Privacy Policy

Welcome to Nexaura Academy (the "Platform", "Website", "we", "us", or "our"), operated by Nexaura Studios ("Entity"). We are dedicated to maintaining the trust, confidentiality, and integrity of the personal data shared by our users, customers, and creators.

This Privacy Policy explains our practices regarding the collection, use, disclosure, storage, and safeguarding of your personal data when you visit our website, register an account, authenticate via Google, purchase downloadable digital assets, enroll in courses, or contact our support team.

1. Operating Entity & Physical Address

Nexaura Academy is an online digital asset marketplace and educational portal operated under:

• Operating Entity: Nexaura Studios
• Physical Address: Adaspur, Cuttack, Odisha 754011, India
• Official Contact Email: contact@nexaurastudios.com
• Governing Jurisdiction: Cuttack, Odisha, India

2. Eligibility & Age Restriction (18+ Policy)

Nexaura Academy is strictly intended for individuals who are at least 18 years of age. We do not knowingly solicit, collect, or process personal information from children or individuals under the age of 18.

If we become aware that an individual under 18 has created an account or submitted personal data without verifiable adult authorization, we will immediately take steps to permanently delete such information from our records and terminate the associated account. If you believe a minor has registered on our platform, please inform us at contact@nexaurastudios.com.

3. Categories of Personal Data We Collect

We collect personal information necessary to deliver digital products, manage accounts, prevent piracy, and process payments. The categories of data collected include:

A. Information You Provide Directly

• Account Registration Data: When registering via email, we collect your full name, email address, and encrypted password. Passwords are cryptographically hashed using one-way bcrypt algorithms and are never stored or readable in plain text.
• Google Single Sign-On (OAuth 2.0): When you choose to register or log in using Google OAuth, we receive your verified name, Google account email address, profile avatar image URL, and unique Google account identifier. We do not access your Google password, Google Drive private files, or contacts.
• Order & Billing Records: When you purchase assets or courses, we record your name, billing email, items ordered, purchase timestamps, order ID, and transaction reference numbers.
• Customer Support Inquiries: When you submit support tickets or contact us, we collect your message content, ticket history, and any files or screenshots you upload.

B. Information Collected Automatically (Technical Telemetry)

• Device & Connection Telemetry: Internet Protocol (IP) address, browser type and version, operating system, device screen resolution, referring URLs, and access timestamps.
• Security & Anti-Piracy Logs: Download token access logs and IP verification records used to prevent unauthorized asset link leeching, credential stuffing, and digital asset piracy.

4. How We Use Your Personal Data

We process your personal information only for legitimate, transparent business purposes:

• Digital Asset Delivery: Generating secure, authenticated download tokens and ensuring lifetime access to your purchased LUTs, presets, templates, toolkits, and course materials.
• Account Authentication: Managing your login credentials, persistent login sessions, and profile customizations.
• Transaction Fulfillment & Invoicing: Generating order invoices, verifying payments with our payment processor, and maintaining financial records.
• Customer Care & Support: Addressing support tickets, troubleshooting download or software compatibility issues, and responding to inquiries.
• Security & Fraud Mitigation: Detecting and mitigating unauthorized logins, malicious activity, automated scraping, payment fraud, and digital copyright infringement.
• Legal & Statutory Compliance: Complying with mandatory accounting, tax (including GST requirements where applicable), and legal record-keeping obligations in India.

5. Cookies & Tracking Technologies

Nexaura Academy uses strictly necessary and functional first-party cookies to operate the platform securely and reliably. We do not employ invasive third-party cross-site advertising trackers or sell your behavioral data to data brokers.

You can choose to disable or block cookies through your individual browser settings (Chrome, Safari, Firefox, Edge). However, disabling essential session cookies will prevent you from logging into your account, accessing downloads, or completing checkout.

6. Payment Information & Zero-Storage Security

All payment transactions on Nexaura Academy are processed through Razorpay (Razorpay Software Private Limited), an internationally certified PCI-DSS Level 1 compliant payment gateway provider.

• No Raw Financial Data on Our Servers: Nexaura Academy does not collect, process, or store your 16-digit credit/debit card numbers, CVV codes, expiration dates, net banking passwords, or UPI PINs. All payment credential inputs are handled directly inside Razorpay's end-to-end encrypted payment modal.
• Stored Payment Metadata: We store only non-sensitive transaction tokens provided by Razorpay post-payment: the Razorpay Order ID (order_...), Razorpay Payment ID (pay_...), payment method category (UPI, Card, NetBanking), payment status (captured), and transaction amount.

7. Third-Party Services & Disclosures

We do not sell, rent, monetize, or trade your personal data with third parties. We share data only with vetted, reputable service providers necessary for platform operations:

• Razorpay Software Private Limited: Payment gateway handling encrypted card processing, UPI transactions, automated refunds, and payment verification.
• Google LLC: Identity authentication through Google OAuth 2.0 and high-speed secure cloud file storage via Google Drive/Cloud CDN for asset delivery.
• Cloud & CDN Infrastructure: Hosting providers and Content Delivery Networks (CDNs) for distributed file delivery, DDOS mitigation, and web security.
• Transactional Email Services: Secure SMTP relay infrastructure used exclusively for dispatching order invoices, download access keys, ticket replies, and account notices.
• Legal & Regulatory Authorities: We may disclose personal data if required by applicable law, search warrant, court subpoena, or valid order from a competent judicial or regulatory body in India.

8. Data Retention Policies

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, resolve disputes, and comply with legal statutory obligations:

• Account Data: Retained for as long as your user account remains active, enabling lifetime perpetual access to your purchased digital files and licensing certificates.
• Financial & Order Records: Retained for a minimum of 7 years following the transaction date to comply with statutory accounting, auditing, and tax regulations in India.
• Customer Support Tickets: Retained for up to 24 months following ticket closure to maintain customer service records and assist with recurring technical inquiries.
• Temporary Session Data: Session cookies and temporary authentication tokens are automatically purged upon session expiration or account logout.

9. User Rights & Data Control

Under applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and international standards, you have the following rights regarding your personal information:

• Right of Access: You have the right to request confirmation of whether we process your data and receive an electronic summary of your stored personal details.
• Right to Rectification: You can review, update, or correct your personal profile information (such as your name) directly through your user dashboard or by writing to support.
• Right to Erasure (Account Deletion): You may request the permanent deletion of your account and associated personal information by emailing us. Please note that certain transactional records must be retained for statutory tax and financial compliance.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right to Grievance Redressal: You have the right to have your privacy grievances addressed in a timely manner by our designated Grievance Officer.

10. Security Protocols & Safeguards

We employ robust physical, administrative, and technical safeguards to protect your personal data against unauthorized access, destruction, loss, or disclosure:

• HTTPS / TLS 1.3 Encryption: All communication between your web browser and our servers is encrypted in transit using modern Transport Layer Security (TLS).
• Cryptographic Password Hashing: Passwords are protected using one-way bcrypt hashing with individualized cryptographic salts.
• Tokenized Asset Delivery: Download links for purchased items are time-limited, session-verified, and cryptographically signed to prevent unauthorized link sharing.
• Database Hardening: Firewalled database servers with restricted role-based administrative access and strict CSRF and SQL-injection mitigation filters.

11. Governing Law & Jurisdiction

This Privacy Policy and any disputes or claims arising out of or in connection with it shall be governed by and construed in accordance with the laws of India.

Any legal action, proceeding, or dispute arising out of this Privacy Policy or your use of Nexaura Academy shall be subject to the exclusive jurisdiction of the competent courts located in Cuttack, Odisha, India.

12. Updates to This Privacy Policy

We may periodically update this Privacy Policy to reflect changes in our operational practices, technological enhancements, or legal regulations. When material modifications are made, we will update the "Last Updated" timestamp at the top of this document. Continued use of our platform following notice of changes constitutes acceptance of the revised terms.

13. Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Redressal Officer for Nexaura Academy is:

Last Updated & Effective: September 20, 2026. Published by Nexaura Studios.