Privacy Policy

Last updated 4 Oct 2026 · The 99 Percentiler

This notice explains how we handle your personal data under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. We collect only what we need to deliver your playbook and help you.

1. Who is responsible

The 99 Percentiler (“we”) decides how your data is used and is the Data Fiduciary. Contact: our contact page or support@the99percentiler.com.

2. What we collect

At checkout: your name, email address and mobile number.
If you ask for the free calendar: your email address, which page you asked from, how you found us (the same campaign tags as below), a one-way hash of your IP address and your browser type, and whether you ticked the optional updates box.
About your order: the product, amount, order ID, Razorpay order and payment IDs, and payment status. We never receive your card, UPI PIN or bank login.
About downloads: how many times you downloaded, with a one-way hash of your IP address and your browser type, to stop link sharing.
How you found us: campaign tags in the link (utm), the page you first landed on and the referring website, stored in a first-party cookie for 30 days and saved with your order.
If you contact us: your name, email, order ID and message.
Analytics (only if you accept): pages visited, device type and approximate location, through Google Analytics.

3. Why we use it

To take payment, deliver your playbook, send your download link and stamp your copy with your email and order number.
To email you the free calendar you asked for.
To answer support requests and complaints.
To keep the records that tax and accounting law requires.
To prevent fraud and abuse, such as link sharing or fake orders.
To send marketing emails (such as exam date alerts and prep tips), only if you tick an optional box (section 6).
To understand which pages and Instagram posts help students, using analytics only if you accept cookies.

4. Who processes it for us

We share data only with the service providers that run the store, under contracts that limit their use of it:

Razorpay: payments
Supabase: database and private file storage
Resend: sending order and calendar emails
Vercel: hosting the website
Cloudflare: DNS, email forwarding and bot protection (Turnstile)
Google Analytics: visit statistics, only after you accept

Some of these providers may store data outside India. We do not sell your data and we do not share it for advertising.

5. Cookies and analytics

We use a few essential cookies: one remembers how you found us (30 days), one lets your browser see its own order page (7 days), and one remembers your cookie choice. Analytics cookies stay off until you click “Accept analytics” in the cookie notice. To change your choice, clear this site's cookies and pick again.

6. Marketing emails and consent

The marketing boxes at checkout and in the free calendar form are unticked by default and separate from your purchase or your calendar. If you tick one, we record the wording you agreed to and the time. You can withdraw at any time through the unsubscribe link in any email or bycontacting us. Withdrawing doesn't affect your order.

7. How long we keep it

Order and payment records: for the period tax and accounting law requires (generally up to 8 years).
Download logs: 1 year.
Contact messages: 2 years after we close your request.
Free calendar requests: 2 years after your last request, unless you ask us to delete them sooner.
Marketing consent: until you withdraw it, plus the record that you withdrew.
Attribution cookie: 30 days.

8. Your rights

Under the DPDP Act you can:

ask what personal data we hold about you and who we shared it with;
ask us to correct, complete or update it;
ask us to erase it, unless the law requires us to keep it (for example, tax records);
withdraw consent you gave us;
nominate another person to use these rights if you die or can't act; and
raise a grievance with us, and then with the Data Protection Board of India.

9. Security and breaches

Paid files sit in private storage and are served through links that expire in 10 minutes. Download tokens and IP addresses are stored as hashes. Only our server can read the database. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

10. Children

Our playbooks are meant for graduates and final-year students preparing for MBA entrance exams. We don't knowingly collect data from anyone under 18.

11. Grievance officer

Grievance officer, The 99 Percentiler, support@the99percentiler.com. We acknowledge complaints within 48 hours and resolve them within one month. You can also write through our contact page.

12. Changes

If we change this notice, we'll update the date at the top. For significant changes we'll tell customers by email.