Start learning
My learning

Legal

Privacy Policy

Last updated 23 October 2026 · Version 2026-10-23-draft-1

Draft. This page is being finalised before launch.

This policy explains what personal data Coding Liquids collects, why, who receives it, how long we keep it and your rights. It applies to every user of codingliquids.com, wherever they live.

Who we are

M/S Coding Liquids, a sole proprietorship of Sagnik Bhattacharya, 13/3 Nabapally Main Road, Kolkata 700104, India, runs codingliquids.com and decides how your personal data is used (it is the “controller”). Our privacy contact, who is also our grievance officer for India, is Sagnik Bhattacharya: hello@codingliquids.com.

Adults only

Our courses are for people aged 18 or over. If a profile shows a birth year under 18, we restrict the account and hide its optional profile at once; if the account does belong to someone under 18, we delete those details and may close the account. Tell us if you think a child has given us personal data, and we will delete it.

What we collect and why

The reason for each use (its “legal basis” under EU and UK law) is in brackets: contract (providing what you asked for), legitimate interests (running a secure, working business, balanced against your rights), consent, or legal obligation.

  • Account: your email address and name, and your Google account identifier if you sign in with Google (contract).
  • Purchases: the course, price, currency, tax, country, date, order reference and any refund, as reported by our payment partners. We never receive card or bank details and keep no billing addresses (contract; legal obligation to keep tax records).
  • Learning: lesson progress, playback position and certificates (code, course, date and the name you chose for them) and, for team seats, your team membership (contract).
  • Questions and support: questions you ask under lessons, replies from the instructor or teaching assistants, AI assistant answers, and messages you send by email or through the contact form (contract; legitimate interests).
  • Optional profile: display name, year of birth or age, phone number, city, country, occupation, learning goals and LinkedIn link, only if you add them; you can edit or delete them at any time (consent).
  • Agreements: the version and time of your acceptance of our Terms of Use, and your checkout and marketing choices, stored with a scrambled (hashed) form of your IP address (legal obligation; legitimate interests in showing what was agreed).
  • Security: sign-in and session records, device and browser type, IP address (in full for at most 30 days, then only hashed, with the country), video-link requests and automated bot checks. Your email address is shown faintly over lessons to discourage recording (legitimate interests in protecting accounts and courses).
  • Analytics and attribution: pages visited and how you arrived, such as the blog post that led to a purchase. In the EU, the EEA, the UK and Switzerland, Google Analytics sets cookies only if you accept them, and otherwise sends Google only basic signals without cookies or identifiers; elsewhere it runs by default and you can switch it off. Cloudflare Web Analytics uses no cookies. See our Cookie Policy (consent where required, otherwise legitimate interests).
  • Marketing emails: only if you tick the box at checkout or confirm a sign-up; every email has an unsubscribe link (consent).

If a team bought your seat, the team administrator can see your name, email address, progress and certificates for that course. Anyone with a certificate’s code or link can see the course, the date and the name shown on it.

The AI assistant

When you use Ask AI, or when an AI answer is prepared for a question still awaiting a reply, the text of your question and conversation, with the course material, is sent to Anthropic, PBC (United States), which generates the answer as our service provider. We add no name or email address, and no audio is ever sent. AI answers are labelled, are for information only and may be corrected by the instructor. We make no automated decisions about you that have legal or similarly significant effects.

Payments

Where the checkout names our payment partner, [PAYMENT PARTNER], that purchase is sold to you by it as merchant of record; it handles your payment details as an independent controller under its own privacy policy. Every other purchase is paid through Razorpay Software Private Limited (India), which collects the payment for us under its own privacy policy.

Who else receives personal data

Each provider receives only what its job needs:

  • Cloudflare, Inc. (United States, worldwide network): hosting, database and file storage, security checks and Cloudflare Web Analytics.
  • BunnyWay d.o.o. (bunny.net, Slovenia): video storage and streaming.
  • Resend (United States): delivery of sign-in links, receipts, certificates and support notifications.
  • Google LLC and Google Ireland Limited: sign-in with Google, Google Analytics, our mailboxes and encrypted backups.
  • Anthropic, PBC (United States): AI assistant answers.
  • Our payment partners, as above; Payoneer receives our payouts but no student data.
  • Teaching assistants who answer questions under our instructions.
  • Authorities, courts and professional advisers where the law requires it, and a successor if the business is transferred.

We do not sell personal data or share it for targeted advertising, and we use no advertising cookies.

International transfers

We are based in India, and our providers work in the United States, the EU, the UK and elsewhere. Where the law requires safeguards, we rely on the European Commission’s standard contractual clauses (with the UK addendum) and on providers’ EU-US Data Privacy Framework certifications. India has no adequacy decision from the EU or the UK; data you give us is protected by this policy and by the laws that apply to us.

How long we keep it

  • Account, profile, progress and questions: while your account exists; after you delete it, a 30-day grace period, then deletion or anonymisation.
  • Order records: 8 years, for tax and accounting, pseudonymised once the account is deleted.
  • Certificates after account deletion: only the code, course, date and status (valid or revoked), without your name, so that a certificate you shared can still be checked.
  • Emails and contact-form messages: as long as needed to answer them and deal with any follow-up.
  • Consent records: as long as the order or subscription they relate to.
  • Security and audit logs: 12 months; full IP addresses: 30 days.
  • Raw payment notifications: 7 days.
  • Email delivery logs: 90 days.
  • Unsubscribe list: kept so that we never send you marketing again.
  • Backups: overwritten within 90 days.

Your rights

Depending on where you live, you can ask for a copy of your data, its correction or deletion, restriction of its use and a portable copy; object to uses based on legitimate interests, including analytics; and withdraw consent at any time. Your account page lets you download your data and delete your account yourself (deletion takes effect after 30 days, during which you can change your mind), or you can email us. We reply within one month and may confirm your identity by a sign-in link sent to your account email.

  • EU, EEA, UK and Switzerland: you can complain to your data protection authority; in the UK that is the Information Commissioner’s Office.
  • India: from 13 May 2027, the Digital Personal Data Protection Act, 2023 gives you the rights to a summary of your data and how it is used, to correction, completion, updating and erasure, to grievance redressal and to nominate someone to act for you. After using our grievance process, you can complain to the Data Protection Board of India.
  • United States: residents of states with privacy laws, including California, can use the rights those laws give. We honour the Global Privacy Control signal where the law requires it, as an objection to analytics. We do not respond to “Do Not Track” signals, for which no common standard exists.

Security

Sign-in is passwordless; sign-in and session tokens are stored only in hashed form; all traffic is encrypted; only our own server code can reach the database; and the administration area has two separate locks. No system is perfectly secure. If a breach puts your data at risk, we notify the authorities within the time the law sets (72 hours in the EU and the UK, and in India from 2027; as soon as feasible in Canada) and tell you without undue delay where required.

Changes

We update this policy when our practices change; the date at the top shows the latest version, and we email account holders about significant changes. Any translation is for convenience, and the English text governs.

Contact

Email hello@codingliquids.com or write to M/S Coding Liquids, 13/3 Nabapally Main Road, Kolkata 700104, India.