Privacy Policy

1. Data We Collect

We require specific data to operate the Platform and deliver the Service to you. We collect only what is necessary for this purpose; below we describe the nature of this data and its source.

• Account Data: your name, email address, and the password you choose. You may also register via Google. This data is stored with our authentication provider (Supabase).
• Performance and Learning Data: your test responses, response time per question, performance analytics results, the cognitive model derived from your strengths and weaknesses, spaced-repetition schedules, and chat sessions about questions and concepts.
• Technical Data: session identifiers, technical performance data for Platform improvement, and site visitor analytics processed in anonymized form where possible.
• Payment Data: subscription date, package type, and pending payments. We do not receive or store credit card numbers; payments are processed entirely by Stripe.
• Purchase and activity records: for every purchase we record the Stripe payment ID, your account ID and email, the IP address and browser the purchase was made from, and the version of the Cancellation & Refund Policy you accepted and when. We also record when you sign in, start tests and open paid courses, with the IP address and browser.
• Communications: text of messages you send through the "Contact" form on the Platform.

2. How We Use Your Data and the Legal Basis for Each Use

We use your data only for the purposes described below, each with a legal basis explaining why we use it. We distinguish between fulfilling our obligations to you (contract performance), seeking your consent, having a legitimate interest that does not override your rights, or being required by law.

We do not sell your data, lease it, or use it to train external artificial intelligence models.

• Providing and operating the Platform: We use login data and profile information to secure your access and display your content. Basis: Contract performance (terms of service agreement).
• Building tests and tracking your performance: We record your answers and response times to generate your cognitive model and direct appropriate questions to you. Basis: Contract performance.
• Adaptive learning and spaced repetition: We analyze your errors and review schedules to provide a personal review timetable. Basis: Contract performance.
• Communicating with you: We use contact data you enter in the "Contact" form to respond to your inquiries. Basis: Consent upon sending your message.
• Analyzing Platform usage: We conduct aggregate analyses to improve technical performance without personally identifying you. Basis: Legitimate interest in service improvement.
• Processing payments: We pass payment data to Stripe only; we do not receive card numbers. Basis: Contract performance.
• Retaining financial records: We retain records of your subscriptions and pending invoices to comply with tax and accounting regulations. Basis: Legal obligation.
• Protecting our rights and handling disputes: We retain usage records to protect the Platform from fraud, violation, or legal claims. Basis: Legitimate interest or legal obligation.
• Compliance with Saudi Personal Data Protection Law: We fulfill your requests regarding your data and implement required security procedures. Basis: Legal obligation.

3. Artificial Intelligence and Processing of Your Responses

When you request an explanation for a question or use the "Ask" page, we send the question text, your answer, and your inquiry to our artificial intelligence service providers: Google Gemini, OpenAI, and Amazon Bedrock. We use them to generate appropriate explanations and evaluate your open-ended responses, not to train or improve their models.

We select these services based on their technical efficiency and contractual terms, and we obligate them not to use your data in training external models or retaining it after processing for operational purposes. We do not transfer your data to these providers except to the extent necessary to deliver the service to you.

4. Cookies and Visit Analytics

We use cookies and similar technologies to ensure the website functions properly and to provide an enhanced educational experience tailored to your progress. The information we collect is limited to understanding how you use the platform, without identifying you personally outside the context of your account. We do not sell this data or share it with external parties for commercial purposes; we use it solely to improve the platform's performance and develop its educational content.

The exception is measuring our ads on TikTok: the TikTok Pixel sends TikTok the pages you visit and when you start a test, create an account, choose a plan, and start and complete a payment, with the plan's value, so we know which of our ads brought visitors to the platform. We do not send your name, email or answers. Basis: legitimate interest in measuring our advertising; you can block third-party cookies in your browser.

5. Data Sharing and Service Providers

We do not sell or lease your data, nor do we make it available except to those who need it to operate and improve the platform. These providers receive only the minimum necessary and may not use your data for any other purpose or retain it after the contractual relationship ends.

• Backup and Authentication: Supabase manages account directory and primary database.
• Hosting and Visitor Analytics: Vercel hosts the platform and records general browsing data.
• Payment Processing: Stripe receives all payment data and processes it without your card details reaching our platform.
• Proving transactions and handling refund requests and payment disputes: we use purchase and activity records to check refund requests under the Cancellation & Refund Policy, to answer payment disputes raised with banks and Stripe, and to prevent fraud. Basis: legitimate interest and performance of the contract.
• Rate Limiting and Task Queues: Upstash Redis organizes the flow of immediate queries.
• Video Hosting: Bunny.net stores and displays course video clips.
• Ad Measurement: TikTok receives the visit, sign-up and purchase events described under Cookies.
• Artificial Intelligence: Google Gemini, OpenAI, and Amazon Bedrock receive question and answer text to generate explanations and respond to your inquiries on the "Ask" page.

6. Data Retention Period and Deletion

We retain your personal and educational data while your account exists and as long as it is necessary to provide our services to you. We do not currently delete accounts automatically, including for inactivity; deletion happens at your request and is carried out by our team by hand.

• Deletion Request: You may request account deletion at any time through the contact form available on the "Contact" page of the platform. Our team reviews the request and deletes your personal and educational data by hand within the timeframes set by the Saudi Personal Data Protection Law, then confirms the deletion to you.
• Financial Records: We retain payment and subscription records for a period consistent with tax and accounting requirements in the Kingdom of Saudi Arabia, even after your account is closed or your educational data is deleted.
• Backups: A copy of your data may remain in database backups until those backups expire and are deleted automatically; backups are used only to restore the service after a failure.

7. Data Security and Technical Safeguards

We implement technical and organizational security measures to protect your data from unauthorized access, use, alteration, or disclosure. Communication between your device and our servers is encrypted during transmission, and our operations team's access to data is restricted according to each member's specific duties. We also enforce rate limiting on platform interfaces to mitigate risks of excessive or harmful usage.

However, no electronic system is completely secure. If you encounter a security vulnerability or suspicious activity, please notify us immediately through the contact form on the "Contact" page of the platform.

8. Your Rights Under the Saudi Personal Data Protection Law and How to Exercise Them

We recognize your full rights regarding your personal data under the Saudi Personal Data Protection Law issued by Council of Ministers Resolution No. (98) dated 16/8/1443 AH, and the implementing standards issued by the Saudi Data and Artificial Intelligence Authority (SDAIA). These rights apply regardless of your plan or subscription status.

• Right to Access: You may request a copy of your personal data we hold, in a clear and readable format.
• Right to Rectification: You may correct any inaccurate or incomplete data, via profile settings or by contacting us.
• Right to Erasure: You may request deletion of your data, subject to legal and technical obligations, and without conflict with retention of test records required for result verification purposes.
• Right to Restrict Processing: You may request temporary cessation of processing in specific circumstances, such as objecting to data accuracy during verification.
• Right to Object: You may object to processing based on legitimate interests, except where required by examination and assessment necessities.
• Right to Withdraw Consent: Where processing is consent-based, you may withdraw consent at any time, without affecting the lawfulness of prior processing.
• Right to Data Portability: You may request your data in a commonly used, machine-readable format, where technically feasible.

9. Privacy of Minors and Parental Consent

We serve students across various educational stages and recognize that many of our users are under eighteen years of age. We do not provide separate registration for minors. When creating any account, we require confirmation that the user has parental consent if below the legal age. Continued use of the platform constitutes acknowledgment from the parent or guardian that they have reviewed this policy and explicitly consent to the collection and processing of their child's data in accordance with the Saudi Personal Data Protection Law.

A parent or guardian has the right to access their minor child's data, correct or delete it, or request cessation of its processing. They may withdraw consent at any time, resulting in account suspension and deletion of associated data. To exercise any of these rights, please contact us through the contact form on the (Contact) page of the platform, attaching documentation establishing guardianship.

10. Changes to this Policy

We reserve the right to modify this policy at any time as required by legal, technical, or operational developments. The new version takes effect upon publication, and any material change is announced through a prominent notice on the platform or through the contact method registered in your account.

The effective date is updated at the top of the page with each revision. Your continued use of the platform after the publication of amendments constitutes acceptance of the revised text. If you wish to object to a material change, you have the right to discontinue using your account and request deletion of your data through the "Contact" page.

11. How to Contact Us About Privacy

If you have any inquiry or request regarding your personal data or our processing practices—whether you wish to access, modify, or delete your data, or if you have a complaint or observation—you may contact us through the contact form available on the "Contact" page of the platform. We respond to privacy-related requests within the timeframes stipulated by the Saudi Personal Data Protection Law.