1. Information We Collect
Categories of personal and educational data processed
To provide a personalized learning experience and issue verifiable certificates, we collect information that you directly provide as well as telemetry generated through platform usage:
- Account Profile Data: Full name, verified email address, hashed passwords, avatar photographs, and user bio.
- Educational Activity: Course progress metrics, video completion timestamps, quiz responses, assignment submissions, and generated completion certificates.
- Billing & Transaction Details: bKash wallet number, Transaction IDs (TrxID), Stripe payment intent IDs, purchased course IDs, currency amounts, and order invoice dates.
- Technical & Device Logs: IP address, browser type, operating system version, access timestamps, and error diagnostics collected to prevent fraud and diagnose streaming issues.
We never ask for sensitive government identifiers, biometric scans, or access to your device contacts.
2. How We Use Your Information
Purposes and legal bases for data processing
We utilize your data exclusively to deliver, maintain, and enhance educational services:
- Course Delivery: Unlocking syllabus modules, streaming video lectures, and tracking progress across your student dashboard.
- Certificate Issuance: Rendering your verified legal name on tamper-proof PDF completion certificates with authentic verification codes.
- Transactional Notifications: Sending automated email receipts via Nodemailer, enrollment confirmations, and password reset instructions.
- Instructor Collaboration: Enabling instructors to evaluate submitted assignments and provide direct student feedback.
- Security & Fraud Prevention: Detecting fraudulent bKash transactions, bot registrations, and protecting instructor copyrights.
3. Payment & Financial Data (bKash & Stripe)
Rigorous financial protection protocols for mobile banking and cards
Your financial security is our highest priority. We follow strict separation of financial credentials:
bKash বিকাশ Gateway Integration
During bKash checkout, your bKash PIN is processed strictly within transient encrypted sessions. LMS Studio NEVER stores, logs, or has access to your bKash PIN. We only retain the transaction ID (TrxID) and mobile number for invoice verification.
Stripe PCI-DSS Processing
Credit and debit card numbers entered during international checkout are transmitted directly to Stripe’s PCI-DSS Level 1 compliant servers. No card numbers or CVV codes ever touch our internal databases.
6. Data Retention & Deletion
How long your records persist and permanent erasure
We retain your course progress, certificates, and enrollment records for as long as your account remains active so you can access lifetime course benefits and verify certificates with employers.
If you choose to delete your account, we permanently scrub your personal identity records, email address, and profile data from active databases within 30 days, retaining only anonymized transaction records required by financial tax regulations.
7. Your Privacy Rights & Choices
Access, rectification, export, and consent revocation
Regardless of your geographic location, you enjoy comprehensive privacy rights:
- Right to Access: You can review all personal data and course completion records via your student profile.
- Right to Rectification: You may update misspelled names or profile information directly from account settings.
- Right to Portability: You can download all earned PDF completion certificates and assignment records at any time.
- Right to Erasure: You can submit an account closure request to have your personal data permanently removed.
To exercise any of these rights, email us at [email protected]. We process requests within 72 business hours.
8. Security Architecture & Encryption
Technical defense mechanisms protecting your data
We implement enterprise-grade security standards across our application stack:
- Transport Layer Security (TLS 1.3): All client-to-server traffic is protected by 256-bit SSL encryption.
- Bcrypt Password Hashing: User passwords are encrypted using multi-round salted bcrypt hashing, rendering them unreadable even to database administrators.
- JSON Web Tokens (JWT): Stateless authentication with cryptographically signed tokens and automated expiration.
- Role-Based Access Control (RBAC): Strict role separation between Students, Instructors, and System Administrators.
9. Children’s Privacy
Protections for young learners
Our services are not intended for children under 13 years of age. We do not knowingly solicit or collect personal information from individuals under 13.
If we discover that a child under 13 has provided personal data without parental consent, we will promptly delete such information. Parents who believe their child has registered may contact us immediately at [email protected].
10. Contact Our Privacy Team
Dedicated privacy and compliance contacts
For privacy inquiries, data subject requests, or questions regarding our security architecture, please contact our Data Protection Officer:
Email: [email protected] | Compliance: [email protected] | Headquarters: Dhaka, Bangladesh