Privacy Policy
Last updated: 5 August 2026
This Privacy Policy explains how Iqra Khan (“we,” “us,” “our”) collects, uses, discloses, and protects personal data of users of iqrakhanscholar-com.vercel.app(“the Website”). By using the Website, purchasing digital content, or booking a consultation, you acknowledge that you have read and understood this Policy.
1. Data Controller
Iqra Khan Scholar
Email: iqrakspromo@gmail.com
Website: https://iqrakhanscholar-com.vercel.app
2. Data We Collect
| Category | Examples |
|---|---|
| Account data | Name, email address, password (stored as a hash) |
| Order data | Shipping address, order history, payment reference |
| Usage data | Pages visited, reading progress, session duration |
| Communication data | Contact form submissions, consultation notes |
| Technical data | IP address, browser type, device information |
We do not store full card or banking details. Payments are processed by Razorpay in compliance with PCI-DSS standards; we only retain a payment reference.
Consultation notes may occasionally include sensitive personal information shared voluntarily during sessions (e.g. related to personal, family, or emotional matters). We treat this information with additional confidentiality safeguards, access to such notes is restricted to Iqra Khan only, and this data is not shared with any third party except where legally required.
3. Purpose of Processing
We process personal data to:
- Create and manage user accounts
- Process orders and deliver digital content
- Schedule and manage consultations
- Send order confirmations and service updates
- Improve the Website and our services
- Respond to enquiries
- Send marketing communications (with consent)
- Protect our legal rights, enforce our Terms of Service, and prevent misuse, fraud, or unauthorised access to the Website or its content
4. Legal Basis for Processing (Article 6 GDPR)
| Purpose | Legal Basis |
|---|---|
| Order processing, digital content delivery, consultations | Contract |
| Marketing communications, analytics cookies, optional data collection | Consent |
| Fraud prevention, website security, service improvement, enforcement of our rights and Terms of Service, business analytics | Legitimate interest |
| Tax and accounting records | Legal obligation |
| Sensitive information shared during consultations | Explicit consent (given voluntarily when booking/attending a session) |
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion, or longer if required to resolve disputes, enforce our agreements, or comply with legal obligations |
| Order data | 7 years (tax obligations) |
| Consultation records | 3 years after the last session |
| Marketing consent | Until withdrawn |
| Technical logs | 90 days |
We reserve the right to retain data beyond the periods above where necessary to protect our legal interests, defend against claims, or comply with a legal or regulatory requirement.
6. Third-Party Processors
- Razorpay - Payment processing
- MongoDB Atlas - Database hosting
- Cloudinary - Image and media hosting
- Vercel - Website hosting and analytics
- Google AdSense - Third-party advertising
All processors are contractually bound to protect data in line with applicable data protection law. We may add, remove, or change processors at our discretion to operate and improve the Website; this Policy will be updated to reflect material changes, but individual notice will not be given for routine processor changes.
International Data Transfers
Some processors may store or process data outside your country of residence. Where this occurs, we rely on Standard Contractual Clauses or equivalent safeguards.
8. Data Security & Limitation of Liability
We implement reasonable technical and organisational measures - including password hashing, restricted access, and encrypted transmission - to protect your data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. To the maximum extent permitted by law, we disclaim liability for unauthorised access, loss, or disclosure of data resulting from circumstances beyond our reasonable control, including third-party processor failures, cyberattacks, or user negligence (e.g. weak passwords, sharing login credentials).
In the event of a data breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.
9. Acceptable Use
Content, materials, and information provided through the Website - including digital products and consultation materials - are for your personal use only. You may not copy, reproduce, distribute, modify, reverse-engineer, or create derivative works from any Website content without our prior written consent. Unauthorised use may result in suspension of access and/or legal action.
10. Children's Privacy
Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided personal data without parental consent, contact us for removal.
11. Your Rights
- Access - Request a copy of your data
- Rectification - Correct inaccurate data
- Erasure- Request deletion (“right to be forgotten”)
- Portability - Receive data in a machine-readable format
- Objection - Object to processing based on legitimate interest
- Restriction - Request limited processing
- Withdraw consent - At any time for consent-based processing
These rights may be subject to exemptions permitted under applicable law, including where retention is necessary for legal compliance or to establish, exercise, or defend legal claims. To exercise your rights, use your account Settings page or email iqrakspromo@gmail.com. We aim to respond within one month.
12. Changes to This Policy
We may update this Privacy Policy at any time at our sole discretion, to reflect changes in our practices, technology, legal requirements, or business operations. The “Last updated” date will be revised accordingly. Continued use of the Website after changes take effect constitutes acceptance of the revised Policy. We encourage you to review this page periodically.
13. Governing Law
This Privacy Policy shall be governed by and interpreted in accordance with the laws of India, without regard to conflict of law principles, except where mandatory local data protection law (such as the GDPR, for EU-based users) grants you rights that cannot be overridden. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of New Delhi.
14. Complaints
If you believe your data protection rights have been violated, you may lodge a complaint with your local data protection authority (for EU residents, via the European Data Protection Board).
15. Contact Us
Email: iqrakspromo@gmail.com