Privacy Policy

This Privacy Policy explains how LearnTrading (“LearnTrading”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you use our online trading-education platform, available at learntrading.com (the “Service”).

It applies to visitors, registered users and subscribers. It should be read together with our Terms & Conditions and our Cookie Policy, which are incorporated by reference. Where local law grants you additional protections — for example, under the EU/UK GDPR, the California CCPA/CPRA, the Brazilian LGPD or the UAE PDPL — those protections apply alongside this Policy.

The data controller responsible for your personal data is SWISSBULL GROUP - FZCO, with registered address at IFZA Business Park, DDP, 49936-01, Dubai, United Arab Emirates.

For any privacy-related question, or to exercise the rights described in this Policy, you can contact us at support@learntrading.com.

We collect only the data we need to operate the Service. The main categories are:

• Account & authentication data. Managed through our authentication provider (Supabase): your email address, a securely hashed password and, where you sign in with a supported single sign-on provider, the account identifier and basic profile fields returned by that provider. We never store your full password in readable form.
• Profile data. Information stored in your user profile: your display name, avatar image, and — where you choose to provide them — your phone number and country.
• Subscription & entitlement data. Records of your subscription status, plan and access rights (held in our user_entitlements data) so we can grant or restrict access to paid content.
• Learning activity. Your course and lesson progress, quiz and exam results, experience points (XP), certificates earned and similar educational activity, so we can track your progress and issue certificates.
• Payment data. When you subscribe, your payment is processed by our payment providers (Stripe for card payments, NowPayments for crypto payments). We do not store full card numbers or wallet private keys on our servers; we receive a limited billing record (for example, plan, amount, currency, status and a provider reference) needed for accounting and support.
• Technical & usage data. Standard technical information such as IP address, device and browser type, and — only where you consent — product-analytics events describing how you use the Service.
• Communications. Messages you send us (for example, support requests) and the emails we send you.

We use your personal data to:

• create and manage your account and authenticate your sign-in;
• provide the Service — deliver courses, track progress, run quizzes and exams, award XP and issue certificates;
• process subscriptions, payments, renewals, refunds and related accounting;
• send service communications (for example, security, billing and account notices) and, where you have opted in, product updates;
• provide customer support and respond to your requests;
• secure the Service, prevent fraud and abuse, and enforce our Terms;
• understand and improve how the Service is used, using consent-gated analytics; and
• comply with our legal, tax and regulatory obligations.

We do not sell your personal data.

Where the GDPR or a comparable law applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service and manage your account and subscription.
• Legitimate interests — to secure the Service, prevent fraud, and maintain and improve our platform, balanced against your rights.
• Consent — for optional analytics and any marketing communications. You can withdraw consent at any time, without affecting processing carried out before withdrawal.
• Legal obligation — to keep billing and tax records and to respond to lawful requests.

To operate the Service we rely on a limited set of trusted service providers (“subprocessors”). Most process personal data only on our instructions and under their own terms and privacy policy, which we encourage you to review; a few are infrastructure or data-source providers (for example, our content-delivery network and our public market-price source) that either handle data solely to route and secure traffic or receive no personal data at all. The subprocessors we currently use are:

• Supabase — authentication, database and file storage.
• Stripe — card payment processing and billing.
• NowPayments — crypto payment processing and billing.
• Resend — transactional and account email delivery.
• PostHog — product analytics, consent-gated in the browser (see Section 7).
• ElevenLabs — server-side text-to-speech used to generate lesson audio.
• CoinGecko — public market-price data used by our free calculators.
• Vercel — application hosting, edge delivery and scheduled jobs.
• Cloudflare — content delivery, DNS and network security.
• Google and X (formerly Twitter) — optional single sign-on (SSO) providers, used only if you choose to sign in with them.

We keep this list up to date. Where required, we put appropriate data-processing agreements and transfer safeguards in place with each provider.

We use PostHog for product analytics — to understand which features are used and how the Service performs. Browser-based product analytics is consent-gated: PostHog runs in your browser only after you opt in through our cookie banner, and it does not run if you decline or have not yet chosen. Separately, a limited set of server-side transactional events (for example, a completed subscription purchase) are recorded to operate and secure the Service regardless of your analytics cookie setting; these are keyed to your account identifier and are not used for marketing.

Essential cookies needed to run the Service (for example, to keep you signed in and remember your consent choice) are always active. All other categories — including analytics — load only with your consent. You can review the categories and change your choice at any time from our Cookie Policy.

We keep personal data only for as long as we need it for the purposes described in this Policy:

• Account, profile and learning data — for as long as your account is active.
• Deleted accounts — see Section 10. After the grace period we remove your account and its data from our active systems. We retain a limited archived record — such as your contact identifiers and a summary of your account — where necessary for legal, fraud-prevention or support-recovery purposes. That archived record is kept for 24 months from the date your account is deleted and is then erased automatically; separately, we keep certain records for the periods required by law.
• Data export files — when you request a copy of your data (see Section 10) we prepare a file and store it in private, encrypted storage. The download link expires after 24 hours, and the file itself is automatically deleted 30 days after you requested it.
• Billing and tax records — retained for the period required by applicable tax and accounting law (typically a minimum of five (5) years).
• Support communications — retained for a reasonable period to handle follow-up requests and disputes.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Deletion (“right to be forgotten”) — ask us to delete your data, subject to legal retention obligations.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection & restriction — object to, or ask us to restrict, certain processing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

You can exercise the access, rectification, deletion and portability rights directly from your dashboard (see Section 10), or by contacting us at support@learntrading.com. We aim to respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

The Service is operated globally and some of our subprocessors (see Section 6) process data in countries outside your own. Where personal data is transferred internationally, we rely on appropriate safeguards — such as adequacy decisions or standard contractual clauses — to ensure your data remains protected to the standard required by applicable law.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include encryption in transit, hashed passwords, access controls and reliance on providers that meet industry-standard security practices.

No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security, and you are responsible for keeping your login credentials confidential.

The Service is intended for individuals who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, please contact us at support@learntrading.com and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time — for example, to reflect changes in our features, our subprocessors or the law. The “Last updated” date at the top of this page will always reflect the current version. Where changes are material, we will provide additional notice (for example, by email or an in-app banner) before they take effect.

For any question about this Policy, to exercise your rights, or for general support, contact us at support@learntrading.com.

Data controller: SWISSBULL GROUP - FZCO, IFZA Business Park, DDP, 49936-01, Dubai, United Arab Emirates.