Privacy policy

This notice explains what personal data we collect when you use Mudarraj, why we collect it, who sees it, how long we keep it and how you stay in control. It applies to everyone who uses the platform: visitors, students, instructors, academy staff and academy owners.

Who we are and who is responsible for your data

Mudarraj is a platform operated by Devya (https://devya.dev); our company details are at the end of this page. Every academy on Mudarraj is an independent business: it runs its own site, teaches its own students, sells its own courses and sets its own prices.

So responsibility for your data is shared between two parties:

• Devya is the controller of your platform account: your name, email, phone number and password (stored in a form that cannot be reversed), sign-in security, sessions and devices, academy billing, security logs, and the contact forms on the Mudarraj site itself. One Mudarraj account works across academies.
• The academy is the controller of your learning, purchases and contributions inside it: your enrolments, progress, quiz results, orders, questions and reviews. Devya processes this data on the academy's behalf and on its instructions, under our data processing addendum.

For any privacy question, or to exercise your rights, write to us at privacy@mudarraj.dev. When the Personal Data Protection Centre issues our licence, we will add its number to this page.

What we collect

• Identity: name, profile photo, bio, date of birth if you add it, city and country.
• Contact: email address and phone number.
• Study details: university, faculty and year or level, for each academy you join.
• Devices and sessions: a random device ID (stored on our servers only as a hash), the device's name and type, IP address, browser (user agent), and sign-in and last-seen times.
• Learning: enrolments, lesson progress, watch days, your notes, quiz attempts and answers, answers to in-lesson checkpoint questions, and certificates.
• Contributions: your course questions, reviews, blog posts, comments and likes.
• Purchases: cart, orders, payment status and method (card, mobile wallet, payment kiosk, InstaPay or free), promo codes and referral points. We never see or store your full card number; card details are entered on the payment gateway's page.
• Instructors: revenue shares, account statement, payouts and payout account details, with sensitive details stored encrypted.
• Notifications: your notifications and preferences, and the push token of the mobile app.
• Uploads: profile photos and course files.
• Contact forms: what you send through the contact, student ambassador, instructor application or academy demo forms.
• Audit logs: a record of sensitive actions (such as changing permissions or prices): who did it, when, and from which IP address.

Why we use your data, and on what basis

Purpose	Data	Basis
Creating your account, signing you in and running it	Identity, contact, devices and sessions	Performing our contract with you
Delivering courses: enrolment, progress, quizzes, certificates	Learning, study details	Performing the contract, on the academy's instructions
Protecting content from account sharing and leaks	Devices, your name and part of your phone number	Legitimate interest and performing the contract
Security, fraud prevention and abuse investigations	Sessions, IP addresses, audit logs	Legitimate interest and legal obligation
Payments and invoices	Purchases, contact	Performing the contract and legal obligation
Account and payment messages	Contact, notifications	Performing the contract
Answering contact forms and screening applications	What you send in the form	Steps you ask for before a contract, and legitimate interest
Marketing messages	Contact	Your consent only
Complying with the law and requests from authorities	As required	Legal obligation

Protecting content: device limits and the watermark

Academies sell their courses to each student individually, so we use two measures against account sharing and video leaks:

• Device limit: each academy sets how many devices your account can use there (2 by default; the academy can change it). We recognise a device by a random ID kept in a cookie (mdr_did) or in the mobile app's secure storage, which our servers store only as a hash, and we store the device's name and type, last IP address and last-seen time. You can remove a device yourself from Settings once every 30 days, or ask the academy to do it.
• Watermark: videos show a moving mark with your name and part of your phone number, with the rest hidden (or part of your email if you have no phone number). It discourages recording and re-sharing, and lets the academy trace where a leaked recording came from. The academy can turn it off.

The rules, and what happens when they are broken, are in the acceptable use policy.

What your academy sees and does with your data

When you join an academy, it becomes responsible for your data inside it. Its team (owner, admins and instructors) sees only what their role needs, within the permissions the owner sets:

• Member list: your name, email, phone, study details and membership status.
• Learning: your progress, quiz results, questions and reviews.
• Purchases: your orders and payment status.
• Devices: the devices registered to your account at that academy (name, type and last seen), so it can manage the device limit.

The owner, and admins with permission, can download the member list as a CSV file; the academy is then responsible for keeping that file safe. The academy may contact you about your courses and enrolment, and sends marketing only with your consent.

For anything about your data inside an academy (correcting it, removing your membership, or finding out what it holds), contact the academy directly through the contact page on its site or its support email. If you get no answer, write to us at privacy@mudarraj.dev and we will help. When you leave an academy, it keeps your order and payment records for as long as the law requires and deletes or anonymises the rest.

Users under 18

If you are under 18, you need a parent's or guardian's consent before you create an account and before you buy anything, and your guardian is responsible for your use of the platform. We do not send marketing to anyone under 18. If we learn that an account belongs to a minor without a guardian's consent, we may ask for that consent or suspend the account.

Who we share your data with

• The academy you join, as described above.
• Service providers (sub-processors) we use for hosting, video, email, notifications and payments, listed on the sub-processors page. They process data only on our instructions and only to provide the service.
• Payment gateways (such as Paymob and Fawaterak) when you buy from an academy that uses them; the academy contracts with the gateway directly.
• Authorities when the law or a court order requires it.

We do not sell your data, and we do not share it with advertisers.

Transfers outside Egypt

Some of our service providers process data on servers outside Egypt. We transfer personal data abroad only with the safeguards and permits required by the Personal Data Protection Law No. 151 of 2020, and we show where each provider processes data on the sub-processors page.

How long we keep data

Data	Period
Account data	While your account is active
After you delete your account	Anonymised within 30 days
Orders, invoices and payment records	As long as tax and accounting law requires
Device IP address and user agent	90 days after the device was last seen
Session records	Deleted when they expire
Contact forms and applications	12 months after the conversation closes
Security audit logs	12 months
Backups	Overwritten within 35 days

Your rights and how to use them

The Personal Data Protection Law No. 151 of 2020 gives you the right to:

• know what we hold about you and get a copy of it;
• correct or complete your data;
• ask us to delete your data, except what the law requires us to keep;
• object to processing or withdraw your consent at any time;
• receive your data in a portable format, where that is possible;
• complain to the Personal Data Protection Centre.

You can already edit your profile and remove devices in Settings. For everything else, write to privacy@mudarraj.dev from the email address on your account. We may ask you to confirm your identity first. We reply as soon as we can, and always within the time limits set by the law. If your request concerns data an academy controls, we pass it to the academy and help it respond.

Marketing messages

Account, security and payment messages are not marketing; your account needs them to work. Marketing messages from Devya or from an academy are sent only with your consent, and you can stop them at any time in your notification settings or by writing to us. We never send them to anyone under 18.

Cookies

We use only the cookies needed for sign-in and security and to remember your language and theme. We use no analytics or advertising tools. Details are in the cookie notice.

Security and breach notification

We use encrypted connections everywhere; we store passwords and session tokens in a form that cannot be reversed; we encrypt payment gateway credentials and other sensitive data; we serve private files and videos only through short-lived links after checking your access; and we keep each academy's data separate from every other academy's.

If personal data is breached, we notify the Personal Data Protection Centre within 72 hours of becoming aware of it, notify affected academies without undue delay, and notify you when the law requires it.

Changes to this notice

When we make a material change to this notice, we announce it in the platform or by email before it takes effect, and we update the effective date at the top of the page. If the English translation differs from the Arabic text, the Arabic text governs.

Contact us

• Privacy and your rights: privacy@mudarraj.dev
• General questions: hello@mudarraj.dev
• Legal matters: legal@mudarraj.dev