Privacy Policy

Effective July 2026 · Last updated July 2026

1. About this policy

This Privacy Policy explains how The Markets Story ("we", "us", "our") collects, uses, stores, and shares personal information when you use our website at themarketsstory.com and our video lessons and course services (collectively, the "Service").

The Markets Story is operated from India. We process personal data of customers in India in accordance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). For customers in the European Economic Area, United Kingdom, or California, we extend equivalent rights as a matter of policy, even where not strictly required.

By using the Service, you agree to the practices described in this policy.

2. What we collect

2.1 Account information

When you create an account, we collect:

• Email address — used as your login identifier and to send transactional emails (sign-in links, receipts, security notices, etc.)
• Name — optional; used to personalize emails and your account page
• Time zone — optional; used to display dates and times correctly
• Lesson progress — which lessons you have watched, so we can save your place and show your progress

We use passwordless sign-in: instead of a password, we email you a one-time link that signs you in. Because of this, we do not store a password for your account at all.

2.2 Payment information

We do not collect or store your full credit/debit card details, bank account numbers, or UPI IDs. Payments are handled by our payment processors (PayPal for USD purchases, PayU for INR purchases), and the card/bank details you enter go directly to them.

We do receive and store the following payment-related information from the processor:

• A transaction reference number (e.g. PayPal sale ID or PayU mihpayid)
• The amount, currency, and date of each payment
• Status notifications (payment succeeded, failed, refunded, etc.)

2.3 Technical information

When you use the Service, we automatically collect:

• IP address and approximate location (for security and fraud prevention only)
• Browser type and version, operating system, device type
• Login session timestamps and the IP address used to sign in

2.4 Communications

If you email us at hello@themarketsstory.com, we retain the email content and your email address to respond and to maintain a support record.

3. How we use it

We use the personal data we collect to:

• Provide the Service — sign you in via one-time email links, deliver and stream your video lessons, save your progress, and process any course purchase
• Operate and improve the Service — diagnose technical issues, prevent abuse and fraud, ensure security
• Send transactional emails — sign-in links, receipts, payment notices, and security notices
• Send newsletter emails — only where you have opted in; you can unsubscribe at any time
• Comply with legal obligations — respond to lawful requests by authorities, and retain records as required by Indian law (income tax records for at least eight years)

We do not sell your personal data to anyone, ever. Sign-in links, receipts, and security notices are essential to the Service and cannot be unsubscribed; newsletter and marketing emails are separate and can be unsubscribed at any time.

4. Who we share data with

We share personal data only with the following categories of recipients, and only as necessary to operate the Service:

4.1 Payment processors

• PayPal Holdings, Inc. (United States) — processes USD payments. PayPal's privacy policy: paypal.com/privacy
• PayU Payments Private Limited (India) — processes INR payments. PayU's privacy policy: payu.in/privacy-policy

4.2 Infrastructure providers

• Bluehost / Newfold Digital (United States) — hosts our website and database, and operates the email server we use to send transactional emails. Bluehost's privacy policy: bluehost.com/privacy
• BunnyWay d.o.o. (Bunny.net) (Slovenia, EU) — hosts and streams our video lessons through its global content delivery network. Bunny.net's privacy policy: bunny.net/privacy

4.3 Legal and safety

We may disclose personal data if we are legally required to do so (e.g., in response to a court order, subpoena, or other lawful request from a competent authority in India), or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not share data with advertising networks, data brokers, social media platforms, or any other third party not listed above.

5. International data transfers

Some of our processors store and process data outside India:

• PayPal is based in the United States; data shared with it may be stored in the U.S. or other jurisdictions where it operates.
• Bluehost servers may be located in the U.S.
• Bunny.net is based in the European Union and delivers video through edge servers located around the world.

Where personal data of Indian residents is transferred outside India, we rely on the contractual safeguards offered by these processors and the relevant exceptions under Section 16 of the DPDP Act. For EEA/UK customers, our processors implement standard contractual clauses or equivalent safeguards for cross-border transfers.

6. How long we keep data

We retain personal data only as long as necessary to provide the Service and to meet our legal obligations:

• Account data — for as long as your account exists. If you request account deletion, we delete or anonymize personal identifiers within 30 days, subject to the retention requirements below.
• Payment records — retained for at least eight years from the end of the relevant financial year, as required by Indian income tax and accounting rules.
• Support emails — retained for up to two years after the last interaction, then deleted.
• Server access logs — typically retained for 90 days for security purposes, then automatically rotated out.

7. Your rights

Regardless of where you live, you have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to correction — ask us to fix data that is inaccurate or incomplete
• Right to erasure / deletion — ask us to delete your personal data, subject to legal retention requirements (see Section 6)
• Right to data portability — receive a copy of your data in a machine-readable format
• Right to withdraw consent — where we rely on your consent to process data, you may withdraw it at any time
• Right to lodge a complaint — with the Data Protection Board of India under the DPDP Act, or with your local supervisory authority (e.g., the Information Commissioner's Office in the UK, or your national data protection authority in the EEA)

To exercise any of these rights, email hello@themarketsstory.com from the email address on your account. We respond within 30 days.

8. Cookies and tracking

We use a small number of cookies, all strictly necessary for the Service to function:

• A session cookie to keep you signed in while using the site
• A CSRF protection token to prevent cross-site request forgery on form submissions
• A currency-preference cookie so prices display in your chosen currency

We do not currently use third-party analytics, advertising, or social media tracking cookies. If we add analytics in the future (such as Google Analytics or Plausible), we will update this policy and, where required, present a cookie consent option.

9. Children

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected personal data from a child under 18 without proper consent, we will delete it promptly. If you are a parent or guardian and believe your child has provided personal data to us, please contact us.

10. Security

We protect your personal data using:

• Encrypted (HTTPS / TLS) connections for all data transmitted between you and our servers
• Passwordless sign-in with single-use, time-limited email links — there is no stored password to steal
• CSRF tokens on all state-changing forms
• Rate limiting on sign-in requests to deter abuse
• Restricted access to production systems — only the business owners (Pallavi and Shriyash Palsule) have direct access

No system is completely secure. If we become aware of a personal data breach affecting your information, we will notify you and, where legally required, notify the Data Protection Board of India or other relevant authorities within the legally mandated timeframes.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes (e.g., new processors, new categories of data collected, new uses), we will notify you by email at least 30 days before the change takes effect, where reasonably possible.

Continued use of the Service after the effective date of a revised policy constitutes your acceptance of the new terms.

12. Contact

Questions, requests, or complaints about this policy or your personal data should be sent to:

The Markets Story
Email: hello@themarketsstory.com
Subject line: "Privacy" (helps us route your message quickly)

Business owners: Pallavi and Shriyash Palsule, based in Pune, Maharashtra, India.

See also: Terms of Service · Refund Policy