Privacy Policy

The Data Fiduciary responsible for processing your personal data is:

• Legal name: White Falcon Publishing Solutions LLP
• Registered office: SCF 15, Second Floor, Sector-65 (Phase-11), Mohali 160062, Punjab, India
• Website: https://whitefalconpublishing.com
• General email: contact@whitefalconpublishing.com
• Grievance Officer: Hardeep Singh, IT Operations Manager — grievance@whitefalconpublishing.com

This notice also covers processing on related platforms we operate, including our publishing platform, the WFP Book Store (hosted on Shopify), and mobile applications, unless a specific product publishes its own notice.

This notice is for customers, authors, Site visitors and other people outside our staff. Personal data of our employees and contractors is processed for employment-related purposes as a legitimate use under the DPDP Act, and is handled under our internal employment records rather than this public notice.

This notice explains our public-facing processing of personal data. It does not create contractual rights beyond those provided by applicable law, our agreements or the services you use. Where another applicable law requires a different retention period, disclosure, security measure, notice or response process, we will follow that requirement.

The itemised description of personal data we may collect is:

• Identity and contact: name, email address, telephone number and country code, location, and (if you sign up through a social network) profile information provided by that network.
• Account: login identifiers and credentials needed to operate your account.
• Address: shipping and billing addresses.
• Financial and tax: bank account details, IFSC/SWIFT, payment email, PayPal email for overseas payouts, PAN and similar details needed to remit author earnings and to comply with tax and accounting law. Card payments on the Site or WFP Book Store are taken by Razorpay and/or Shopify. We retain transaction and order references, amounts and payer identity needed for fulfilment, accounting and tax; we do not retain card numbers.
• Orders and publishing: book title, word count, plan or service interest, book type and preferred call time from publishing enquiries; titles, formats, quantities, delivery preferences, and replacement or support information for author copies and bookstore orders; records of publishing services you request; identity details where we assist with copyright-registration filings; and order or fulfilment information received from marketplaces such as Amazon or Flipkart where needed to print and ship.
• Communications: the content of emails, contact-form messages, WhatsApp or telephone enquiries, publishing agreements and related correspondence, and our replies.
• Newsletter preferences: your subscription status and the topics you asked to receive.
• Usage and log data: IP address, browser type, referring domain, pages visited, timestamps, and advertisement impressions generated by your use of the Services.
• Cookies and similar identifiers: described in the Cookies section.
• Content you upload: manuscripts, cover files, author biographies, photographs and other publishing materials. If those materials contain personal data, that personal data is processed as part of providing the publishing service.

We collect this personal data from:

• website forms, including general contact and publishing enquiry forms;
• author account registration and use of our publishing platform;
• WFP Book Store / Shopify account and checkout activity;
• email, telephone and WhatsApp communications;
• publishing agreements, project submissions and production workflows;
• newsletter subscriptions and marketing interactions;
• orders, delivery and fulfilment processes; and
• information supplied by or received through publishing, marketplace, payment, logistics, professional and service providers.

If you email us or message us on WhatsApp, we may keep your message, email address, phone number and contact information to respond to your request.

We take reasonable steps to keep the personal data you give us for accounts, orders, shipping and author payouts accurate and complete, including by acting on correction, completion and update requests. You should give us accurate details when you register, place an order, or request a payout, and tell us if they change. We are not responsible for the accuracy or completeness of literary content you submit for publication. That remains the author’s responsibility, as described in Content You Publish and in the Terms.

We process personal data for the following specified purposes, and only as much as is needed for those purposes. The lawful basis under the DPDP Act is stated for each purpose:

• Publishing and production (legitimate use): language review and editing (primarily grammar, usage and readability), design, typesetting, printing, ISBN assignment and related publishing services you request. Language review is not fact-checking or a check of authenticity.
• Copyright-registration assistance and events (legitimate use): identity details needed to assist with copyright-registration filings you request, and name, biography, photograph and book details for launches, book fairs, press or related publishing activity where that is part of the arrangement.
• Account and platform access (legitimate use): creating and administering your membership or author account on the Site.
• Orders, shipping and bookstore sales (legitimate use): taking orders on the Site and the WFP Book Store, printing on demand, delivering books through courier partners or India Post, and handling replacements for production defects.
• Author earnings (legitimate use): calculating, reporting and remitting royalties or other payments, including international payouts through PayPal where that method is used, and keeping tax records.
• Support (legitimate use): answering questions and sales or support chats you send by email or WhatsApp, and fulfilling requests and complaints.
• Service improvement (legitimate use): understanding how the Services are used, fixing faults, and producing aggregated internal reports. Non-essential analytics cookies are used only with consent, as described below.
• Newsletters and marketing (consent): sending information about our services by email or newsletter, and where you have given consent, by WhatsApp, telephone, social media, advertising platforms, book fairs, influencer or book-blogger outreach, press or PR activity, or related campaign communications. Providing personal data for publishing or an order is not, by itself, consent to marketing. We do not purchase or scrape contact lists. Marketing lists are built from people who enquire, publish, buy or subscribe. You may unsubscribe by following the instructions in those messages or by writing to the Grievance Officer.
• Analytics and advertising cookies (consent): measuring how the Site is used and, where you have accepted non-essential cookies, measuring or showing advertisements. Non-essential analytics and advertising cookies are stored only if you accept them.
• Security, fraud and abuse prevention (legitimate use): protecting accounts, the Site and other users, including Cloudflare Turnstile bot-protection on forms.
• Legal and tax compliance (legitimate use): keeping records required by Indian tax, company and other applicable law.

We do not use personal data for a purpose that is not specified in this notice without a fresh notice and, where required, a fresh consent. Using the Services is not consent for marketing or for non-essential cookies.

Under the DPDP Act, we process personal data on consent or on a legitimate use recognised by the Act.

Consent. Where we rely on consent (for example newsletters, analytics cookies and advertising cookies), consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action after this notice. You may withdraw consent at any time, with comparable ease, by using the cookie banner controls, the unsubscribe link in a message, or an email to grievance@whitefalconpublishing.com. Withdrawal does not affect processing already completed, or processing that we must continue under law or to provide a service you still want. If you unsubscribe from marketing, we may keep a suppression record for up to one year so that marketing is not restarted by mistake.

Legitimate uses. We may process personal data without a separate consent where you have voluntarily provided it for a specified purpose and we use it only for that purpose (for example an enquiry form, an order, or an author-payout request); where processing is necessary for employment-related purposes of our staff; or where processing is necessary to comply with any law or a court or government order, to respond to a medical emergency, or to protect a person from harm, as permitted by the DPDP Act.

We may share or disclose your personal data with your consent, and as otherwise described in this policy.

We do not use solely automated processing to make a decision that has a legal or similarly significant effect on you (for example, refusing a publishing arrangement solely by algorithm). If you accept advertising cookies, Google may use identifiers to measure campaigns and, where permitted, to show relevant advertisements, under Google’s own policies. You can reject non-essential cookies or change that choice through Cookie settings.

Our servers automatically record information (“Log Data”) created by your use of the Services. Log Data may include information such as your IP address, browser type, the referring domain, pages visited, timestamps and impressions. Other actions, such as interactions with advertisements, may also be included in Log Data. We use Log Data to operate, secure and diagnose the Services. Relevant logs are retained for at least one year for detection, investigation and remediation of unauthorised access, as required by the DPDP Rules, unless a longer period is required by another law.

We use a cookie consent banner so that non-essential analytics and advertising cookies are not stored until you accept them. Until you accept, Google Consent Mode keeps analytics and ads storage denied. Limited technical pings may still be sent to Google without those cookies. A cookie is a small data file stored on your device. We use:

• Essential cookies: required to operate the Site, keep you signed in, remember your cookie choice, and protect security. These do not require a separate consent.
• Analytics cookies: Google Analytics, used to understand how visitors use the Site. These run only if you accept non-essential cookies.
• Advertising cookies: Google Ads, used to measure campaigns and, where permitted, to show relevant advertisements. These run only if you accept non-essential cookies.

White Falcon Publishing may use both session cookies and persistent cookies. You can accept all cookies, reject non-essential cookies, or change your choice later through the “Cookie settings” control in the site footer. You may also instruct your browser to refuse cookies or to prompt you before accepting one. Blocking essential cookies may prevent parts of the Site from working.

The WFP Book Store is hosted on Shopify. Shopify and its checkout providers may set their own cookies and process store orders under Shopify’s policies as well as this notice.

Third-party services we use may set their own cookies as part of a page request. Those parties process data under their own policies. See Third-Party Services below.

White Falcon Publishing uses third parties to help provide the Services. They may receive only the personal data needed for the purpose below. They act as Data Processors on our instructions, or as independent Data Fiduciaries where they determine their own purposes (for example when you buy a book on Amazon or Flipkart, or when you leave our Site and use their website).

• Amazon Web Services (AWS): hosting of our systems. Personal data we host on AWS is stored in AWS’s Mumbai (India) data centre.
• Shopify: the WFP Book Store. Shopify processes store orders, checkout, customer accounts and related store data.
• Razorpay: card, net-banking and similar payments taken through the Site.
• PayPal: international author royalty payouts, where that method is used.
• Google: website analytics and advertising measurement, only if you accept non-essential cookies.
• Cloudflare: website security and bot-protection on forms (Turnstile).
• WhatsApp (Meta): sales and support chats you choose to send us on WhatsApp, and advertising activity on Meta platforms where you have accepted advertising cookies or otherwise given consent.
• Amazon (including Kindle Direct Publishing), Ingram, Flipkart and other distribution platforms: printing, listing, fulfilment and sale of published books, including Indian sales on Amazon and Flipkart and distribution through Ingram, Amazon KDP and, where used, platforms such as Barnes & Noble, Kobo, Google Play and Scribd.
• India Post, Blue Dart, DTDC, Professional Couriers and other courier partners: delivery of physical orders.
• Printers: print production, including files, quantities and relevant ship-to information.
• Banks and professional advisers: HDFC, ICICI and other banks used for payments or royalties; accountants, auditors and tax professionals who receive financial, tax or contractual records needed for their work.
• PR and event partners: author name, biography, photograph, book details and contact information as needed for launches, events and media activity.

We do not sell your personal data. On an access request, we will identify the Data Fiduciaries and Data Processors with whom your personal data has been shared, together with a description of what was shared, as required by the DPDP Act.

Use of a third-party provider does not mean we certify or guarantee that provider’s privacy or security compliance. Third-party services may use their own subprocessors and may process data outside India, as described in Transfer of Personal Data Outside India.

We engage certain trusted third parties to perform functions and provide services to us. White Falcon Publishing provides personal data to trusted partners who work on behalf of or with White Falcon Publishing. They may only use your data as directed by White Falcon Publishing, which includes using your personal data to help White Falcon Publishing communicate with you, printing and shipping your books, delivering services or other products, and completing financial transactions. These partners do not have any independent right to share this information, nor do they have any right to contact you for matters not pertaining to White Falcon Publishing, except where the law requires them to do so.

Contracts with Data Processors require them to take reasonable security safeguards and to process personal data only for the purposes we specify. Sales platforms such as Amazon and Flipkart act as independent Data Fiduciaries for purchases made on their own storefronts.

White Falcon Publishing Solutions LLP is registered and established only in India. Personal data we host on AWS is stored in AWS’s Mumbai (India) data centre.

Razorpay, Flipkart, India Post and our Indian courier partners process data in India. Personal data may still be processed outside India because some processors and platforms we use operate from other countries. That includes Google, Shopify, Cloudflare, WhatsApp (Meta), Amazon, Ingram and PayPal, which may process data in the United States and in other countries where they provide their services.

Under the DPDP Act and DPDP Rules, personal data processed by a Data Fiduciary in India may be transferred outside India except to a country or territory restricted by the Central Government. We will not transfer personal data to any country or territory that the Central Government has so restricted. If you use the Services from outside India, we still process your personal data from India, subject to those restrictions and to this policy.

We retain personal data only for as long as it is required for the specified purpose, or for as long as another law requires us to keep it. When the purpose is no longer being served and no law requires retention, we erase the personal data or make it no longer identifiable. Typical periods are:

If a statutory erasure period under the DPDP Rules applies to us, we will inform you at least 48 hours before that erasure unless you log in, contact us for the specified purpose, or exercise your rights in the meantime. For other personal data, we erase it when the specified purpose is no longer being served and no law requires retention.

As a Data Principal under the DPDP Act, you have the right to:

• Access: obtain a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom the data has been shared, together with a description of the personal data shared.
• Correction, completion and updating: have inaccurate personal data corrected, incomplete personal data completed, and out-of-date personal data updated.
• Erasure: request erasure of personal data that is no longer necessary for the specified purpose, or where you have withdrawn consent, unless retention is required by law or needed to provide a service you still use.
• Withdraw consent: withdraw consent for processing that is based on consent, with comparable ease to the way it was given.
• Grievance redressal: have a grievance about our processing addressed by the Grievance Officer.
• Nominate: nominate one or more individuals who may exercise your rights on your behalf in the event of your death or incapacity. Send the nominee’s name, contact details and relationship to you to the Grievance Officer. We may ask for information reasonably needed to identify you and the nominee.

To exercise these rights, email grievance@whitefalconpublishing.com from the address we have on file, and include your full name, the email or username associated with your account (if any), and a clear description of the request. We may ask for additional particulars reasonably needed to identify you under our terms of service. We will not charge a fee for a reasonable request.

Where we have shared your personal data with a Data Processor and we accept your request to correct, complete, update or erase it, we will, where reasonably practicable, ask that processor to do the same, unless a law requires the data to be retained.

Every response we send about a rights request will again include the Grievance Officer’s business contact information.

White Falcon Publishing has appointed a Grievance Officer to answer questions about our processing of personal data and to receive grievances under the DPDP Act.

• Name: Hardeep Singh
• Designation: Grievance Officer, IT Operations Manager
• Email: grievance@whitefalconpublishing.com
• Phone: +91-8284859812
• Address: White Falcon Publishing Solutions LLP, SCF 15, Second Floor, Sector-65 (Phase-11), Mohali 160062, Punjab, India

The Grievance Officer is the person able to answer questions on our behalf about the processing of personal data. Send grievances in writing to the email or postal address above. Please include your name, contact details, the nature of the grievance, and any relevant account or order reference.

We will acknowledge your grievance and close it within a reasonable period that will not exceed 90 days from receipt. We maintain records of grievances received, acknowledgements and closure.

If you are not satisfied after this process, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and the DPDP Rules.

We may disclose your information if we believe that it is reasonably necessary to comply with a law, regulation or legal request; to protect the safety of any person; to address fraud, security or technical issues; or to protect White Falcon Publishing’s rights or property. This includes disclosure required by a court, a government authority, or the Data Protection Board of India.

In the event that White Falcon Publishing is involved in a bankruptcy, merger, acquisition, reorganization or sale of assets, your information may be sold or transferred as part of that transaction. The promises in this privacy policy will apply to your information as transferred to the new entity, and that entity will become the Data Fiduciary to the extent it determines the purposes and means of processing.

We may share or disclose aggregated or otherwise non-personal information that does not identify you, such as statistics about how the Site is used. Information that remains personal data under the DPDP Act is not treated as non-personal information.

Under the DPDP Act, a child is a person who has not completed eighteen years of age. The Site and publishing services are directed at adults. We do not track, behaviourally monitor, or target advertising at children.

If a child uses a service, we process that personal data only after taking suitable measures to obtain the verifiable consent of the parent or lawful guardian, as required by the DPDP Act and DPDP Rules. The contracting adult is the parent or guardian. We do not use a child’s personal data for targeted advertising.

If you become aware that a child has provided us with personal data without verifiable parental consent, please contact the Grievance Officer at grievance@whitefalconpublishing.com. If we become aware that we have processed a child’s personal data without such consent, we will take steps to erase that data and, where applicable, terminate the child’s account.

Where personal data of a person with disability who has a lawful guardian is processed, we will take suitable measures to obtain the verifiable consent of that lawful guardian, appointed by a court, a designated authority or a local level committee under applicable guardianship law.

You may nominate one or more individuals to exercise your rights under the DPDP Act in the event of your death or incapacity. Email the nomination to grievance@whitefalconpublishing.com. We will record it against your account or correspondence file and may ask for information reasonably needed to identify you and the nominee.

Unpublished manuscripts, cover files, proofs and other production files you send us are processed to provide the publishing service. We do not treat those unpublished files as public, and we use them only to edit, design, print, distribute and support the project, and as otherwise described in this policy or your publishing agreement.

As part of a publishing arrangement we may also publish your name, biography and photograph on a book cover or back cover, an Amazon Author Page, Goodreads, our website or portfolio, newsletters, social posts, press material and book-fair or event material. Once that information is on a third-party marketplace or public channel, copies may remain available under that platform’s own policies.

Once a book or other product is published, or you post content on an open forum on the Site, any personally identifiable information you included in that published content may be widely available to other users and to purchasers. White Falcon Publishing does not exercise control over those users and cannot guarantee that your personal information will be protected as described in this Privacy Policy once it forms part of published content.

Language review before publication does not include removing personal information from your manuscript. White Falcon Publishing does not modify the content to delete personal information. If you do not want personal information to appear in the published work, you must delete it before you approve the print-ready files.

Do not include personal data about any individual other than yourself in content you upload, unless you have a lawful basis to do so.

Your account on the Site is password protected. It is your responsibility to safeguard your password.

White Falcon Publishing takes reasonable security safeguards to protect personal data in our possession or under our control, including where a Data Processor processes it on our behalf. These safeguards include access controls, encryption or equivalent protection of data in transit and at rest where appropriate, logging and monitoring to detect unauthorised access, backups, and contractual clauses with processors. White Falcon Publishing limits access to personal information about you to employees who we believe reasonably need to come into contact with that information to provide products or services to you or in order to do their jobs.

Staff and contractors may access personal data only as needed for their work. We review access where appropriate. This notice describes our safeguards; it is not a security audit or a DPDP certification.

No method of transmission or storage is completely secure. Please use a unique password and tell us promptly if you believe your account has been misused. Do not send passwords, authentication codes, payment-card numbers or other unnecessary confidential information through ordinary email or public forms.

If we become aware of a personal data breach, we will inform affected Data Principals without delay, in clear and plain language, through the user account or another registered mode of communication. That intimation will describe the nature, extent and timing of the breach, the likely consequences, the measures we have taken or are taking, the steps you can take to protect yourself, and the Grievance Officer’s business contact information.

We will also intimate the Data Protection Board of India without delay, and provide the detailed information required by the DPDP Rules within 72 hours of becoming aware of the breach (or within any longer period the Board allows on written request).

We may update this Privacy Policy to reflect changes in the Services, in the DPDP Act or DPDP Rules, or in our processing. The current version will always be posted on this page with the last-updated date. Where a change is material, we will give you notice by email or another reasonable registered mode of communication before the change takes effect, so that you can withdraw consent or exercise your rights if you wish.