Privacy Policy

1. Who is responsible for your data

Elaaf Digital Innovations is the data controller for personal information processed through the Platform. Our contact details for privacy matters appear at the end of this policy.

2. Information we collect

• Account and profile data: name, email address, country, preferred language, phone number, avatar, and any profile or creator-page details you provide.
• Payout and financial data: bank name, IBAN, and beneficiary details where you request payouts; wallet balance and transaction history. Full card details are handled by our payment provider and are not stored by us.
• Purchase and learning activity: courses viewed, enrolled, purchased, gifted, or completed; progress, quiz answers, certificates, reviews, questions, discussions, wishlist, notes, and subscriptions.
• Content you submit: course topics and prompts, generated course content you publish, and communications with us or other Users.
• Technical and usage data: device and browser information, IP address, approximate location, pages viewed, and interactions, collected through cookies and similar technologies.
• Communications: messages you send us (for example, support or contact requests).

3. How we collect it

We collect information directly from you (when you register, build or buy courses, or contact us), automatically as you use the Platform (through cookies and analytics), and from third parties such as authentication providers (Google, Apple) and our payment and verification providers.

4. How and why we use it

• To create and manage your account and authenticate you.
• To operate the marketplace: generate, deliver, and improve courses; process purchases, subscriptions, earnings, and payouts; issue certificates.
• To provide customer support and respond to your requests.
• To maintain security, prevent and detect fraud and abuse, and enforce our Terms and policies.
• To send service and transactional messages (for example, receipts, payout and course updates, and important notices).
• Where enabled and permitted, to measure and improve marketing performance.
• To comply with legal, tax, accounting, and regulatory obligations.

5. Legal bases

We process personal data as necessary to perform our contract with you (providing the Platform), to comply with legal obligations, for our legitimate interests in operating and securing the Platform, and, where required, on the basis of your consent (for example, certain marketing and analytics cookies). You may withdraw consent at any time where processing is based on it.

6. AI processing

To generate Courses and provide AI-enabled features, course topics, prompts, uploaded or entered materials, and related text you submit may be transmitted to third-party AI, translation, embedding, and text-to-speech providers. Those providers process information on our behalf or otherwise under the terms applicable to the relevant service. We take reasonable steps to use providers and configurations appropriate for the service and to protect personal data in accordance with applicable law. You should not include sensitive personal data, confidential information, or personal data relating to another person in a Course prompt or other AI input unless you have a lawful basis and all necessary permissions to do so. AI-generated output may reproduce or infer information contained in your input, so you should review inputs before submitting them.

7. Cookies and analytics

We use cookies and similar technologies that are necessary for the Platform to function, and — where enabled — analytics and marketing pixels (which may include Google Analytics, Meta, TikTok, Snapchat, and LinkedIn). These help us understand usage and measure campaigns. Non-essential analytics and marketing cookies load only after you accept them in our cookie banner; you can change your choice at any time using "Cookie preferences" in the site footer, or through your browser settings. Necessary cookies (such as your session, security, and preference cookies) are always active.

8. Who we share it with

We do not sell your personal data. We share it with service providers ("processors") who help us run the Platform, under contracts that require them to protect it and use it only for us. These include, for example: cloud hosting and database/storage (Supabase; Vercel), payment processing (MyFatoorah), email delivery (Resend), AI generation and text-to-speech (Anthropic; Google/Gemini), phone verification (Twilio), and analytics/marketing providers where enabled. We may also share data to comply with law, enforce our terms, or protect rights, safety, and security, and in connection with a business transfer.

9. International transfers

Some of our service providers may process or store personal data outside the Kingdom of Bahrain. International transfers are made only where permitted under applicable Bahrain data-protection law. Depending on the destination and circumstances, this may include transfers to countries or territories recognised as providing an adequate level of protection, transfers made under an authorisation or other legally permitted safeguard, or transfers relying on an applicable statutory exception such as the data subject's consent or a transfer necessary for the performance of a contract, where legally available. We take reasonable steps to ensure that transferred personal data remains appropriately protected.

10. Data retention

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, to provide and secure the Platform, to resolve disputes and enforce agreements, and to meet legal, tax, accounting, fraud-prevention, and regulatory requirements. Retention periods vary by category of data. For example, account data may be retained while your account remains active; transaction, payout, tax, and ledger records may be retained for the period required by applicable law; and security or support records may be retained for a reasonable period after the relevant matter is closed. When information is no longer required, we delete or anonymise it, unless continued retention is required or permitted by law.

11. Security

We use technical and organisational measures designed to protect personal data, including encryption of sensitive credentials and access controls. No method of transmission or storage is completely secure; you are responsible for keeping your account credentials confidential.

12. Your rights and choices

Subject to applicable law and any lawful exceptions, you may have rights to:

• access personal data we hold about you and obtain information about how it is processed;
• request correction, blocking, erasure, or other action in relation to inaccurate or unlawfully processed personal data;
• object to or request restriction of certain processing where the law provides that right;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• opt out of non-essential marketing communications using available account settings or the unsubscribe link; and
• exercise any other data-subject right available under applicable Bahrain data-protection law. Where a particular right, such as portability, applies under applicable law or regulation, we will honour it in accordance with those requirements. We may need to verify your identity before acting on a request.

13. Children

The Platform is not directed to children. You must meet the minimum age in our Terms to use it. We do not knowingly collect personal data from children below that age; if you believe we have, please contact us so we can address it.

14. Third-party links

The Platform may link to third-party sites or services that we do not control. Their privacy practices are governed by their own policies, which we encourage you to review.

15. Changes and contact

We may update this Privacy Policy from time to time and will post the updated version here with a new effective date. For privacy questions, to exercise your rights, or to raise a concern, contact us using the details below. You may also have the right to lodge a complaint with the competent data-protection authority in the Kingdom of Bahrain.