The Last Slide← Back to site

Legal

Privacy Policy

Last updated: 21 June 2026

Please note: this is placeholder legal text. It must be reviewed and finalised by a qualified lawyer before launch. It is written to be accurate to how the site actually works today, but it is not legal advice and may need to be adapted for your final business arrangements and the laws that apply to you.

This Privacy Policy explains how The Last Slide (the “Site”, thelastslide.com) collects, uses, shares, and protects personal data. The Site is the marketing home of the book The Last Slide by Manish Katariya, and it offers a paid online reader (a one-time payment of £9.99 for lifetime, browser-based reading access).

We have written this policy to be aware of three privacy regimes at once: India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), the EU and UK General Data Protection Regulation (“GDPR” / “UK GDPR”), and the California Consumer Privacy Act as amended by the CPRA (“CCPA”). Depending on where you live, different rights and terms apply to you; we have tried to give everyone the stronger protection where it is practical to do so.

Who we are (Data Controller / Data Fiduciary)

The Site is operated by Manish Katariya, who is the “data controller” (GDPR), “data fiduciary” (DPDP Act), and “business” (CCPA) responsible for your personal data. Manish is established in India and serves readers worldwide, including in the EU, the UK, and California.

You can reach the controller, and the Grievance Officer named below, at thelastslide@outlook.com.

What we collect and why

1. Information you give us

  • Email address — when you request the free sample chapter, subscribe to the “Edge Point” newsletter, use the contact form, or submit a review. For the contact form we also collect the name, optional subject, and the message you write. For reviews we collect what you choose to submit (such as your name or initials and your review text).
  • Reader access — when you buy the online reader, we store the email address tied to your purchase so we can grant and recognise your lifetime reading access, plus an order record (a payment reference, amount, currency, and “paid” status). To remember that you are signed in on a device, we set a small reader cookie (see Cookies, below).

2. Payment information

Payments are handled entirely by Dodo Payments, which acts as the Merchant of Record. Dodo collects and processes your card or payment details on its own systems. The Site never sees, receives, or stores your full card number. We receive only confirmation of a successful payment along with the email and basic order details described above. Dodo’s handling of your payment data is governed by Dodo’s own privacy policy.

3. First-party, privacy-respecting analytics

We run our own minimal analytics to understand, in aggregate, how the Site is used. For each page view we record:

  • the page path you viewed and the referring website (if any);
  • a derived country (from a network-level header) and a coarse device type (mobile, tablet, or desktop, derived from your browser’s user-agent string);
  • a random session identifier generated by your browser and stored in your browser’s localStorage, so we can roughly tell repeat visits in one browser apart from new ones.

To be clear about what we do not do: we do not store your IP address, we use no advertising trackers, we do no cross-site tracking, and we do no device fingerprinting. The random session id is not linked to your name or email. If your browser sends a “Do Not Track” signal, we do not record analytics for that visit.

Categories of personal information (CCPA)

For California residents, the categories of personal information we collect are: identifiers (such as your email address and, for the contact form, your name); customer records / commercial information (your purchase and order record); internet or other electronic network activity (page path, referrer, coarse device type, and a random session id); and geolocation data only at the coarse, derived country level. We collect these directly from you and from your interaction with the Site, and we use them for the business purposes described in this policy (providing the Site and reader, responding to you, security and fraud prevention, and aggregate analytics). We do not collect sensitive personal information for the purpose of inferring characteristics, and we do not sell or share personal information and have not done so in the preceding 12 months.

Legal bases and consent

Where the GDPR / UK GDPR applies, we rely on the following legal bases:

  • Consent — for sending you the sample chapter and the “Edge Point” newsletter, and for our analytics where consent is required. You can withdraw consent at any time (every email has an unsubscribe link), without affecting processing already carried out.
  • Performance of a contract — to process your purchase and provide and maintain your lifetime reader access.
  • Legitimate interests — to respond to your messages, prevent fraud and abuse, secure the Site, and understand site usage in aggregate. Where we rely on legitimate interests, we have balanced them against your rights.
  • Legal obligation — to keep records (for example, tax or accounting records relating to a purchase) where the law requires it.

Where the DPDP Act applies, we process your personal data with your consent or, where permitted, for a legitimate use (such as a purpose for which you voluntarily provided your data). You may withdraw consent as easily as you gave it.

Cookies and local storage

We keep our use of cookies and similar storage to a minimum and do not use them for advertising:

  • Reader cookie (essential) — a secure, HTTP-only cookie that remembers which purchased email is reading on a device, so you stay signed in to the reader. It is necessary for the paid service to work.
  • Analytics session id (localStorage) — a random value stored in your browser as described above. It is not a cookie and is not shared across sites.
  • Admin cookie — used only by the site administrator to sign in to the private admin area; it is never set for ordinary visitors.

You can clear cookies and local storage at any time through your browser settings. Clearing the reader cookie will simply ask you to re-enter your purchase email to read again; clearing the session id resets your anonymous analytics identifier.

Service providers and other third parties (Processors)

We use a small number of trusted service providers (“processors” under GDPR; “data processors” under the DPDP Act) to run the Site. They process data on our instructions and for the purposes below only:

  • Vercel — website hosting and delivery (global, primarily US infrastructure).
  • Supabase — the database that stores subscriber emails, contact messages, reviews, order/access records, and aggregate analytics.
  • Dodo Payments — payment processing as Merchant of Record (card data is handled by Dodo, not by us).
  • WordPress mShots (Automattic) — generates a live screenshot image of the author’s public portfolio page that appears in the “About the author” section. This is an image-rendering service and does not receive your personal data.
  • Email provider — we may use an email service to send the sample chapter and newsletter. Your email address is shared with that provider only to deliver those messages.

We do not sell your personal data, and we do not share it with advertisers or data brokers. We may disclose data if required by law, to enforce our terms, or to protect rights, safety, and security.

International data transfers

We operate from India and use providers based in or operating from other countries, including the United States and the European Union. This means your personal data may be transferred to, stored, and processed in countries other than your own. Where such transfers are subject to the GDPR / UK GDPR, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision). Where the DPDP Act applies, transfers are made consistent with its requirements.

How long we keep your data (Retention)

  • Newsletter / sample emails — kept until you unsubscribe or ask us to delete your data.
  • Contact messages and reviews — kept for as long as needed to respond and for our legitimate records, then deleted on request.
  • Order and reader-access records — kept for the lifetime of your reading access and for any period required for tax, accounting, or dispute-handling purposes.
  • Analytics — retained in aggregate; the random session id is not tied to your identity.

How we protect your data (Security)

We use reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), access controls, an HMAC-signed and HTTP-only reader cookie, and reliance on reputable providers for hosting, database, and payments. No method of transmission or storage is completely secure, but we work to protect your information and to address issues promptly. If a reportable personal-data breach occurs, we will notify the relevant authorities and affected individuals as required by applicable law.

Your rights

Subject to the law that applies to you, you have rights over your personal data. These may include the right to:

  • Access — ask what personal data we hold about you and get a copy.
  • Correct — have inaccurate or incomplete data fixed.
  • Erase — ask us to delete your personal data (“right to be forgotten” / right to erasure).
  • Withdraw consent — opt out of the newsletter or other consent-based processing at any time.
  • Portability — receive certain data in a portable format (GDPR).
  • Object / restrict — object to or restrict certain processing (GDPR).
  • Grievance redressal — raise a complaint with our Grievance Officer (DPDP Act).
  • Nominate — under the DPDP Act, nominate another individual to exercise your rights in the event of your death or incapacity.
  • No solely-automated decisions — we do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
  • Opt out of “sale” or “sharing” and non-discrimination (CCPA) — California residents may opt out of the sale or sharing of personal information. We do not sell or share your personal information for cross-context behavioural advertising, and we never have. Exercising any right will not result in discriminatory treatment.

How to exercise your rights

The simplest options:

  • Unsubscribe — use the unsubscribe link in any newsletter email to stop emails immediately.
  • Email us — send your request (access, correction, erasure, withdrawal of consent, portability, or opt-out) to thelastslide@outlook.com. Tell us what you would like and the email address you used with us, so we can locate your data.
  • Data-request / deletion form — you can also make a data-access or deletion request using our data request form. If the form is unavailable, email the address above and we will handle your request directly.

We may need to verify your identity (for example, by confirming you control the email address on file) before acting on a request, to protect your data. You may use an authorised agent where the law allows. We will respond within the time required by applicable law. If you are in the EEA or UK, you also have the right to complain to your local data protection authority; in India, you may complain to the Data Protection Board after first raising the matter with our Grievance Officer.

Children

The Site is intended for professional adult readers and is not directed to children. We do not knowingly collect personal data from children (under 18 in India under the DPDP Act, or under the age set by your local law). If you believe a child has provided us personal data, please contact us and we will delete it.

Grievance Officer (India — DPDP Act)

In line with India’s DPDP Act and IT Rules, our Grievance Officer handles privacy questions and complaints:

We aim to acknowledge and address grievances within the timeframes required by applicable law.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, take additional steps to notify you where appropriate. Please review this page periodically.

Contact

Questions or requests about this policy or your data? Email thelastslide@outlook.com.