For the purposes of the GDPR, UK GDPR, CCPA/CPRA, and all other applicable data protection laws, the data controller is:

Legal entity

iBrothers Group LLC, an Indiana limited liability company operating the iGurus learning platform.

Principal address

Greenwood, Indiana, USA

DPO / Privacy contact

dpo@igurus.org

Governing law

State of Indiana, USA. EU/UK users retain all rights conferred by GDPR and UK GDPR regardless of this choice of law.

We collect only what is needed to run the platform, verify instructors, process payments, and keep the platform secure.

Account information

Name, email, phone, password (stored hashed), country, and language preference.

Profile information

Photo, bio, gender (optional), age (optional), job title, skills, experience, education, certifications, and social links.

Instructor credentials

Professional certifications, payout account details, and qualification documents. These are encrypted and used only for verification and payment processing.

Transaction data

Course purchases, subscription history, payment amounts, coupon usage, and refund records.

Learning data

Course progress, quiz results, certificates earned, lesson completion status, and Q&A activity.

Communications

Platform messages, support tickets, lesson Q&A, live class metadata, and instructor announcements.

Technical data

IP address, browser type, device information, pages visited, referral source, and session timestamps.

Cookies

Session tokens and analytics identifiers. See Section 05 for the full list and purposes.

Every use of your data maps to one of the operational, legal, or product purposes below.

Operate the marketplace

Course delivery, instructor payouts, student enrollment, progress tracking, and dispute resolution.

Verify instructor credentials

Identity and qualification checks for instructors applying to teach on the platform.

Process payments & payouts

Via Stripe, Razorpay, PayPal, Flutterwave, Paystack, and other integrated gateways.

Detect fraud & abuse

Across all platform activity including enrollment, payments, and content uploads.

Communicate

Course updates, security alerts, platform announcements, and instructor notifications.

Marketing

Only with your explicit consent. You can unsubscribe from every email at any time using the link in the footer.

Aggregate analytics

To improve course recommendations, platform performance, and user experience. This data is always de-identified before analysis.

Personalized learning

Course recommendations, learning streak tracking, and progress insights based on your enrolled courses and activity.

Where data protection law requires a legal basis for processing, we rely on the following:

Performance of a contract

To provide the marketplace, process transactions, deliver courses, and issue certificates you have purchased or earned.

Legitimate interests

To secure the platform, prevent fraud and abuse, and improve the product through de-identified analytics. We balance these interests against your rights.

Legal obligation

To meet tax, accounting, identity-verification, and other regulatory requirements applicable to our business.

Consent

For marketing communications and for non-essential cookies. You can withdraw consent at any time without affecting prior lawful processing.

We share data only with vetted service providers, with other users as you direct, and where the law requires it.

Payment processors

Stripe, Razorpay, PayPal, Flutterwave, Paystack, and Mollie. Each is contractually bound to protect your data and prohibited from using it for their own marketing purposes.

Live class providers

Zoom and Jitsi for video-based live instruction. Only session metadata is shared; recording requires your explicit consent.

Authentication providers

Google and Facebook for social login. Data is used only for account authentication.

Cloud infrastructure

Our hosting provider stores all platform data under strict data processing agreements with security and confidentiality obligations.

Other users (limited)

Your public instructor or student profile is visible to other registered users per your privacy settings. Verified reviews are public.

Legal authorities

Only when required by subpoena, court order, or to prevent imminent harm to a person or the platform.

Successor entity

In the event of a merger, acquisition, or asset sale, your data may transfer to the new entity. You will receive at least 30 days notice before that happens.

We use cookies to make the platform work and to understand how you use it.

Strictly necessary

Keep you logged in and make core features function — these cannot be switched off.

Functional

Remember your preferences such as language and currency.

Analytics

Help us understand usage patterns using de-identified data.

Marketing

Only set with your consent and can be changed at any time from the cookie preferences panel.

For the full cookie table — names, providers, durations, and purposes — see our Cookie Policy. You can update your preferences at any time using the cookie panel at the bottom of any page.

We keep data only as long as needed for the purpose we collected it — or as the law requires.

Account & profile data

The active period plus 7 years post-account-closure for legal, tax, and dispute resolution purposes.

Payment & transaction records

7 years, in compliance with applicable tax and financial regulations.

Instructor verification documents

2 years after revocation or expiry, then permanently and securely deleted.

Course & learning data

Retained for the lifetime of your account to support certificate validity and progress records. Deleted on account closure.

Marketing preferences

Retained until you unsubscribe or request deletion.

System & security logs

12 months, unless longer retention is required for an active security investigation.

You have full rights over your data — including access, correction, deletion, and portability.

United Kingdom

Information Commissioner's Office (ICO)
Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113

European Union

Contact the data protection authority in your EU member state. A full list is maintained by the European Data Protection Board: edpb.europa.eu/members

United States

California residents may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov. Other US residents may contact the Federal Trade Commission (FTC) at reportfraud.ftc.gov.

All data transmitted to and from iGurus is encrypted in transit using TLS. Data at rest is protected by our hosting provider's encryption controls. We apply access controls, rate limiting, and input validation throughout the application. We review our security practices periodically and will notify affected users promptly in the event of a confirmed data breach.

iGurus operates globally and serves students and instructors in multiple countries. If you access the service from outside the United States, your data may be transferred to and stored on servers in the US or other jurisdictions where our infrastructure partners operate. All such international transfers are protected by Standard Contractual Clauses or equivalent legal safeguards recognized under applicable data protection law, including GDPR and UK GDPR.

iGurus is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If you are a parent or guardian and believe your child has created an account on our platform, please email dpo@igurus.org immediately. We will verify the claim and delete the account and associated data without delay.

Instructors who create courses, communicate with students, or conduct live classes are responsible for any personal data they collect directly from students outside the iGurus platform. iGurus is not responsible for the data practices of individual instructors operating beyond the platform's built-in tools. Students should review an instructor's own privacy practices before sharing personal information through external channels such as email, social media, or third-party tools.

We will notify you of any material changes to this Privacy Policy via email and through a prominent in-platform notice at least 30 days before the changes take effect. Minor updates — such as clarifications or corrections that do not affect your rights — may be made without advance notice. Continued use of the platform after the effective date of any update constitutes your acceptance of the revised policy. All previous versions are available on request.