Privacy Policy

Introduction

Qodorat & More ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.

Information We Collect

We collect information that you provide directly to us and information that is automatically collected when you use our services:

Personal Information

Name and contact information
Email address
Device information and identifiers
Subscription and payment information

Usage Information

Practice session data and progress
Mock exam results and performance
Learning progress and statistics
App usage patterns and preferences

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services
Personalize your experience and improve app functionality
Send you updates, notifications, and respond to your inquiries
Detect, prevent, and address technical issues and security threats
Comply with legal obligations and enforce our terms

Legal Basis for Processing

We process your personal data based on the following legal grounds as required by Saudi Arabia's Personal Data Protection Law (PDPL):

Contract Performance: To fulfill our contractual obligations and provide you with our services
Consent: When you have given explicit consent for specific processing activities
Legal Obligation: To comply with applicable laws and regulations in Saudi Arabia
Legitimate Interest: For our legitimate business interests, such as improving our services and preventing fraud, while respecting your rights and interests

Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

Third-Party Service Providers

We work with trusted third-party service providers to deliver our services. These providers are contractually obligated to protect your data and use it only for the purposes we specify:

Supabase (Database & Authentication): We use Supabase for secure database storage, user authentication, and cloud infrastructure. Supabase processes your account information, progress data, and app usage statistics. Data is stored in secure, encrypted databases.
Firebase (Google): We use Firebase services for push notifications (FCM), crash reporting, analytics, and performance monitoring. Firebase may collect device identifiers, app usage data, and error logs to help us improve the app.
Payment Processors: For in-app purchases, we use Apple App Store and Google Play Store payment systems. Payment information is processed directly by Apple or Google and is not stored on our servers. We only receive transaction confirmations and subscription status.
Authentication Providers: If you choose to sign in with Google or Apple, these providers authenticate your identity. We receive your email address and name (if provided) from these services, but we do not have access to your Google or Apple account credentials.

Important: All third-party service providers are required to maintain appropriate security measures and are prohibited from using your personal information for any purpose other than providing services to us.

Legal Requirements: We may disclose information if required by law or in response to valid legal requests from Saudi Arabian authorities or courts.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to the same privacy protections.

International Data Transfers

Some of our third-party service providers may process your data outside of Saudi Arabia. When we transfer your personal data internationally, we ensure appropriate safeguards are in place to protect your data in accordance with Saudi Arabia's Personal Data Protection Law (PDPL).

We implement standard contractual clauses, data processing agreements, and other legal mechanisms to ensure your data receives adequate protection when transferred internationally. All transfers comply with PDPL requirements.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law:

Active Accounts:

We retain your data for as long as your account is active and for a reasonable period thereafter to allow you to reactivate your account if desired.

Deleted Accounts:

After you request account deletion, we will delete or anonymize your personal data within 30 days, except where we are required to retain certain information for legal, regulatory, or legitimate business purposes (such as transaction records for accounting, which we retain for 7 years as required by Saudi tax law).

Legal Requirements:

We may retain certain data for longer periods when required by Saudi Arabian law, such as financial records (7 years), or when necessary for legal proceedings, dispute resolution, or fraud prevention.

Data Security

We implement comprehensive technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

Encryption: We use industry-standard encryption (TLS/SSL) for data in transit and encryption at rest for sensitive data stored in our databases
Access Controls: We implement strict access controls, authentication requirements, and role-based permissions to ensure only authorized personnel can access your data
Secure Storage: Your data is stored in secure, monitored data centers with physical security measures and redundant backup systems
Regular Audits: We conduct regular security assessments, vulnerability testing, and compliance audits to identify and address potential security risks
Staff Training: Our team members receive regular training on data protection, privacy best practices, and security protocols

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

Payment Information

When you make in-app purchases, payment processing is handled directly by Apple (for iOS) or Google (for Android) through their secure payment systems. We do not collect, store, or process your credit card information, bank account details, or other payment credentials. We only receive confirmation of successful transactions and subscription status to manage your account access.

All payment data is subject to Apple's and Google's respective privacy policies and terms of service. We recommend reviewing their privacy policies for information about how they handle your payment information.

Your Rights Under Saudi PDPL

Under Saudi Arabia's Personal Data Protection Law (PDPL), you have the following rights regarding your personal information:

Right to Access

You have the right to request access to your personal data and receive a copy of the data we hold about you, including information about how we use your data.

Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You can update your information directly in the app or contact us for assistance.

Right to Deletion

You have the right to request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw your consent. You can request account deletion through the app or by contacting us.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another service provider where technically feasible.

Right to Object

You have the right to object to the processing of your personal data for certain purposes, such as direct marketing or processing based on legitimate interests.

Right to Withdraw Consent

Where we process your data based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

How to Exercise Your Rights: To exercise any of these rights, please contact us at support@qudoratplus.com or use the account deletion feature in the app. We will respond to your request within 30 days as required by PDPL. We may need to verify your identity before processing your request.

Children's Privacy

Our services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: support@qudoratplus.com