Privacy Policy

1. Who We Are

ShikkhaGuru ("we", "us", "our") operates the exam preparation platform at shikkhaguru.com and our associated mobile applications. We are registered in Bangladesh and are the data controller for personal information collected through our services.

Contact: support@shikkhaguru.com · +8801844772217

2. What We Collect

2.1 Information you provide directly

Data	When collected	Required?
Full name	Registration	Yes
Email address	Registration	Yes
Phone number	Profile / checkout	Optional
Password (hashed)	Registration	Yes
Profile photo	Profile settings	Optional
Institution name	Profile settings	Optional
Payment details	Checkout (via gateway)	For paid plans

2.2 Information collected automatically

• Usage data: pages visited, exams attempted, questions answered, time spent, scores.
• Device data: browser type, operating system, screen resolution, device identifier.
• Log data: IP address, date/time of access, referring URL, error logs.
• Session data: stored temporarily in server-side sessions; expires after inactivity.

2.3 Information from third parties

If you sign in via Google OAuth, we receive your name, email address, and profile picture from Google. We do not receive your Google password. You may disconnect Google sign-in at any time from your profile settings.

3. How We Use Your Information

Purpose	Legal Basis
Operate and deliver our services	Contractual necessity
Process payments and verify subscriptions	Contractual necessity
Personalise your learning experience (e.g., weak-zone detection)	Legitimate interest
Send transactional emails (password reset, receipt)	Contractual necessity
Send product updates and study tips (optional)	Consent — opt-out anytime
Improve platform performance and detect fraud	Legitimate interest
Comply with legal obligations	Legal obligation

We do not use your data for advertising profiling or sell it to data brokers.

4. Sharing Your Data

We share data with third parties only in the following limited circumstances:

• Payment processors (e.g., bKash, PipraPay): receive transaction data to complete your purchase. They are bound by their own PCI-compliant privacy policies.
• Cloud infrastructure: our servers are hosted on providers that process data on our behalf under data processing agreements.
• Email service: we use a transactional email provider to deliver account emails. They only receive your email address and the content of the message.
• Legal requirements: we may disclose data if required by Bangladeshi law, court order, or to protect the rights and safety of our users.

We never share your exam scores, personal data, or study analytics with employers, universities, or any other external party without your explicit consent.

5. Cookies & Tracking

We use cookies and similar technologies for the following purposes:

Cookie type	Purpose	Deletable?
Session cookie	Keep you logged in during your session	Auto-deleted on browser close
Persistent login	Remember me across sessions	Yes, via profile settings or browser
CSRF token	Security — prevent cross-site request forgery	Auto-managed
Preference cookie	Store UI preferences (e.g., sidebar state)	Yes

We do not use third-party advertising cookies or cross-site tracking pixels. You can disable cookies in your browser settings, but some features (including login) will not work without session cookies.

6. Data Retention

• Account data: retained while your account is active and for 90 days after deletion request, then permanently deleted.
• Exam attempts & analytics: retained for the lifetime of your account to power your personal learning history.
• Payment records: retained for 7 years to comply with Bangladeshi tax and accounting regulations.
• Log files: retained for 90 days then automatically purged.

7. Security

We implement industry-standard safeguards to protect your data:

• All data is transmitted over HTTPS (TLS 1.2+).
• Passwords are hashed using bcrypt — we never store plain-text passwords.
• CSRF tokens protect all state-changing actions.
• Session IDs are regenerated on login to prevent fixation attacks.
• File uploads are validated by MIME type and stored with randomised filenames outside the web root.
• SQL queries use PDO prepared statements — no raw string concatenation.

8. Your Rights

You have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate or incomplete data via your profile settings, or by contacting us.
• Deletion: request deletion of your account and associated personal data (subject to legal retention obligations).
• Portability: receive your exam history and analytics data in a machine-readable format (CSV export).
• Opt-out: unsubscribe from marketing emails via the link in any email, or from your notification settings.

To exercise any right, email support@shikkhaguru.com with the subject line "Privacy Request". We will respond within 30 days.

9. Children's Privacy

Our Platform is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or prominent in-app notification at least 14 days before taking effect. The "Last Updated" date at the bottom of this page always reflects the most recent revision.

11. Contact & Complaints