Privacy Policy
Last updated: 5 August 2026
This Privacy Policy explains how Iqra Khan (“we,” “us,” “our”) collects, uses, discloses, and protects personal data of users of iqrakhanscholar.com(“the Website”). By using the Website, purchasing digital content, or booking a consultation, you acknowledge that you have read and understood this Policy.
1. Data Controller
Iqra Khan Scholar
Email: iqrakspromo@gmail.com
Website: https://iqrakhanscholar.com
2. Data We Collect
| Category | Examples |
|---|---|
| Account data | Name, email address, password (stored as a hash) |
| Order data | Shipping address, order history, payment reference |
| Usage data | Pages visited, reading progress, session duration |
| Communication data | Contact form submissions, consultation notes |
| Session recordings | Audio recording of a one-to-one consultation, where the session tier includes one and you have agreed to it |
| Technical data | IP address, browser type, device information |
We do not store full card or banking details. Payments are processed by Razorpay in compliance with PCI-DSS standards; we only retain a payment reference.
Consultation notes may occasionally include sensitive personal information shared voluntarily during sessions (e.g. related to personal, family, or emotional matters). We treat this information with additional confidentiality safeguards, access to such notes is restricted to Iqra Khan only, and this data is not shared with any third party except where legally required.
3. Purpose of Processing
We process personal data to:
- Create and manage user accounts
- Process orders and deliver digital content
- Schedule and manage consultations
- Send order confirmations and service updates
- Improve the Website and our services
- Respond to enquiries
- Send marketing communications (with consent)
- Protect our legal rights, enforce our Terms of Service, and prevent misuse, fraud, or unauthorised access to the Website or its content
4. Legal Basis for Processing (Article 6 GDPR)
| Purpose | Legal Basis |
|---|---|
| Order processing, digital content delivery, consultations | Contract |
| Marketing communications, analytics cookies, optional data collection | Consent |
| Fraud prevention, website security, service improvement, enforcement of our rights and Terms of Service, business analytics | Legitimate interest |
| Tax and accounting records | Legal obligation |
| Sensitive information shared during consultations | Explicit consent (given voluntarily when booking/attending a session) |
| Session recordings | Explicit consent, confirmed at the start of the session before any recording begins. You may decline and still have the session. |
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion, or longer if required to resolve disputes, enforce our agreements, or comply with legal obligations |
| Order data | 7 years (tax obligations) |
| Consultation notes | 3 years after the last session |
| Session recordings | 12 months after the session, then permanently deleted — or sooner on request |
| Marketing consent | Until withdrawn |
| Technical logs | 90 days |
We reserve the right to retain data beyond the periods above where necessary to protect our legal interests, defend against claims, or comply with a legal or regulatory requirement.
6. Third-Party Processors
- Razorpay - Payment processing
- MongoDB Atlas - Database hosting
- Cloudinary - Image and media hosting
- Vercel - Website hosting and analytics
- Google - Google Meet hosts consultation sessions, and Google Drive stores session recordings where one has been made
- Google AdSense - Third-party advertising, loaded only on our blog pages and only if you accept marketing cookies
All processors are contractually bound to protect data in line with applicable data protection law. We may add, remove, or change processors at our discretion to operate and improve the Website; this Policy will be updated to reflect material changes, but individual notice will not be given for routine processor changes.
International Data Transfers
Some processors may store or process data outside your country of residence. Where this occurs, we rely on Standard Contractual Clauses or equivalent safeguards.
7. Session Recordings
Each consultation tier includes an audio recording of your session so you can revisit the guidance afterwards. Recordings are audio only— sessions are held as an audio call on Google Meet and video is not used.
Your consent
Nothing is recorded without your agreement. You are asked at the start of the session, before recording begins, and you may decline — the session goes ahead either way. You can also ask for recording to stop at any point during the session.
Storage and access
Recordings are made through Google Meet and stored in a private Google Drive folder accessible only to Iqra Khan. They are shared with you and with nobody else. They are never published, never used in marketing or teaching material, and never sold or shared with third parties.
Retention and deletion
Recordings are kept for 12 months after the session and then permanently deleted. You can ask us to delete your recording sooner at any time by emailing iqrakspromo@gmail.com, and we will confirm once it is done.
Because a consultation may involve sensitive personal circumstances, recordings are treated as special-category data and processed only on the basis of your explicit consent.
9. Data Security & Limitation of Liability
We implement reasonable technical and organisational measures - including password hashing, restricted access, and encrypted transmission - to protect your data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. To the maximum extent permitted by law, we disclaim liability for unauthorised access, loss, or disclosure of data resulting from circumstances beyond our reasonable control, including third-party processor failures, cyberattacks, or user negligence (e.g. weak passwords, sharing login credentials).
In the event of a data breach affecting your personal data, we will notify affected users and relevant authorities as required by applicable law.
10. Acceptable Use
Content, materials, and information provided through the Website - including digital products and consultation materials - are for your personal use only. You may not copy, reproduce, distribute, modify, reverse-engineer, or create derivative works from any Website content without our prior written consent. Unauthorised use may result in suspension of access and/or legal action.
11. Children's Privacy
Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided personal data without parental consent, contact us for removal.
12. Your Rights
- Access - Request a copy of your data
- Rectification - Correct inaccurate data
- Erasure- Request deletion (“right to be forgotten”)
- Portability - Receive data in a machine-readable format
- Objection - Object to processing based on legitimate interest
- Restriction - Request limited processing
- Withdraw consent - At any time for consent-based processing
These rights may be subject to exemptions permitted under applicable law, including where retention is necessary for legal compliance or to establish, exercise, or defend legal claims. To exercise your rights, use your account Settings page or email iqrakspromo@gmail.com. We aim to respond within one month.
13. Changes to This Policy
We may update this Privacy Policy at any time at our sole discretion, to reflect changes in our practices, technology, legal requirements, or business operations. The “Last updated” date will be revised accordingly. Continued use of the Website after changes take effect constitutes acceptance of the revised Policy. We encourage you to review this page periodically.
14. Governing Law
This Privacy Policy shall be governed by and interpreted in accordance with the laws of India, without regard to conflict of law principles, except where mandatory local data protection law (such as the GDPR, for EU-based users) grants you rights that cannot be overridden. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of New Delhi.
15. Complaints
If you believe your data protection rights have been violated, you may lodge a complaint with your local data protection authority (for EU residents, via the European Data Protection Board).
16. Contact Us
Email: iqrakspromo@gmail.com