Privacy Policy

When you submit a Learn Sujok lead form on Facebook or Instagram, we collect only the details you choose to share in that form: your name and WhatsApp number.

Website course and workshop registration forms collect your first and last name, calling code and mobile number, WhatsApp preference and number, area / city / country, and email if provided. Email is required if you do not use WhatsApp. Your introduction is optional; please do not include medical or other sensitive details.

The current Sujok training workshop enquiry form also records your selected course interest, gender and age in whole years. Earlier enquiries may retain the purpose of learning selected at that time. We do not ask for symptoms or medical history.

The Sujok course enquiry page records bounded campaign labels from the link you used (source, medium, campaign and content), when provided. It does not record the full link or create a personal advertising profile. After submitting, you can optionally open WhatsApp with a short message about your enquiry. The message is not sent until you choose to send it in WhatsApp.

We do not ask for payment information, medical records, health history, or sensitive personal information through these lead forms.

We use your name and WhatsApp number to contact you about Learn Sujok courses, batch dates, curriculum questions, enrolment steps, and related course support.

We may contact you through WhatsApp, phone, or another direct method connected with your enquiry.

For course and workshop registrations, we use your details to manage your registration, send joining information and communicate schedule changes. Registration consent is not consent to unrelated marketing.

We use your selected course interest, gender and age to respond to your enquiry, not to infer medical history or send these answers to Meta. Submitting the form alone does not share contacts with advertising platforms. Only fresh, separate enhanced Meta permission and enabled reporting can authorize the listed hashed contact and device data for advertising measurement and delivery optimization.

If you choose “to be announced”, we use your details to contact you about the selected course or workshop when dates are available. This does not reserve a place or enrol you automatically. You can ask us to close your interest or stop contacting you at any time.

Lead details may be stored in Meta's lead tools, WhatsApp conversations, spreadsheets, or enquiry-management tools used by Learn Sujok.

Access to business enquiries is limited to authorised course-support staff. Separately consented matching data is processed by the restricted measurement service and, only when reporting is enabled, Meta for the advertising purposes described below. We take reasonable care to protect these records from unauthorised access.

Website course and workshop registrations are stored in our private database and backups. We also keep a separate enquiry record in our private staff CRM for registration-related follow-up. Access to participant details, introductions and CSV exports is restricted to authorised staff. Participant lists and joining links are not published on the website.

We retain course and workshop registrations unless you request deletion. Hiding or cancelling a scheduled session does not delete your submission or change the session you selected. Deleting a registration alone does not remove its separate CRM enquiry; staff handle requests to delete your information across both records.

These forms use first-party security tokens and temporary, salted network-address digests to limit abuse. Our server also maintains access logs. No third-party CAPTCHA service is used.

We do not sell, rent, or trade lead form information.

We may share limited information with enquiry/registration service providers or when required by law. With fresh optional enhanced Meta permission and separately enabled reporting, the listed hashed contacts and device identifiers may also be shared with Meta for advertising measurement and delivery optimization under its policies. Hashing does not make them anonymous.

Workshop-page videos load from YouTube only when you choose to play them. Playing a video connects your browser to YouTube, which handles that visit under its own privacy policy. Opening a WhatsApp enquiry similarly takes you to WhatsApp; it does not send a message until you choose to send it.

On the two Sujok enquiry pages, analytics, private campaign attribution and Google conversion feedback start by default only when a fresh server-side location policy identifies an eligible India visit and no previous refusal applies. Meta never uses these India defaults and always requires your fresh explicit choice. For other, unreviewed or unknown locations, optional tracking stays off until you choose. IP-country detection is approximate and can be affected by VPNs or proxies. The server uses a local DB-IP Country Lite database, not an external IP lookup service. DB-IP provides this database under Creative Commons Attribution 4.0 (CC BY 4.0).

Enhanced Meta advertising measurement and delivery optimization need a fresh server-confirmed choice in the same privacy dialog. Old browser and mock-only permissions never authorize it. If reporting is separately enabled, a genuinely new saved educational-course enquiry can produce a Lead event with its original time, random event ID, action source website and truthful course-page address. This site contains health-related education; neither consent nor dataset category None establishes tracking clearance.

The matching fields are first and last names, main phone and optional email normalized then SHA256-hashed, plus a genuine consented ad-click identifier, original visitor IP address and browser user agent. Manually created Meta browser identifiers (fbp) are disabled and are not currently collected or shared. Meta uses these to match people, measure advertising and optimize delivery under its policies. Hashing is not anonymity. Optional email remains optional. No answers, age/date of birth, gender, location text, health information, secondary WhatsApp contacts, payment details/references, raw URLs/queries/referrers, Google identifiers or external customer IDs are sent. Known under-13 enquiries are excluded.

Enhanced v2 permission has its own HttpOnly cookie and expires after 180 days. A separate necessary first-party privacy-family cookie joins concurrent tabs without using IP or advertising identity; it is never sent to Meta. Secure cookie read-back, Web Locks and BroadcastChannel coordination are required for positive Meta permission and collection; unsupported or blocked storage features do not break enquiries. A missing family/cookie/recovery history means earlier-context withdrawal cannot be confirmed; contact privacy support. Historical enhanced v1 scopes are retired, their matching snapshots cleared, and never upgraded. A separate browser purpose record and bounded pending-action receipt support reconciliation and withdrawal; old receipts are not reinterpreted. A durable negative intent blocks an uncommitted original grant. Server consent/recovery actions have a 210-day purge policy; browser records are cleared on use or withdrawal where storage permits; expired old acceptance bodies cannot renew permission. Consented browser/ad identifiers have separate 90-day creation/expiry metadata, belong to the permission epoch and are cleared on withdrawal. A new current permitted click can refresh fbc without resetting fbp. Up to 32 salted click-fingerprint timestamps prevent re-minting expired/replayed clicks within the permission lifetime (at most 180 days); these linkable anti-extension markers are not sent to Meta, are not anonymous and are cleared with the matching record on withdrawal/expiry. They are generated/read only after confirmed enhanced permission and enabled capture gates; no Meta SDK is used.

Matching snapshots are restricted to the server measurement service, valid for at most 24 hours and cleared on terminal processing or withdrawal. A scheduled purge removes expired matching snapshots on its next run. Cleanup follows the job schedule rather than occurring at an exact instant; outages can delay physical deletion, but snapshots older than 24 hours cannot be sent. Non-matching deduplication/attempt records have a 180-day purge policy; server consent/recovery records have a 210-day policy. Browser identifier validity is 90 days, with best-effort deletion on use or withdrawal, not a promise to erase storage on an inactive device. Scheduled purge enforces these retention limits. Restricted-access Meta-specific backups contain permission and delivery metadata, exclude matching snapshots, and rotate after 30 days. Business enquiry records and their existing backups are managed separately. Diagnostics never include contacts, payloads, tokens or identifiers. Withdrawal stops future collection and queued processing after server confirmation but cannot recall work already authorized or handed off for sending or promise deletion by Meta. Re-consent never revives old enquiries. Permission alone does not enable reporting; reporting requires separate activation.

Meta enhanced permission is separate from analytics and Google in the same dialog. India defaults and old permissions never grant it. The privacy dialog shows whether reporting is enabled; you can enquire without accepting. A browser without saved privacy choices may receive one nonblocking invitation to review this same dialog. Dismissal never grants permission; a local notice-history marker prevents repeat invitations. Existing saved choices and refusals are not automatically re-prompted.

The Privacy choices popup offers Accept all, Reject optional and Customize. Closing it or pressing Escape does not accept tracking. The footer Privacy settings link lets you reopen it at any time. Choices do not affect the enquiry form. Positive explicit permissions are valid for up to 180 days. We store versioned, timestamped preferences in your browser; expired refusals remain off rather than becoming a new grant. If browser storage is unavailable, automatic tracking stays off and a direct choice applies only to the current page session.

With analytics enabled, our self-hosted Umami service at stats.learnsujok.com receives only the homepage and two enquiry-page paths, generic page titles and page views. Form-start and confirmed-save events, and the selected course label when a choice is saved, are limited to the enquiry pages. Homepage visits or contact links are not saved enquiries. Umami does not receive form answers, names, contact details, gender, age, introductions, medical information, enquiry references, security tokens, URL query strings, fragments or referral URLs. Analytics requests still involve network-address and browser processing; this is not a claim of anonymity or zero personal-data processing.

With private campaign attribution enabled, bounded campaign labels and a permitted Google advertising click identifier, when present, are kept separately from analytics and linked to your saved enquiry. Capture starts only on the homepage or enquiry pages after the current regional policy or your choice permits it. A valid browser snapshot can be retained while navigating the site's Wiki, course, lecturer, gallery, review, contact, workshops and privacy pages; these navigation pages do not collect new advertising identifiers or send analytics page views. The snapshot is used only while valid, for up to 90 days, and is cleared on rejection or withdrawal. Advertising identifiers are not copied into navigation links or sent to Umami. The contact form and its receipt do not depend on this optional record.

Google reporting is enabled. Delivery and attribution are checked separately. Meta enhanced matching is a separate optional purpose. The privacy dialog shows the current reporting status; only fresh confirmed permission and enabled reporting allow the sharing described above. Approved Google reporting uses permitted advertising identifiers and approved outcomes, not email or phone matching. This is separate from payment verification or course enrolment.

When Google conversion feedback is enabled under the current regional policy or your explicit choice, permitted advertising click identifiers, an opaque internal transaction identifier, event time and approved course-enquiry or enrolment outcomes may be sent to Google. Verified paid outcomes may include amount and currency. Names, email, phone, medical details, enquiry/security references, bank/payment references and free-text notes are not sent. A regional default is recorded as a default, not as explicit user consent. No contact matching or advertising-personalisation permission is given.

Google feedback applies prospectively: a later permission or location decision does not authorise an earlier outcome. A purpose-only HttpOnly cookie allows withdrawal after the shorter enquiry-resume cookie expires. Browser withdrawal updates the enquiry linked to the current cookie. For older enquiries or missing cookies, use the privacy-contact details below. Withdrawal stops future queued imports once the server update is confirmed; a temporary network failure may delay that update until settings are retried. It cannot cancel an already in-flight request or promise deletion of information already received by Google.

Rejection or withdrawal stops future optional browser measurement and clears the browser attribution snapshot. It also requests that optional processing stop for the enquiry linked to the current cookie. A temporary network failure may delay the server update. Withdrawal does not erase requests already sent. Contact information remains in the existing private enquiry system and is not sent to the analytics collector.

IP Geolocation by DB-IP: https://db-ip.com
Database licence: https://creativecommons.org/licenses/by/4.0/

You can ask us to stop contacting you, correct your details, or delete your lead information.

To make a request, message us on WhatsApp or email us using the contact details below.

You may also request correction, cancellation or deletion of a course or workshop registration. Backup copies expire through our backup rotation rather than being edited individually.