Privacy & cookies

Who we are

Raju H runs a small-batch AI bootcamp. We collect only what we need to register you, take payment, deliver the bootcamp, and issue a completion certificate. We do not sell or share your information with advertisers.

What we collect

• Registration details you submit on the form: name, mobile, LinkedIn URL, current professional status, AI experience, learning goal, referral source.
• Google account infovia Google OAuth when you sign in to register, access your portal, or claim a certificate — specifically your name, email, and profile picture. We receive this through Google's standard OAuth scopes (openid, profile, email). We never see your Google password.
• Payment metadatafrom bKash: bKash payment ID, transaction ID, total amount paid, and the bKash service fee component charged at the time (frozen on your row so later fee-rate changes don't affect your refund math). We do not store your bKash credentials, card numbers, or PIN. The fee passthrough mechanic and refund-time treatment are documented in our Terms & conditions.
• Server-side analytics events: page views, form steps, payment funnel, material clicks, refunds, certificate issuance. Stored as event names + a session ID + a salted IP hash (we do not store raw IPs). Used to measure conversion and improve future batches.
• Optional client-side analytics: when you click Accept on the cookie banner, we load Microsoft Clarity and Google Analytics 4 on public pages. These do NOT load on your portal or admin pages. You can decline at any time.

How we use it

• To run the bootcamp you registered for.
• To send essential WhatsApp / email notifications about your registration, payment, and the live sessions.
• To process refunds for participants who complete the bootcamp.
• To improve the schedule and operations of future batches.

Cookies we set

• sid — first-party session identifier for server-side analytics. Set by our proxy on first visit. 30 days. HttpOnly + SameSite=Lax.
• cookie_consent — first-party. Records your choice on the cookie banner. 1 year.
• Google OAuth sets cookies on its own domain when you sign in.
• Auth.js session cookie — HttpOnly + Secure + SameSite=Lax JWT after sign-in. Removed at sign-out.
• When consent is granted: Google Analytics 4 and Microsoft Clarity set their own cookies per their respective policies.

Your rights

You can request access to, correction of, or deletion of your data by contacting us via the WhatsApp link on the homepage or the email tied to your registration. We will respond within 30 days.

Data retention

Registration and payment records are retained for as long as the bootcamp's lifecycle (typically 6 months from end date) plus the legally required minimum. Analytics events are kept for up to 24 months for batch-comparison reporting.

Security

All traffic is HTTPS. Sensitive identifiers (cert codes, invoice IDs) are opaque, not sequential database IDs. We do not expose personal information in URLs. Admin access is restricted to a short server-side allowlist.

Changes

If we change this policy materially, we will note the date at the top and surface it on the cookie banner.