Privacy policy · v3 · 2026-05-15 · Edge Terminal update

What we collect, why, and how to control it.

This is v3 of the Bharath Shiksha privacy policy, updated May 2026 to disclose data flows for Edge Terminal — our newly-launched educational analytics layer at bharathshiksha.com/terminal/. All Edge Terminal personal-data (watchlists, trade-journal entries) is stored locally in your browser at V1; no Bharath Shiksha server holds it. Plain English; full enumeration below.

1. What data we collect

We classify data into essential (required to deliver the curriculum), functional (improves the experience), and analytical (helps us improve the curriculum). The classification determines retention and your control rights.

Calculator inputs (position sizing, expectancy, R-multiple, drawdown, compound returns) are computed entirely in your browser. No calculator data is transmitted to us. The calculators are designed to never need network access for their core function.

2. Why we collect it

Each data point has a specific purpose. We don't collect speculatively.

• Email + name — to deliver curriculum content and login access. Required for service delivery.
• Payment data (via Razorpay) — to process enrolment payments. Razorpay is PCI-DSS compliant; we don't see or store card numbers.
• Curriculum progress — to unlock subsequent lessons (gate quizzes, capstone certificates) and personalise the curriculum sequence.
• Tutor channel queries — to answer your methodology questions. Reviewed weekly to identify content gaps for curriculum updates.
• Diagnostic results — to compute your stage recommendation and (anonymously, in aggregate) understand stage-distribution patterns across waitlist members.
• NPS responses — to measure curriculum satisfaction and identify detractors needing personal follow-up. Used in quarterly compliance report (aggregate only; no individual responses disclosed).
• Funnel events — to understand which content paths lead to enrolment vs drop-off. Used to improve free-to-paid conversion. Aggregated; individual users not tracked across the funnel beyond pseudonymous session IDs.
• Cohort waitlist info — to send you priority enrolment links and cohort-related notifications. No marketing emails outside cohort context.
• Testimonial submissions — to publish on /testimonials.html with your consent. Performance-claim testimonials are auto-rejected per SEBI compliance.
• Affiliate program data — to track referrals and pay commissions. Bank/UPI details collected at payout time, retained for tax-record purposes.

3. Third parties & processors

The following third parties process some of your data on our behalf. We've selected each based on data-protection posture and minimum-necessary access.

We do not share your data with: marketing platforms, ad networks, analytics aggregators (Google Analytics, Facebook Pixel), data brokers, or any party outside the four processors above. We have no marketing-attribution layer that tracks you across sites.

4. Cookies & tracking

We use a minimal cookie set. The site cookie banner offers consent choices.

• Essential cookies (always on, no opt-out): session ID for login state, CSRF tokens. Without these, login and enrolment can't function.
• Functional cookies (default opt-in, can opt out via banner): cohort thread preferences, lesson-progress markers.
• Analytics cookies (default opt-out, opt-in via banner): pseudonymous session ID for funnel-event tracking.
• No marketing cookies. We do not run third-party ad pixels, retargeting tags, or marketing-attribution beacons. The CSP at /_headers blocks them at the platform level.

5. Retention windows

6. Your rights under DPDP Act 2023

India's Digital Personal Data Protection Act, 2023 grants you specific rights as a Data Principal. We honour each.

• Right to access. Request a copy of all personal data we hold about you. We respond within 7 working days. Email privacy@bharathshiksha.com.
• Right to correction. Request correction of inaccurate data. Most fields can be self-edited from your portal; non-self-editable fields can be requested via email.
• Right to erasure. Request deletion of your account and personal data. We honour deletion requests within 30 days, except for data we're legally required to retain (e.g., payment records for tax purposes).
• Right to portability. Request export of your data in machine-readable format (JSON or CSV). Trade journal entries, curriculum progress, and tutor channel queries are exportable.
• Right to grievance. If you believe we've mishandled your data, file via grievance redressal Stage 1.
• Right to nominate. You can nominate another person to act on your behalf in case of incapacity or death. Contact privacy@bharathshiksha.com with nomination details.
• Right to withdraw consent. Withdraw consent for analytics cookies, marketing emails, or functional features at any time. Doesn't affect prior processing.

7. International data transfer

Your data is processed in India and the United States. Netlify (hosting + Identity) operates servers in the US; data in transit is encrypted (TLS 1.3). Razorpay is India-based; Backblaze B2 is US-based with India edge replication. Postmark is US-based.

Per DPDP Act 2023, cross-border transfers to countries not on the negative list are permitted. The Government of India hasn't yet published the negative list as of May 2026; if it does and the US is included, we'll migrate the relevant processing within 90 days of the gazette notification and disclose the change at this URL.

8. Children's data

The Bharath Shiksha curriculum is intended for adult learners. We do not knowingly collect data from children under 18. Account creation requires self-declaration of age 18+. If you believe a minor has created an account, contact privacy@bharathshiksha.com and we'll delete the account and associated data within 7 working days.

9. Changes to this policy

We update this policy when we add features, change processors, or in response to regulatory updates. Material changes are notified via email to all enrolled students at least 30 days before the change takes effect. Non-material changes (clarifications, formatting) are made silently with the version number and date updated.

Version history: v1 (initial), v2 (this version, 2026-05-08). v1 archived at /privacy-v1.html.

10. Edge Terminal — data flows (Q2 2026)

Edge Terminal launched in May 2026 as the educational analytics layer at bharathshiksha.com/terminal/. Six modules: Visualiser, Watchlist, Backtester, Trade Journal, Risk-Literacy, Methodology Library. We disclose the data flow for each module below.

Visualiser (Module 01)

Data collected: none personal. Your chart-overlay selections and timeframe choices are not stored. Data shown: historical NSE Bhavcopy OHLC (≥30-day lag) via the cache-bhavcopy scheduled function into terminal-ohlc Netlify Blobs, served read-only via /api/ohlc.

Watchlist (Module 02)

Data stored: the list of tickers and notes you add. Where: in YOUR BROWSER's localStorage under key bs.terminal.watchlist.v1. Bharath Shiksha does NOT see this data. Clearing your browser data clears your watchlist. Future Phase 2.5 work may add optional Netlify Identity-gated sync for logged-in users; that change will be disclosed before deployment.

Backtester (Module 03)

Data stored: none. Backtest runs happen entirely in your browser; results are not transmitted to Bharath Shiksha. Data shown: the same historical Bhavcopy data + your selected methodology rules. The cache-bhavcopy daily cron fetches data; the get-ohlc API reads cached data on request.

Trade Journal (Module 04)

Data stored: the trades YOU enter. Where: in YOUR BROWSER's localStorage under key bs.terminal.tradejournal.v1. Bharath Shiksha does NOT see your trade history. All aggregation (R-multiples, win rates, behavioural insights) is computed in your browser. CSV export downloads to your device. Future cross-device sync (Phase 2.5) will be optional and disclosed before deployment.

Risk-Literacy Dashboard (Module 05)

Data collected: none. Data shown: historical macro indicators + sector breadth, both via the same terminal-ohlc cache. FII/DII illustrations at V1 are deterministic-synthetic; a real NSE EOD scrape is in the Phase 2.5 backlog and will be disclosed if added.

Methodology Library (Module 06)

Data collected: none. Pure reference documentation. Data shown: the 255-methodology catalog stored as a static JavaScript bundle at terminal/data/methodology-catalog.js.

Stage-gate unlock state

The Edge Terminal reads your Netlify Identity roles client-side via window.netlifyIdentity.currentUser() to determine which methodologies are unlocked at your stage. This read happens entirely in your browser — no separate Bharath Shiksha server call is made for stage-gating. Your roles are already known to Bharath Shiksha because you purchased a stage through us.

Phase 2 / Phase 2.5 / Phase 3 disclosure triggers

• Cross-device sync (Phase 2.5): if a logged-in user opts into syncing watchlist/journal across devices, data will be stored in Netlify Blobs scoped to their Netlify Identity user ID. Disclosed before deployment.
• Real-time data licensing: not planned. If ever pursued, would change the data flow materially and require fresh disclosure + lawyer review.
• FII/DII real scrape (Phase 3): public NSE EOD CSV — no personal data, but disclosed for completeness.

What Edge Terminal will NEVER collect

• Your broker login credentials
• Your actual portfolio holdings or positions
• Your bank account or card details (those go to Razorpay, not us)
• Real-time location, microphone, camera, or any device sensor
• Cross-site tracking cookies for advertising

11. Contact

For privacy questions or to exercise any right above, contact:

• Email: privacy@bharathshiksha.com
• Postal: Bharath Shiksha, [Bengaluru office address — TBD before public launch]
• Grievance: grievance-redressal.html

This privacy policy is the canonical statement of Bharath Shiksha's data practices as of 2026-05-08. Reviewed annually and updated when material changes occur. Disputes governed by Indian law; jurisdiction Bengaluru. The policy doesn't waive consumer-protection rights you have under Indian law including the DPDP Act 2023.