Privacy Policy

1. Who is responsible for your data

Elaaf Digital Innovations is the data controller for personal information processed through the Platform. Our contact details for privacy matters appear at the end of this policy.

2. Information we collect

• Account and profile data: name, email address, country, preferred language, phone number, avatar, and any profile or creator-page details you provide.
• Payout and financial data: bank name, IBAN, and beneficiary details where you request payouts; wallet balance and transaction history. Full card details are handled by our payment provider and are not stored by us.
• Purchase and learning activity: courses viewed, enrolled, purchased, gifted, or completed; progress, quiz answers, certificates, reviews, questions, discussions, wishlist, notes, and subscriptions.
• Content you submit: course topics and prompts, generated course content you publish, and communications with us or other Users.
• Technical and usage data: device and browser information, IP address, approximate location, pages viewed, and interactions, collected through cookies and similar technologies.
• Communications: messages you send us (for example, support or contact requests).

3. How we collect it

We collect information directly from you (when you register, build or buy courses, or contact us), automatically as you use the Platform (through cookies and analytics), and from third parties such as authentication providers (Google, Apple) and our payment and verification providers.

4. How and why we use it

• To create and manage your account and authenticate you.
• To operate the marketplace: generate, deliver, and improve courses; process purchases, subscriptions, earnings, and payouts; issue certificates.
• To provide customer support and respond to your requests.
• To maintain security, prevent and detect fraud and abuse, and enforce our Terms and policies.
• To send service and transactional messages (for example, receipts, payout and course updates, and important notices).
• Where enabled and permitted, to measure and improve marketing performance.
• To comply with legal, tax, accounting, and regulatory obligations.

5. Legal bases

We process personal data as necessary to perform our contract with you (providing the Platform), to comply with legal obligations, for our legitimate interests in operating and securing the Platform, and, where required, on the basis of your consent (for example, certain marketing and analytics cookies). You may withdraw consent at any time where processing is based on it.

6. AI processing

To generate courses and features, course topics, prompts, and related text you submit are sent to third-party AI providers (for example, for content generation, translation, embeddings, and text-to-speech). We instruct such providers to process the data only to provide the service to us. Do not submit sensitive personal information in course prompts.

7. Cookies and analytics

We use cookies and similar technologies that are necessary for the Platform to function, and — where enabled — analytics and marketing pixels (which may include Google Analytics, Meta, TikTok, Snapchat, and LinkedIn). These help us understand usage and measure campaigns. Non-essential analytics and marketing cookies load only after you accept them in our cookie banner; you can change your choice at any time using "Cookie preferences" in the site footer, or through your browser settings. Necessary cookies (such as your session, security, and preference cookies) are always active.

8. Who we share it with

We do not sell your personal data. We share it with service providers ("processors") who help us run the Platform, under contracts that require them to protect it and use it only for us. These include, for example: cloud hosting and database/storage (Supabase; Vercel), payment processing (MyFatoorah), email delivery (Resend), AI generation and text-to-speech (Anthropic; Google/Gemini), phone verification (Twilio), and analytics/marketing providers where enabled. We may also share data to comply with law, enforce our terms, or protect rights, safety, and security, and in connection with a business transfer.

9. International transfers

Some of our providers process data outside the Kingdom of Bahrain. Where personal data is transferred internationally, we take steps intended to ensure an appropriate level of protection consistent with applicable law.

10. Data retention

We keep personal data for as long as needed to provide the Platform and for legitimate business and legal purposes — for example, transaction and ledger records are retained as required by accounting and tax law. When data is no longer needed, we delete or anonymise it. Certain records may be retained longer where the law requires.

11. Security

We use technical and organisational measures designed to protect personal data, including encryption of sensitive credentials and access controls. No method of transmission or storage is completely secure; you are responsible for keeping your account credentials confidential.

12. Your rights and choices

• Access, correct, or update your profile information at any time in your account.
• Request access to, correction, or deletion of your personal data, subject to legal retention requirements.
• Opt out of non-essential marketing emails using the profile settings or the unsubscribe link.
• Object to or restrict certain processing, and request portability where applicable.
• Withdraw consent where processing is based on it.

13. Children

The Platform is not directed to children. You must meet the minimum age in our Terms to use it. We do not knowingly collect personal data from children below that age; if you believe we have, please contact us so we can address it.

14. Third-party links

The Platform may link to third-party sites or services that we do not control. Their privacy practices are governed by their own policies, which we encourage you to review.

15. Changes and contact

We may update this Privacy Policy from time to time and will post the updated version here with a new effective date. For privacy questions, to exercise your rights, or to raise a concern, contact us using the details below. You may also have the right to lodge a complaint with the competent data-protection authority in the Kingdom of Bahrain.