Privacy policy

We collect the following categories of personal data:

• Account data — name, email, phone number, country, date of birth, role (student / mentor / admin), password (stored as a one-way bcrypt hash, never in plaintext), Google account identifier when you sign in with Google.
• Profile data — avatar, bio, expertise, headline, and any professional links you choose to share (LinkedIn, website).
• Enrolment & learning data — courses enrolled, lesson progress, quiz attempts, assignment submissions, certificates issued, mentor bookings, Q&A threads.
• Transaction data — order history, invoice records, payment identifiers (we never store full card numbers; instruments are tokenised by Razorpay / Stripe), GST details if you provide them.
• Communications — emails, WhatsApp messages, support tickets, testimonials and reviews you submit.
• Technical & usage data — IP address, browser, device type, referrer, pages viewed, time-on-page, cookies (see our Cookie Policy).
• Sensitive personal data or information (SPDI) — passwords and payment instrument details. We do not collect biometric, health or sexual orientation data.

We do not knowingly collect personal data from children under 18. If you are below 18, please ask a parent or legal guardian to enrol on your behalf.

Under §6 of the DPDP Act we process personal data only for specified, lawful purposes:

• To create your account, authenticate you, and deliver the Services.
• To process payments, issue GST-compliant invoices, fulfil enrolments, refund approved cancellations and prevent fraud.
• To send transactional communications (cohort start, mentor session reminders, certificates, password resets) — these are not opt-out as they are required to deliver the Service.
• To send marketing and product updates only with your express consent (toggleable in your account settings).
• To improve our courses, run aggregated analytics, and prevent abuse of the platform.
• To comply with legal, regulatory and tax obligations.

We do not sell your personal data. We share it only with carefully selected data processors under contractual data protection terms:

• Razorpay Software Pvt Ltd, Stripe — payment processing, including card / UPI / net-banking tokenisation.
• SendGrid (Twilio) — transactional emails.
• WhatsApp Business via Interakt — opted-in messaging.
• Google LLC — Sign-In with Google, Google Calendar / Meet for live sessions.
• Amazon Web Services (Mumbai region) — application hosting and S3 object storage. Your data is stored in India by default.
• MongoDB Atlas (India region) — primary database.
• Sentry, PostHog — error tracking and product analytics, with IP-anonymisation enabled.

We disclose personal data to law enforcement, courts or regulators only when required by valid legal process under Indian law.

We keep your personal data for as long as you maintain an account, plus a limited retention window after closure to satisfy our legal obligations:

• Account & learning records — retained while your account is active. On closure, deleted within 90 days, except where retention is required for legal compliance.
• Tax invoices & payment records — retained for 8 years as required by §36 of the CGST Act, 2017 and the Income-tax Act, 1961.
• Marketing consent records — retained for 3 years after withdrawal to demonstrate prior consent.
• Server logs & security audit trails — retained for 180 days per Rule 4 of the IT Rules, 2021.

Under §11–§14 of the DPDP Act you have the right to:

• Access a summary of personal data we hold and the processing we do.
• Correct inaccurate, incomplete or out-of-date personal data.
• Erase personal data when it is no longer needed for the purpose collected (subject to legal retention duties above).
• Withdraw consent at any time — without affecting lawfulness of prior processing.
• Nominate another individual to exercise these rights on your behalf in case of death or incapacity.
• Grievance redressal — file a complaint with our Grievance Officer (see §10) and, if unsatisfied, with the Data Protection Board of India.

To exercise any of these rights, email gthindore@gmail.com with the subject “Data Principal Request”. We respond within 30 days.

We implement reasonable security practices and procedures consistent with IS/ISO/IEC 27001 as required by the SPDI Rules, including:

• TLS 1.3 encryption for all data in transit.
• Encryption at rest for the primary database and S3 object storage (AES-256, AWS KMS-managed keys).
• One-way bcrypt hashing of passwords.
• Role-based access control with least-privilege; admin actions are logged with actor and timestamp.
• JWT access tokens (15 min) and refresh tokens (30 days) with revocation.
• Regular dependency scanning and security patching.

In the unlikely event of a personal data breach we will notify affected users and the Data Protection Board within 72 hours as required by §8(6) of the DPDP Act.

Your personal data is stored in India (AWS Mumbai). Where any of our processors (e.g. Sentry, Stripe US) transfer data outside India, we rely on contractual safeguards permitted under §16 of the DPDP Act and applicable Government of India notifications.

We use essential, analytics and preference cookies. See our Cookie Policy for the full list and how to manage them.

We may update this policy from time to time. Material changes will be notified via email and a banner on this page at least 14 days before they take effect. Continued use of the Services after changes take effect constitutes acceptance.

Per Rule 5(9) of the SPDI Rules and §28 of the DPDP Act, the designated Grievance Officer for Global Trade House is:

• Name: Manoj Sharma
• Designation: Director — Operations & Technology
• Email: gthindore@gmail.com
• Phone: +91 96912 99617 (Mon–Sat, 10:00–18:00 IST)
• Address: 323, 3rd Floor, Milinda Manor, Regal Circle, Opposite TI Next Mall, Indore, Madhya Pradesh, India

We acknowledge complaints within 24 hours and resolve them within 15 days. See our Grievance Redressal page for the full process.