government IDs, financial-account numbers, health, or biometric data. Card details are entered on Razorpay’s PCI-DSS-compliant checkout and never touch our servers.

Under the DPDP Act we process your personal data on the basis of the consent you give when you submit a form, place an order, or create an account — and for the specific, lawful purposes below:

• Deliver digital downloads after purchase.
• Fulfil and ship merch orders through our print partner.
• Send transactional email — receipts, download links, password resets, order/shipping updates, and important PLOS notices.
• Run the PLOS app and the account you signed up for.
• Reply when you contact us. Marketing email (if any) is strictly opt-in and easy to leave.
• Compute aggregate, identity-free numbers — e.g. “how many active users this week” — to decide what to build.

You can withdraw consent at any time (see “Your rights”). Withdrawal doesn’t affect processing already done, and we may still keep the minimum data the law requires us to retain.

We share data only with the processors that run the service, and only the minimum each one needs:

• Razorpay — payment processing for all paid orders. Razorpay privacy.
• Qikink — our print-on-demand partner. For merch orders we pass your name, shipping address, and phone so the item can be printed and couriered to you. Used only for fulfilment.
• Resend — transactional email delivery. Resend privacy.
• Supabase — managed Postgres and file storage for product and PLOS data. Configured in the ap-south-1 (Mumbai) region.

We do not share your data with advertising networks or data brokers, and we do not allow third parties to set tracking cookies through our site. We may disclose data if compelled by a valid Indian legal order.

Some of our processors (e.g. Razorpay, Resend, Qikink) may process or store data on servers outside India. Where that happens we rely on the processor’s own safeguards and only use providers that are not in any country restricted for transfer under the DPDP Act. Our primary database is hosted in Mumbai (ap-south-1).

We use only the cookies needed to keep you logged in and to keep the site secure. We don’t run third-party advertising or cross-site tracking cookies. Any product analytics we use are aggregate and privacy-respecting (no selling of personal data).

• Order & payment records — kept as long as needed to honour refunds, support, and any tax/accounting obligation, then deleted or anonymised.
• PLOS account data — kept while your account is active; deleted within 30 days of you closing the account.
• Download links / tokens — expire automatically (7 days / 5 uses).
• Server logs — rotated and retained only for a short window for security.

Data is encrypted in transit (HTTPS) and held by reputable managed providers. Access is limited to what’s needed to run the service, and payment card data never reaches our servers. No system is perfectly secure, but if a breach ever affects your data we’ll act on it and notify you and the Data Protection Board as the DPDP Act requires.

Under the DPDP Act you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct or complete inaccurate data;
• ask us to erase data we no longer need;
• withdraw consent for any processing; and
• nominate someone to exercise these rights on your behalf if you are unable to.

To exercise any of these, email hello@thenispace.com with “DPDP request” in the subject line, or write to our Grievance Officer below. We respond within 30 days.

In line with the DPDP Act and the Consumer Protection (E-Commerce) Rules, 2020, you can raise any privacy concern or complaint with our Grievance Officer:

• Name: Ishank Sainger
• Email: hello@thenispace.com
• Based in: New Delhi, India

We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

The PLOS app and the trackers are not designed for children under 18, and we do not knowingly process a child’s data without verifiable parental consent. If you believe a child has signed up, write to us and we’ll remove the account.

When this notice changes meaningfully, we’ll email anyone with an account at least 14 days before the new version takes effect. Minor edits (typos, clarifications) ship immediately and get a new “last updated” date.