Privacy Policy.

Information you provide

• Enrollment data: Name, email, WhatsApp number, payment proof (when you apply for mentorship)
• Account data: Login credentials, profile picture, bio (for student accounts)
• Submitted work: Video URLs, assignments, feedback you submit
• Contact messages: Information you send via the contact form

Information collected automatically

• IP address (for rate limiting and security)
• Browser type and version
• Pages visited and referrer URLs
• Cookies essential for authentication and CSRF protection

• Process your enrollment and provide mentorship services
• Authenticate you and secure your account
• Respond to inquiries and provide support
• Improve our website and services
• Prevent fraud and abuse (rate limiting, audit logs)
• Comply with legal obligations

Your password is hashed with industry-standard Bcrypt before storage. We never store passwords in plain text. Even our staff cannot read your password. We strongly recommend using a strong, unique password and changing it periodically. Never share your password with anyone, including ZH Motions support — we will never ask for it.

To prevent piracy of premium courses, recorded class videos, project files, and exclusive content, we may collect identity information including National ID (NID), phone number, and email. Premium course videos are delivered via personalized magic links containing your name, email, and IP address as a visible watermark. Sharing your link, recording videos for redistribution, or attempting to bypass access controls violates this policy and our Terms — links auto-revoke on multi-device abuse and accounts may be terminated without refund.

We do not sell your personal data. We share data only with:

• Service providers (hosting, payment processing) under strict confidentiality
• Legal authorities when required by law

We implement industry-standard security measures including:

• HTTPS encryption for all traffic
• Bcrypt password hashing
• CSRF token protection
• Rate limiting against brute-force attacks
• Session security (HttpOnly, Secure, SameSite cookies)
• Regular security audits

You have the right to:

• Access your personal data we hold
• Correct inaccurate information
• Delete your account and associated data
• Export your data in a portable format
• Withdraw consent at any time

To exercise these rights, contact us at [email protected].

We use essential cookies required for authentication, session management, and CSRF protection. We also use Google AdSense which may set advertising cookies — you can manage these via our cookie consent banner or your browser settings. We do not sell cookie data.

• Active accounts: retained as long as you maintain your account
• Enrollment records: retained for 7 years for tax/legal compliance
• Contact messages: retained for 2 years
• Logs and audit trails: retained for 1 year

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13.

We may update this policy from time to time. The "Last updated" date will reflect the latest revision. Continued use of our services after changes constitutes acceptance.

For privacy questions or concerns, reach out at:

• Email: [email protected]
• WhatsApp: +880 1811 199 175
• Contact form: zhmotions.com/contact