Privacy Policy

1. Who runs ARBS Academy

ARBS Academy is run by Aether Brains in Bangladesh (“ARBS Academy”, “we”, “us” or “our”). We decide how the personal data described in this Policy is used. For privacy questions and requests, use our contact form (section 14).

2. Scope

This Policy applies when you visit or use ARBS Academy’s website, applications, accounts, learning features, community areas, payments, support channels and related services (the “Service”). It does not govern a third-party website or service reached through a link; that provider’s privacy policy applies there.

3. Information we collect

• Account and identity data: email address, password hash, email-verification status, Google account name and identifier when you choose Google sign-in, chosen username, and account timestamps.
• Optional profile data: full name, avatar, phone, address, age, gender, institution, education level, field of study, graduation year, target exams and biography.
• Learning and activity data: answers, attempts, scores, mock and live-exam activity, completion marks, saved or followed circulars, progress, streaks, leaderboard choice, points, rewards and referral activity.
• Community and support data: posts, comments, feedback, votes, reports, wishlist submissions, contact-form name, email, topic and message, and our correspondence with you.
• Payment and transaction data: customer name, account email, phone, billing address, city, postcode, plan, amount, currency, payment status, merchant and gateway transaction references, gateway responses and receipt details. We do not intend to store full card, bank-account or mobile-wallet credentials; the payment provider handles those details.
• Device, security and usage data: IP address, browser or device user agent, cookie and session identifiers, requested pages, event data, approximate location derived from IP, login and security events, referral source, and diagnostic or performance information.
• Guest data: a random browser identifier stored locally, completion marks and feedback submitted before sign-in, along with IP address and user agent used for security and moderation. Eligible guest activity may be merged into your account when you sign in.

Fields marked optional may be left blank. Please do not submit sensitive information that the Service does not request.

4. How and why we use information

• create, authenticate and secure accounts; provide the learning, exam, profile, community and job-circular features you request;
• calculate progress, scores, streaks, rewards, referrals and—only if you opt in—leaderboard participation;
• process payments, activate Premium, issue receipts, reconcile transactions and respond to billing questions;
• send verification, password-reset, security, transaction, service and support messages;
• respond to questions, moderate content, correct errors and enforce our Terms;
• measure use, diagnose problems, prevent abuse and fraud, maintain audit records and improve the Service; and
• comply with legal obligations, lawful orders and the establishment, exercise or defence of legal claims.

Depending on the context, we process data with your consent, to perform our agreement with you, to comply with law, to protect vital interests, or for legitimate operational and security interests that do not override your rights. Where consent is the basis, you may withdraw it prospectively.

5. Cookies, local storage and analytics

We use two kinds of cookies and browser storage:

• Essential: sign-in and session cookies, request-forgery protection, your preferences (such as dark mode and lesson language) and security. Without these, accounts and learning features cannot work.
• Analytics: Google Analytics (GA4) measures how the Service is used: pages viewed, features used, the kind of device, and an approximate location derived from your IP address. When you are signed in, analytics events carry a pseudonymous identifier, never your username or email. We also record how you found us, for example the link you came from.

You can turn analytics off for this browser at any time. The choice is stored in this browser only:

6. When we share information

We do not sell personal data. We share it only as needed to run the Service, with:

• DigitalOcean, which hosts our application and database servers;
• Netlify, which hosts the website;
• Google, for Google Analytics and, when you choose it, Google sign-in;
• Brevo, which delivers our emails;
• Cloudflare Turnstile, which checks that sign-ups and sign-ins come from people, not bots;
• EPS, our payment service, and the banks and wallets it works with, to take, verify and support payments;
• professional advisers and authorities where reasonably necessary to obtain advice, enforce our rights, protect users, investigate abuse, or comply with law or a lawful request; and
• a successor organisation involved in a merger, financing, reorganisation or transfer of the Service, subject to confidentiality and applicable law.

Public posts are visible to other users. If you opt into a leaderboard, the profile and performance details shown in the interface will be visible as described there. Referral participants may see limited display information and referral status; they do not receive your email, phone or payment details.

7. International transfers

Some of the providers in section 6 process or store information outside Bangladesh. When personal data leaves Bangladesh, we share only what that provider needs for its part of the Service, and we use the safeguards that the Personal Data Protection Act, 2026 and other applicable law require.

8. Retention

We keep personal data only as long as we need it:

• Account, profile and learning data: while your account is active. If you ask us to delete your account, we delete this data within 30 days of the request.
• Notification and activity logs: 180 days.
• Database backups: 14 days, on a rolling basis. Deleted data leaves the backups as they roll over.
• Payment and receipt records: as long as Bangladeshi tax and accounting law requires, even after an account is deleted.

We may keep de-identified or aggregated information that can no longer reasonably identify you.

9. Security

We use reasonable administrative, technical and organisational safeguards designed to protect personal data. Measures reflected in the Service include encrypted HTTPS transport in production, restricted administrative access, strong password hashing, multi-factor authentication for staff access, secure cookies, request-forgery protection, rate limits and audit logging of sensitive administrative access. No service can guarantee absolute security.

If you suspect unauthorised access, contact us immediately. Where a personal-data breach creates a notification obligation, we will notify the competent authority and affected people in the manner and time required by applicable law.

10. Your choices and rights

Subject to applicable law and any permitted exception, you may ask us to:

• confirm whether we process your personal data and provide access to or a portable copy of it;
• correct inaccurate or incomplete data;
• delete data that is no longer required or restrict or object to certain processing;
• withdraw consent without affecting earlier lawful processing;
• explain and request review of a significant decision made solely by automated processing, if any; and
• receive information about relevant recipients, sources, purposes, retention and international transfers.

You can edit many profile fields and your leaderboard visibility in the Service. For anything else, including a copy of your data or deleting your account, use our contact form. We may verify your identity first, and we handle requests within 30 days. You may also complain to the competent data-protection authority or another regulator with jurisdiction.

11. Age and children’s privacy

ARBS Academy is for people preparing for jobs, and is meant for adults aged 18 and over. Someone under 18 may use it only with the consent of a parent or guardian. We do not knowingly collect personal data from children. A parent or guardian who believes a child has given us data without that consent can tell us through the contact form, and we will delete it.

12. Communications

We send messages needed to operate the account, such as verification, password reset, security, payment, receipt, support and material policy notices. These are service communications rather than marketing. If we introduce promotional email, we will provide the notice, consent and unsubscribe controls required by law.

13. Changes to this Policy

We may update this Policy to reflect changes in law, providers or the Service. We will post the new version and change the “Last updated” date. If a change materially affects how we use personal data, we will provide reasonable notice and obtain fresh consent where required.

14. Contact

To ask a privacy question or make a request about your data, use our contact form and choose the topic that fits. We reply by email.