Privacy Policy

To run a video-based learning platform we collect only the data that is necessary to deliver the service, settle payments and issue certificates:

• Account data: name, email, phone number, password hash and (optionally) avatar.
• Billing data: the billing name, email and phone you enter at checkout, plus the transaction reference returned by our payment gateway. We do not store your card or wallet credentials on our servers.
• Learning data: course enrollments, lesson progress, quiz attempts, scores and certificates.
• Device & usage data: IP address, browser, OS and anonymised page-view events used for analytics and abuse prevention.

Your information is used strictly to:

• Authenticate your account and protect it from unauthorised access.
• Deliver purchased courses and track learning progress.
• Process payments and issue invoices through our payment gateway.
• Issue verifiable course-completion certificates.
• Send essential service emails (enrollment confirmation, password reset, security alerts). Marketing emails are sent only when you have explicitly opted in.
• Improve the platform through aggregate analytics.

We process personal data on the basis of (a) the contract we have with you when you create an account or buy a course, (b) our legitimate interest in keeping the platform secure and improving it, and (c) your explicit consent for optional items such as marketing communications. You can withdraw consent at any time without affecting access to the courses you have already enrolled in.

We never sell your personal data. We share the minimum amount needed with trusted processors that operate under strict data-protection agreements:

• Payment gateway (SSLCommerz / SurjoPay) for processing course payments and refunds.
• Vimeo for hosting and streaming course videos.
• Google OAuth when you choose to sign in with Google.
• Email delivery providers for transactional emails.
• Hosting and analytics providers for running and monitoring the platform.

Each processor has its own privacy policy that governs how your data is handled inside their systems.

• All traffic is served over HTTPS / TLS.
• Passwords are hashed with bcrypt and never stored in plain text.
• Card and wallet details are handled exclusively by the payment gateway.
• Database access is restricted to authenticated services on a private network.
• Webhooks from the payment gateway are signature-verified to prevent tampering and replay.
• Admin accounts are role-based and protected by audit logging.

We use a small number of cookies and local-storage entries that are strictly necessary for the platform to work (authentication tokens, CSRF protection, course-player preferences) plus aggregated, non-identifying analytics. We do not use third-party advertising trackers.

• Account & learning data: for as long as your account is active.
• Payment records and certificates: retained for the period required by Bangladeshi tax and regulatory law (typically up to 6 years).
• Logs and analytics: retained for up to 12 months in aggregated form.

You can, at any time:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account, subject to records we are legally required to keep, such as tax invoices.
• Withdraw consent for marketing communications.
• Export your data in a portable format.

To exercise any of these rights, email info@rupeelingua.com from your registered email address. We respond within 30 days.

Rupee Lingua is intended for learners aged 13 and above. Learners under 18 should use the platform with parental or guardian consent. We do not knowingly collect personal data from children under 13. If you believe we have, please contact us and we will delete it.

We may update this Privacy Policy as the platform evolves. The effective date at the top of this page will be revised on each update. Material changes will be communicated by email or an in-app notice. The version in force when you use the service is the version that applies.