Privacy Policy

1. Information We Collect

2. How We Use Your Information

• Provide and improve our courses and services
• Process payments and send purchase confirmations
• Track your course progress and provide personalized recommendations
• Send important updates about your enrolled courses
• Respond to your inquiries and support requests
• Analyze usage patterns to improve our platform
• Comply with legal obligations

3. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your data based on:

• Contract: To fulfill our agreement when you purchase a course
• Consent: For analytics cookies (with your explicit consent)
• Legitimate Interest: To improve our services and prevent fraud
• Legal Obligation: To comply with tax and financial regulations

4. Data Sharing

We share your information only with:

• Payment Processors: Stripe for secure payment processing
• Cloud Services: Google Cloud Platform for hosting and storage
• Analytics: Google Analytics (only with your consent)
• Email Service: Resend, Inc., USA. For transactional emails (purchase confirmations, course access, booking confirmations). Data processed: email address, name, delivery status.
• Call Scheduling: Cal.com for consultation bookings (Global customers only). Cal.com, Inc., USA. Video calls powered by Cal Video.
• Geolocation: Cloudflare Trace API for country detection (regional routing). Cloudflare, Inc., USA. Your browser sends your IP address to Cloudflare to retrieve your country code.
• Authentication (Google): Google OAuth for account login. Google Ireland Ltd., Ireland. Data processed: name, email address, and profile picture.
• Authentication (Apple): Apple Sign In for account login. Apple Inc., USA. Data processed: Apple ID, name, and email address (optionally hidden via Apple's "Hide My Email" feature).
• Rate Limiting: Upstash, Inc., USA. For abuse prevention and DDoS protection. Data processed: hashed IP addresses with automatic expiry (1–60 minutes).

We never sell your personal data to third parties.

5. Data Retention

• Account Data: Retained while your account is active, plus 30 days after deletion request
• Payment Records: Retained for 7 years for tax compliance
• Course Progress: Retained while enrolled in courses
• Support Communications: Retained for 2 years
• Rate Limit Data: Automatically expires after 1–60 minutes (Upstash Redis)
• Email Delivery Logs: Retained per Resend's retention policy
• Analytics Data: 14 months (Google Analytics 4 default)
• Video Access Logs: 90 days
• Document Review Files: 1 year (auto-deleted via GCS lifecycle policy)

6. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Data Portability: Receive your data in a portable format
• Withdraw Consent: Opt out of analytics tracking at any time

To exercise these rights, visit your Profile page or contact us at contact@sunnyredhu.com.

7. Cookies

We use cookies for:

• Essential Cookies: Authentication, session management, region preference
• Payment Cookies: Stripe cookies for secure payment processing and fraud prevention (set only during checkout)
• Analytics Cookies: Google Analytics (only with your consent)

You can manage your cookie preferences through our cookie consent banner or browser settings.

8. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all data transmission
• Secure cloud infrastructure with Google Cloud Platform
• Regular security audits and updates
• Access controls and authentication

9. International Data Transfers

Your data is stored on Google Cloud servers in Europe (Belgium, europe-west1). If data is transferred outside the EEA, we ensure appropriate safeguards are in place.

10. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children under 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through our website.

Automated Decision-Making

We do not use automated decision-making or profiling as defined under GDPR Art. 22. All significant decisions (e.g., course access, payment processing) are handled through standard processes without automated profiling.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: contact@sunnyredhu.com
• Business: Sunny Redhu (Sunny Redhu)
• Location: Sunny Redhu c/o GAM, Pappelallee 64, 10437 Berlin, Germany

13. Data Protection Authority

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In Germany, the competent authority for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information):

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin, Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de