1. Introduction

Zestra Capital ("we," "us," or "our") operates the website zestracapital.com and provides online trading education courses and economic data subscription services. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services.

By accessing or using our services, you consent to the collection and use of your information as described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, city, country, and address when you register or update your profile.
• Payment Information: Payment method details, billing address, and transaction history when you subscribe or purchase courses. We do not store credit card numbers directly.
• Course Data: Lesson progress, quiz answers, notes, and enrollment records.
• Communications: Messages, support tickets, and correspondence you send to us.
• Form Submissions: Information submitted through enrollment forms, contact forms, or payment support forms.

2.2 Information Collected Automatically

• Device & Browser Data: IP address, browser type, operating system, screen resolution, and device identifiers.
• Usage Data: Pages visited, time spent, click patterns, search queries, and referral sources.
• Cookies & Tracking: Cookies, local storage, and similar technologies (see our Cookie Policy).
• Security Data: Login timestamps, session tokens, rate-limiting records, and fingerprint hashes for fraud prevention.

3. How We Use Your Information

We use the collected information for the following purposes:

• Providing, maintaining, and improving our services, including course delivery and data subscriptions.
• Processing payments, managing subscriptions, and handling enrollment requests.
• Communicating with you about your account, services, updates, and support.
• Tracking course progress, quiz results, and learning analytics.
• Preventing fraud, unauthorized access, and abuse of our platform.
• Enforcing our Terms of Service and other policies.
• Analyzing usage patterns to improve user experience and platform performance.
• Sending service-related notifications and, with your consent, promotional communications.
• Complying with legal obligations and responding to lawful requests.

4. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party providers who assist in operating our platform (hosting, email delivery, analytics, payment processing). These providers are bound by confidentiality agreements.
• Legal Requirements: When required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of the transaction.
• With Your Consent: When you explicitly authorize us to share specific information.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• SSL/TLS encryption for all data transmitted between your browser and our servers.
• Content Security Policy (CSP) headers to prevent cross-site scripting and injection attacks.
• Rate limiting and brute-force protection on authentication endpoints.
• Secure session management with token-based authentication.
• Regular security audits and monitoring.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods include:

• Account Data: Retained until account deletion is requested.
• Transaction Records: Retained for 7 years for tax and legal compliance.
• Session Logs: Automatically purged after 30 days.
• Rate-Limiting Records: Purged after 7 days.
• Error Logs: Retained for 90 days for debugging purposes.

Upon account deletion, your personal data will be removed from active systems. Some data may persist in backups for a limited period as part of our standard backup procedures.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate information via your account settings.
• Deletion: Request deletion of your account and associated data.
• Restriction: Request that we limit how we process your data.
• Objection: Object to processing of your data for specific purposes.

To exercise any of these rights, contact us at info@zestracapital.com. We will respond within 30 days.

8. Third-Party Services

Our platform may integrate with or link to third-party services, including Google (reCAPTCHA, Sign-In), YouTube (video hosting), and analytics providers. These services have their own privacy policies, and we are not responsible for their practices. We encourage you to review their policies.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

10. International Data Transfers

Your information may be processed and stored on servers located outside your country of residence. By using our services, you consent to the transfer of your data to Pakistan and any other jurisdictions where our service providers operate.

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Changes are effective immediately upon posting. Your continued use of our services constitutes acceptance of the updated policy. We recommend reviewing this page periodically.