Privacy Policy

Sortlyfe sells digital products — ebooks, planners and templates — delivered as instant downloads. This policy covers this website and the emails we send you about your orders.

There are three ways we end up with information about you: you buy something, you ask for a free sample, or you simply browse. Buying is covered here, samples have their own section below, and browsing is covered under analytics.

When you buy something we collect:

• Your name, email address and phone number, which you enter at checkout.
• Your order details: what you bought, the amount paid, and the payment reference returned by our payment provider.
• A record of your downloads — how many times each file has been fetched — so we can apply the download limit.
• Any review you choose to write, along with the name on your account.

We do not receive or store your card number, UPI PIN, CVV or bank credentials. Those go directly to our payment provider.

Separately, and on every visit rather than only when you buy, we collect analytics data: the pages you view, the products you look at, whether you add something to the cart or start a checkout, the value involved, your IP address, your browser user agent and the identifiers listed under “Cookies and similar technologies” below. This happens whether or not you ever place an order.

Some products offer a free sample. Asking for one is the only time we collect anything from someone who has not bought, so it is worth being precise about it.

What we collect, and why

• Your email address — so we can send you the sample you asked for. That is the purpose, and on its own it is the whole purpose.
• Which sample you requested — so we know what was sent, and so any later contact can refer to the thing you actually asked about rather than treating you as a generic name on a list.
• The date and time you asked — this is our record of your consent, and what we would rely on if you ever asked us to show why we hold your address.

Marketing is a separate choice

Giving us an address to receive a file is not a mailing list signup, and we do not treat it as one. The form has a separate, unticked box asking whether you also want to hear about new releases. If you leave it unticked you get the sample and nothing else — that is recorded against your address, and our own systems will not include you in any future send.

If you do tick it, we record that as its own permission with its own timestamp, kept apart from the sample request, so the two can never be confused for one another.

Stopping it

Every marketing email carries an unsubscribe link, and you can use it without signing in. Unsubscribing stops marketing only: you will still receive anything you specifically ask for, such as another sample or an order confirmation. You can also write to [SUPPORT EMAIL ADDRESS] and ask us to remove your address entirely, which deletes the record rather than just silencing it.

How long we keep it

• If you did not opt in to marketing — we keep the record for up to 12 months so we can show why we held your address and what we sent, then delete it.
• If you did opt in — until you unsubscribe or ask us to delete it, whichever comes first.
• After you unsubscribe — we keep your address on a suppression record so a later import cannot accidentally email you again. That record exists to keep you off lists, not on them.

Asking for a sample never creates an account, and it is unconnected to the cookie choice above: one is about measurement, this is about an email you asked us to send.

• Razorpay processes payments. They receive your name, email, phone and order amount, and handle card and UPI details under their own privacy policy.
• Resend delivers our transactional email — order confirmations, download links and sign-in links. They receive your email address and the message content.
• Cloudflare hosts this site, its database and the product files, and provides cookieless traffic analytics that count page views without identifying you.
• Google (Google Analytics 4) measures how the site is used. Google receives a randomly generated analytics identifier, the pages and events you trigger, the value and contents of an order, your IP address and your browser user agent. Where you are signed in we also send our own customer identifier so repeat visits join up.
• Meta (Facebook, Instagram) measures the performance of our advertising. Meta receives the events you trigger and their value, the Meta identifiers described below, your IP address and browser user agent, and — where we have them — your email address, name and city in hashed form. Hashing means we send an irreversible fingerprint rather than the address itself, but it is still information about you and it is used to match you to a Meta account.

We do not sell your personal information. We do, however, share the limited data described above with Google and Meta for analytics and advertising measurement. If you would rather we did not, see “Your rights” below.

When you first visit, a bar at the bottom of the page asks whether you accept analytics and advertising cookies. Accept and Decline are given equal prominence, and the page stays usable while you decide.

Nothing in tier 3 below runs until you accept. If you decline, or have not yet chosen, Google Analytics and the Meta pixel are never loaded, so their cookies are never set, and we send nothing to Google or Meta about you — including from our own servers after a purchase. Choosing to decline does not affect your order, your download links or your email.

We record your choice in a cookie called sl_consent, together with the date and the version of this policy you were shown, so that we can evidence what was agreed and when. It lasts 180 days. You can change your mind at any time using the Cookie preferences link in the footer of every page. If this policy changes materially we will ask again.

These are the cookies this site sets, and what each one is for. The first two run always because the site cannot work without them; the rest run only if you accept.

Always on — strictly necessary

• sortlyfe_session — a signed sign-in identifier for My Library. Marked HttpOnly so scripts cannot read it. Lasts 30 days. Strictly necessary; without it you cannot stay signed in.
• sl_consent — remembers whether you accepted or declined tracking, with the date and policy version. Lasts 180 days. Setting it is what lets us honour your choice, so it is not itself optional.

Only if you accept — set by us

• sl_attr — records which campaign, if any, first brought you to the site: the utm_source, utm_medium and utm_campaign values from the link you arrived on, and the page you landed on. Written only on a visit that carries those values, and then left unchanged so a later visit does not overwrite it. Lasts 30 days. We use it to understand which channels lead to sales. It holds campaign names, not anything about you personally.

Only if you accept — Google Analytics

• _ga and _ga_<id> — a randomly generated identifier for your browser, used to recognise a returning visit and group events into a session. Set by Google and typically lasting up to two years.

Only if you accept — Meta

• _fbp — an identifier Meta assigns to your browser, used to measure advertising. Typically lasts about three months.
• _fbc — recorded only if you arrive from a Meta ad, and holds the click identifier from that link so the visit can be attributed to the ad. Typically lasts about three months.

Always on — no cookies involved

Cloudflare Web Analytics counts page views and loading performance without setting any cookie and without identifying you. It runs whatever you choose, which is why declining costs us attribution rather than leaving us blind to basic traffic.

The Google and Meta entries above are cross-site advertising and analytics technologies. An earlier version of this policy said we used none; that is no longer accurate and this section replaces it.

Your shopping cart and your reading text-size preference are kept in your browser's local storage rather than in a cookie. They never reach our servers and hold only product identifiers, quantities and a size setting.

When you place an order we copy the following onto the order record, so that a completed sale can be attributed to the campaign that produced it. Payment is confirmed by our own server, and these are captured at that moment because the confirmation reaches us without your browser's cookies.

• The campaign values from sl_attr — utm_source, utm_medium, utm_campaign and the page you first landed on.
• The Google Analytics identifier from _ga, so the purchase is reported against the same visit rather than as a new anonymous one.
• The Meta identifiers from _fbp and _fbc, for the same reason.

We also keep a log of the analytics events the site sent. That log records which kinds of identifier were included — for example “an email was included” — and never the values themselves.

• Orders and invoices — as long as Indian tax and accounting rules require.
• Download links — they expire one year after purchase.
• Campaign and analytics identifiers stored on an order — for as long as we keep that order, because they form part of the record of how the sale came about. They are deleted with it.
• The sl_attr cookie — 30 days in your browser, unless you clear it sooner.
• Cookies set by Google and Meta — controlled by them, not by us; see their own policies. Clearing your browser cookies removes them.
• Our analytics event log — kept indefinitely, because it records only event names, amounts and which categories of identifier were sent, never the identifiers themselves.

You can ask us to delete your account and associated personal data at any time, except records we are legally required to retain.

Under India's Digital Personal Data Protection Act, 2023 you have the following rights over your personal data, including the analytics and advertising identifiers described above:

• Access — a summary of the personal data we hold about you, what we are doing with it, and who we have shared it with.
• Correction and completion — to have inaccurate or incomplete data corrected or updated.
• Erasure — to have your data deleted, unless we are required by law to keep it, such as invoice records.
• Withdraw consent — to stop analytics and advertising processing, and to stop marketing email, at any time. Withdrawing consent does not undo processing already carried out.
• Grievance redressal — to raise a complaint with us about how your data is handled, and to escalate to the Data Protection Board of India if you are not satisfied with our response.
• Nomination — to nominate another person to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these, write to [SUPPORT EMAIL ADDRESS] and we will respond within a reasonable period. You can also stop the Google and Meta cookies yourself at any time by clearing or blocking cookies for this site in your browser, or by using Google's and Meta's own opt-out controls.

Payments are verified server-side against a signed confirmation from Razorpay. Product files are held in private storage and served only through expiring, limited-use links tied to your order. Sessions are signed so they cannot be edited in your browser.

If this policy changes materially we will update the date at the top of this page and, where the change affects you, tell you by email.