🔒 Privacy Policy

1. Introduction

This policy explains what data we collect and how we use and protect it when you use Tafawwuq. Our practices are designed in the spirit of the Saudi Personal Data Protection Law (PDPL) and standard privacy principles: minimum data, specific purposes, serious protection.

2. Data We Collect

Account data: email, optional name, and password — passwords are stored only as scrypt hashes and are never visible to us in plain text. Training data: your progress, XP, mistakes, practice answers, and the essay texts and speaking answers you submit for evaluation. Payment data: payments (mada, Visa and Mastercard) happen entirely at the StreamPay payment gateway; we never receive or store card numbers.

Referral programme data: for each referral we store the inviting account and the invited account, the date of the purchase that counts for it and the date its days were granted, how many friends created an account through your link, and your invite code linked to your pseudonymous account id — for the sole purpose of running the programme. Your friend is never shown your name or email, and you are never shown your friends’ details — only how many there are, and your data export does not include their account ids. Deleting your account deletes your invite code; a pseudonymous id of your account, which contains no name or email, stays on the record of the friend who invited you or whom you invited, so a referral reward cannot be paid twice.

Age and consent data: your birth year only — never a full date of birth — to verify age; for users aged 13–17, a guardian's e-mail address and the time their consent was confirmed at signup. Purchase data: when you tap pay, we create a customer record for you at the StreamPay payment gateway containing your name and e-mail so the payment page opens pre-filled; for every purchase we keep an order record (plan, amount, date, StreamPay reference) linked to your pseudonymous account id, not your e-mail, retained for six years under commercial and tax record-keeping requirements, including after account deletion.

3. AI Processing

To generate evaluations, questions and replies, your relevant inputs (such as your essay text, the transcript of your spoken answer, or your question to the AI tutor) are sent to trusted third-party AI model providers engaged by the Platform, and are processed under their agreements for the sole purpose of generating the feedback you requested. We send the minimum necessary data, we do not sell your data, and we do not use it for advertising.

Voice: speech recognition in speaking exercises is performed by your own browser’s speech service (your browser vendor may process the audio under its own policies); the Platform receives only the resulting text and does not store your voice recordings. Listening-lab clips are pre-produced recordings.

The AI model providers that may currently process your inputs are Anthropic, Google and Groq, on their servers outside the Kingdom; when voice features are enabled, the tutor's reply text is converted to speech by ElevenLabs.

4. Storage & Security

Account records are stored fully encrypted at rest (AES-256-GCM) with our cloud hosting provider, data travels over encrypted connections (TLS), and sessions are cryptographically signed (HMAC). No system guarantees absolute security, but we adhere to well-established good practices.

The platform and its data are hosted with Vercel on servers outside Saudi Arabia, encrypted in transit and at rest, in accordance with the data-transfer provisions of the Personal Data Protection Law and its regulations.

5. Cookies

We use essential cookies to run the Platform: the sign-in session (tfq_session), the paid-plan status (tfq_premium), the interface language (NEXT_LOCALE), and a temporary device token (tfq_anon), kept for 30 days, so the placement test can run without an account; it carries no personal data. If you open an invite link, we also keep the invite code (tfq_ref) for 30 days so it counts when you create your account; it holds no personal data. We use no advertising or tracking cookies.

6. Local Storage & Sync

Your practice progress is kept in your browser’s local storage. When you are signed in, a snapshot of this progress is synced to your encrypted cloud account so it follows you across devices.

7. Your Rights

You may request access to your data, its correction, a copy of it, or permanent deletion of your account and data, by contacting support from the email registered to your account. We will fulfil requests within a reasonable time. You can also download a copy of your data and permanently delete your account yourself, from your account page, without contacting support.

8. Retention & Age

We retain your data while your account is active and delete it upon your request. The platform is for students aged 13 and over; we do not accept accounts for anyone younger. Users aged 13–17 must provide a guardian's e-mail and the guardian's confirmed consent at signup.

9. Updates & Contact

We may update this policy from time to time, publishing the latest version here with its date. For any privacy or data question, contact customer service: WhatsApp +966 54 385 8011, email support@tafawwuq-sa.com, Snapchat @Tafawwuq.

Contact us about your data

To request access to, correction of, or deletion of your data, write to us from the email registered on your account: