Privacy policy

This notice explains what personal data we collect when you use Mudarraj, why we collect it, who sees it, how long we keep it and how you stay in control. It applies to everyone who uses the platform — visitors, students, instructors, academy staff and academy owners — on the Mudarraj site, on every academy's site and discipline site built on it, and in the mobile apps. It is written to meet Egypt's Personal Data Protection Law No. 151 of 2020 and, for people in the European Union and the United Kingdom, the GDPR and the UK GDPR.

Who we are and who is responsible for your data

Mudarraj is a platform operated by Devya (https://devya.dev); our company details are at the end of this page. Every academy on Mudarraj is an independent business: it runs its own site, teaches its own students, sells its own courses and sets its own prices.

So responsibility for your data is shared between two parties:

• Devya is the controller of your platform account: your name, email, phone number and password (stored in a form that cannot be reversed), sign-in security, sessions and devices, your consent choices, academy billing, security logs, and the contact forms on the Mudarraj site itself. One Mudarraj account works across academies.
• The academy is the controller of your learning, purchases and contributions inside it: your enrolments, progress, quiz results, orders and wallet, live attendance, questions and reviews. Devya processes this data on the academy's behalf and on its instructions, as its processor, under our data processing addendum.

You can exercise most of your rights yourself, from Settings → Privacy & account (see "Your rights" below); for anything else, or any privacy question, write to us at privacy@mudarraj.dev. When the Personal Data Protection Centre issues our licence, we will add its number to this page. We have not appointed a representative in the EU or the UK: Mudarraj is built for academies and students in Egypt, and we do not target people elsewhere.

What we collect

• Identity: name, profile photo, bio, date of birth if you add it, city and country.
• Contact: email address and phone number.
• Study details: university, faculty and year or level, for each academy you join.
• Devices and sessions: a random device ID (stored on our servers only as a hash), the device's name and type, IP address, browser (user agent), and sign-in and last-seen times.
• Learning: enrolments, lesson progress and daily watch time, your notes, quiz attempts and answers, answers to in-lesson checkpoint questions, and certificates.
• Live sessions: when you joined and left a live room, and the chat messages you wrote in it.
• Contributions: your course questions, reviews, blog posts, comments and likes.
• Purchases: cart, orders, payment status and method (card, mobile wallet, payment kiosk, InstaPay, balance or free), wallet balance and transactions, promo codes, access codes you redeemed and referral points. We never see or store your full card number; card details are entered on the payment gateway's page.
• Instructors: revenue shares, account statement, payouts and payout account details, with the account number stored encrypted.
• Consent: your acceptance of the terms (which document, which version, when, from which IP address and browser) and your answers to the cookie banner (what you allowed, when, and the policy version — never an IP address or browser details).
• Notifications: your notifications and preferences, and the push token of the mobile app.
• Uploads: profile photos and course files.
• Contact forms: what you send through the contact, student ambassador, instructor application or academy demo forms.
• Audit logs: a record of sensitive actions (such as changing permissions or prices, exporting or deleting an account): who did it, when, and from which IP address.

Why we use your data, and on what basis

Each purpose rests on one of the bases the law allows: performing our contract with you (GDPR Art. 6(1)(b)), a legal obligation (6(1)(c)), our legitimate interest (6(1)(f)), or your consent (6(1)(a)), which you can withdraw at any time.

Purpose	Data	Basis
Creating your account, signing you in and running it	Identity, contact, devices and sessions	Performing our contract with you
Delivering courses: enrolment, progress, quizzes, certificates, live rooms	Learning, live sessions, study details	Performing the contract, on the academy's instructions
Protecting content from account sharing and leaks	Devices, your name and part of your phone number	Legitimate interest and performing the contract
Security, fraud prevention and abuse investigations	Sessions, IP addresses, audit logs	Legitimate interest and legal obligation
Payments, wallets, invoices and instructor payouts	Purchases, instructors, contact	Performing the contract and legal obligation
Account and payment messages	Contact, notifications	Performing the contract
Answering contact forms and screening applications	What you send in the form	Steps you ask for before a contract, and legitimate interest
Remembering optional settings and a referral code on your device	What the cookie policy lists as optional	Your consent (the cookie banner)
Showing a lesson hosted on YouTube	IP address and browser data, sent to YouTube	Your request (pressing play) or your consent
Proving that you accepted the terms or answered the cookie banner	Consent	Legal obligation
Marketing messages	Contact	Your consent only
Complying with the law and requests from authorities	As required	Legal obligation

Protecting content: device limits and the watermark

Academies sell their courses to each student individually, so we use two measures against account sharing and video leaks:

• Device limit: each academy sets how many devices your account can use there (2 by default; the academy can change it). We recognise a device by a random ID kept in a cookie (mdr_did) or in the mobile app's secure storage, which our servers store only as a hash, and we store the device's name and type, last IP address and last-seen time. You can remove a device yourself from Settings once every 30 days, or ask the academy to do it.
• Watermark: videos show a moving mark with your name and part of your phone number, with the rest hidden (or part of your email if you have no phone number). It discourages recording and re-sharing, and lets the academy trace where a leaked recording came from. The academy can turn it off.

The rules, and what happens when they are broken, are in the acceptable use policy.

Cookies, storage and your consent

We use no analytics tool, advertising pixel or third-party tracker. What we keep on your device is either strictly necessary (sign-in, security, your theme, your cart, your own consent choice) or waits for your consent: remembering your camera and microphone for live rooms, and a referral code from a shared link. A lesson hosted on YouTube loads from YouTube only when you press play on it, or straight away if you allowed the marketing category.

The consent banner offers Reject all, Customize and Accept all with equal weight; nothing is pre-ticked. You can change your choice at any time from "Cookie settings" at the bottom of every page or in Settings → Privacy & account, and withdrawing a category clears what it stored. Every answer is recorded as a receipt without your IP address or browser details, kept for 365 days. The full list, with lifetimes, is the cookie policy.

What your academy sees and does with your data

When you join an academy, it becomes responsible for your data inside it. Its team (owner, admins and instructors) sees only what their role needs, within the permissions the owner sets:

• Member list: your name, email, phone, study details and membership status.
• Learning: your progress, quiz results, live attendance, questions and reviews.
• Purchases: your orders, wallet and payment status.
• Devices: the devices registered to your account at that academy (name, type and last seen), so it can manage the device limit.

The owner, and admins with permission, can download the member list as a CSV file; the academy is then responsible for keeping that file safe. The academy may contact you about your courses and enrolment, and sends marketing only with your consent.

For anything about your data inside an academy (correcting it, removing your membership, or finding out what it holds), contact the academy directly through the contact page on its site or its support email. If you get no answer, write to us at privacy@mudarraj.dev and we will help. When you leave an academy, it keeps your order and payment records for as long as the law requires and deletes or anonymises the rest.

Users under 18

If you are under 18, you need a parent's or guardian's consent before you create an account and before you buy anything, and your guardian is responsible for your use of the platform. We do not send marketing to anyone under 18. If we learn that an account belongs to a minor without a guardian's consent, we may ask for that consent or suspend the account.

Who we share your data with

We share personal data only with the parties below, each for its stated role. The current list, with locations and safeguards, is kept on the sub-processors page, where we announce any change before it takes effect.

• The academy you join, as described above.
• Our hosting provider — the application and its database run on servers we rent from a hosting company; it holds every data category in this notice and sees the technical details of each request (IP address, browser, address visited) in its server logs. We name the provider and its region on the sub-processors page.
• Cloudflare — the name servers of our domains, lesson video (Cloudflare Stream, played through short-lived signed links) and, where configured, file storage (R2). It receives IP addresses and request data, and the videos and files themselves.
• YouTube (Google) — only when you press play on a lesson an academy hosts on YouTube, or once you have allowed the marketing category in the cookie settings: your IP address and browser data then go to YouTube under Google's privacy policy. Nothing is sent before either.
• Payment gateways — Paymob today (the sub-processors page lists any other): name, email, phone and order amount, with card details entered on the gateway's own page. The academy or Devya contracts with the gateway directly.
• Our email provider — sends account email (verification codes, password resets, payment and order notices): your name, email address and the message content.
• Google Firebase Cloud Messaging (Android app) and the Apple Push Notification service (iOS app) — deliver push notifications: the device's push token and the notification text.
• Live rooms run on our own servers with the open-source LiveKit software, so no other company receives your audio, video or chat. If an academy holds a live session on Zoom, Google Meet or Jitsi instead, that service receives your name and email when you join, your IP address, and the audio and video you share, under its own policy.
• Authorities when the law or a court order requires it.

We do not sell your data, and we do not share it with advertisers.

Transfers outside Egypt

Our servers, and most of the providers above, process data outside Egypt. We transfer personal data abroad only with the safeguards and permits required by the Personal Data Protection Law No. 151 of 2020, and we show where each provider processes data on the sub-processors page.

If you are in the European Union or the United Kingdom, a transfer to Egypt or to a provider outside the EEA or the UK rests on one of the safeguards the GDPR allows — standard contractual clauses with the provider, or an adequacy decision covering it. Write to privacy@mudarraj.dev for details of the safeguard that applies to a given provider.

How long we keep data

Data	Period
Account data	While your account is active
After you delete your account	Anonymised at once (see your rights below); what academies must keep stays without your name
Orders, invoices, wallet and payout records	As long as tax and accounting law requires, with billing details pseudonymised once that period allows
Sessions	Deleted when they expire, or a week after they were signed out
Verification codes	A week after they were used or expired
Device records (name, type, last IP address, last seen)	While the device is registered to your account; you can remove it yourself, and all are deleted with your account
Acceptance of the terms	As long as your account exists, then as anonymous evidence
Cookie-banner answers (receipts)	365 days
Contact forms and applications	12 months after the conversation closes
Security audit logs	12 months
Backups	Overwritten within 35 days

Your rights and how to use them

The Personal Data Protection Law No. 151 of 2020 and, where it applies, the GDPR give you the right to:

• access what we hold about you, and get a copy of it in a portable, machine-readable form;
• correct or complete your data;
• erase your data, except what the law requires us to keep;
• restrict or object to a use of your data that rests on our legitimate interest;
• withdraw consent at any time, without affecting what was done before;
• complain to a supervisory authority.

You can exercise most of these yourself, right away:

• Copy of your data: Settings → Privacy & account → "Download my data" gives you a JSON file of everything the platform holds about you across every academy — profile, memberships, courses and progress, notes, questions, reviews, quiz attempts, certificates, posts and comments, orders, wallet, points, live attendance and chat, consent records (terms and cookie banner), referral codes and access codes, notifications, devices and sessions. Messages you sent through the contact and application forms are not in the file, because a form does not prove who typed the email address: write to privacy@mudarraj.dev from that address and we send you a copy.
• Correction: edit your profile and study details in Settings, or ask the academy for what only it can change.
• Erasure: Settings → Privacy & account → "Delete my account", after re-entering your password. Deletion is immediate and covers your account in every academy. We remove your name, email, phone, date of birth, city, country, bio and photo, your password, your private notes, your notifications and their settings, every signed-in device and session, your cart and any pending verification codes; the old email address is freed for a new account. We keep, detached from your name, what someone else legitimately relies on: enrolments, progress, watch days, quiz attempts and certificates (the academy's teaching record), your questions, answers, reviews, posts and comments (shown as "Deleted user"; you can edit or delete them before leaving), your memberships (suspended, with student number and instructor profile cleared), invitations you sent, your acceptance of the terms and your cookie-banner receipts (as evidence, no longer linked to you), and the orders, wallet, ledger and payout records that tax and accounting law make us keep. The sole owner of an academy must first hand it to another owner or close it; platform administrators cannot delete their account from here.
• Sign out everywhere: the same page ends your sessions on every other device.
• Withdraw consent: "Cookie settings" at the bottom of every page, and the notification settings for marketing messages.

For restriction, objection and anything the pages above do not cover, write to privacy@mudarraj.dev from the email address on your account. We may ask you to confirm your identity first. We reply as soon as we can, and always within the time limits the law sets (one month under the GDPR). If your request concerns data an academy controls, we pass it to the academy and help it respond.

You may also complain to the Personal Data Protection Centre in Egypt, or, if you are in the EU or the UK, to the data protection authority of the country where you live (in the UK, the Information Commissioner's Office). We would rather hear from you first, so that we can put things right.

Automated decisions

Two things happen automatically, and neither has a legal or similarly significant effect on you:

• Quiz marking: multiple-choice and true/false answers are marked by comparing them with the instructor's answer key; written answers are graded by a person. The result counts towards your progress and certificate in that academy, and the instructor can review and change a grade.
• Device limit: a sign-in from more devices than the academy allows is refused until you remove one, which you can do yourself (see above) or by asking the academy.

We do no profiling and make no automated decisions for advertising.

Marketing messages

Account, security and payment messages are not marketing; your account needs them to work. Marketing messages from Devya or from an academy are sent only with your consent, and you can stop them at any time in your notification settings or by writing to us. We never send them to anyone under 18.

Security and breach notification

We use encrypted connections everywhere; we store passwords and session tokens in a form that cannot be reversed; we encrypt payment gateway credentials, payout account numbers and other sensitive data; we serve private files and videos only through short-lived links after checking your access; and we keep each academy's data separate from every other academy's.

If personal data is breached, we notify the Personal Data Protection Centre within 72 hours of becoming aware of it (and, where the GDPR applies, the competent supervisory authority within the same period), notify affected academies without undue delay, and notify you when the law requires it.

Changes to this notice

When we make a material change to this notice, we announce it in the platform or by email before it takes effect, and we update the effective date at the top of the page. If the English translation differs from the Arabic text, the Arabic text governs.

Contact us

• Privacy and your rights: privacy@mudarraj.dev
• General questions: hello@mudarraj.dev
• Legal matters: legal@mudarraj.dev