মূল content-এ যান
Cart

Policies

Privacy Policy

Effective date: 13 October 2026 · Last updated: 13 October 2026

This Privacy Policy explains what personal data sus.trades collects, why we collect it, how it is used and shared, and the choices and rights you have. This website, sustrades.in, is operated under the brand name sus.trades, based in Tamluk, West Bengal, India (PIN 721636). In these policies, “sus.trades”, “we”, “us” and “our” refer to the operator of this website.

1. Information we collect from customers

We collect only what we need to run the website and deliver our products:

  • Account information: your name, email address and password (stored only in hashed form by our authentication provider).
  • Optional profile information: a phone number, if you choose to add one.
  • Free resource downloads: your name and WhatsApp number, which are required to download a free PDF, together with the resource you downloaded and the time. We use them only to send sus.trades updates and to provide support, and you can ask us to delete them at any time.
  • Order information: courses purchased, order amounts, order status and timestamps.
  • Learning information: the courses you have access to and the lessons you mark as complete.
  • Support messages: your name, email, the topic, any order number you provide and the content of your message.
  • Technical information: IP address, browser/device information and request logs generated when you use the website.

Downloading a free resource does not require an account and does not require you to give us your name or email.

2. Account and authentication information

Sign-up, login, email confirmation and password reset are handled by Supabase Auth. Passwords are never visible to us. Session information is stored in secure cookies on your device so that you stay signed in.

3. Email addresses and customer contact information

We use your email address to operate your account (confirmation and password-reset emails), to send information about your orders and access, and to reply to your support requests. We do not currently send marketing emails. If we introduce marketing communications in the future, we will ask for your consent where required and provide a way to opt out.

4. Orders and payment references

For each order we store the items, amount, status and the payment references issued by Razorpay (such as order ID, payment ID, refund ID, payment method type and, for failed payments, the error code). We keep these records to deliver access, handle refunds and support requests, prevent fraud and meet accounting and legal obligations.

5. Payment processing through Razorpay

Payments are processed by Razorpay. When you pay, you provide your payment details directly to Razorpay inside its checkout window. We do not receive or store your full card number, CVV, UPI PIN, net-banking credentials or wallet passwords. Razorpay processes your payment information under its own terms and privacy policy. We share with Razorpay the order amount and, to pre-fill checkout, your name and email address.

6. Supabase hosting, authentication, database and storage

Our database, user authentication and file storage (course files, PDFs and images) are provided by Supabase. Your account, order, learning and support data are stored in our Supabase project, protected by access controls including row-level security.

7. Vercel hosting and technical logs

The website is hosted on Vercel. Like most hosting providers, Vercel processes technical request data (such as IP address, user agent, requested URL and timestamps) to serve the website, maintain security and produce logs that help us diagnose errors.

8. Cookies, sessions and essential technologies

We use only cookies that are necessary for the website to function:

  • Authentication cookies (set by Supabase Auth, names beginning with sb-) keep you signed in securely.
  • Cart cookie (st_cart) remembers which courses you added to your cart. It contains only course identifiers.

The Razorpay checkout window may use its own cookies or similar technologies, governed by Razorpay’s policies. We do not use advertising or cross-site tracking cookies.

9. Analytics

We do not currently use any third-party analytics or advertising tools on this website. If we enable analytics in the future, we will update this policy before doing so and describe what is collected.

10. Purposes and lawful basis for processing

We process personal data for the following purposes:

  • to create and manage your account and authenticate you;
  • to process orders, verify payments, grant and manage course access, and handle refunds;
  • to respond to support requests, complaints and privacy requests;
  • to keep the website secure, prevent fraud and abuse (including rate limiting) and fix technical problems; and
  • to comply with legal, tax and accounting obligations.

We process personal data on the basis of your consent (given when you create an account, place an order or contact us) and, where applicable law permits, for legitimate uses such as fulfilling a service you have requested and complying with legal obligations.

11. Data sharing with service providers

We do not sell your personal data. We share personal data only with service providers who process it on our behalf to operate the website — currently Razorpay (payments), Supabase (authentication, database and storage) and Vercel (hosting) — and where we are required to disclose it by law, court order or a lawful request from a government authority. If you contact us on WhatsApp, that conversation is also processed by WhatsApp under its own terms.

12. Security safeguards

We use reasonable security safeguards appropriate to the data we hold, including:

  • encrypted connections (HTTPS) for all traffic;
  • database row-level security so that customers can only access their own records;
  • private storage for paid course files, delivered only through short-lived signed links after an access check;
  • server-side verification of every payment and of every administrative action, with an audit trail of sensitive admin actions; and
  • keeping secret keys only on the server and limiting administrative access.

No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any issue.

13. Data retention and deletion

  • Account and profile data are kept while your account is active.
  • Order, payment and refund records are kept for as long as required for accounting, tax, dispute-resolution and legal purposes, even if you close your account.
  • Support messages are kept for as long as needed to resolve the request and for a reasonable period afterwards for reference.
  • Rate-limiting records (which may include an IP address) are short-lived and routinely deleted.
  • Hosting providers keep technical logs according to their own retention settings.

To delete your account, email us from your account’s email address. We will delete or anonymise your personal data, except records we must retain by law, which will be kept only for that purpose.

14. Your rights and how to submit requests

Subject to applicable law, you may request to:

  • access a summary of the personal data we hold about you;
  • correct or update inaccurate or incomplete data (you can edit your name and phone number in your account);
  • erase your personal data, subject to records we must retain by law;
  • withdraw consent, where processing is based on consent (this does not affect processing already carried out); and
  • raise a grievance about how your data is handled.

Send requests to sustrades.fx@gmail.com from the email address on your account (so we can verify it is you), or use the Contact page and choose “Privacy / data request”. We may need to verify your identity before acting on a request.

15. Children’s privacy and age-appropriate use

The website and our courses are intended for adults aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has created an account or provided personal data, please contact us and we will take appropriate steps to delete it.

16. Cross-border processing

Our service providers may store or process data on servers located outside India, depending on their infrastructure and the regions configured for our services. Where data is transferred outside India, we rely on providers that apply appropriate security measures, and we will comply with any restrictions on cross-border transfer that apply under Indian law.

17. Security incident handling

If we become aware of a security incident affecting personal data, we will act promptly to contain and investigate it, take steps to reduce any harm, and notify affected users and authorities where required by applicable law.

18. Updates to this policy

We may update this Privacy Policy to reflect changes to our practices or legal requirements. The effective date at the top of this page shows when it was last updated. Material changes will be posted on this page.

19. Contact details