Privacy Policy

Last updated: October 13, 2026

This Privacy Policy explains how [Company legal name] ("Um Al-Lughat", "we", "us") collects, uses, shares and protects personal data when you use the Um Al-Lughat student app, the Um Al-Lughat teacher app and the website ummal.sa (together, the "Services").

We process personal data in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. By using the Services you acknowledge that you have read this policy.

1. Who we are

The controller of your personal data is [Company legal name], Commercial Registration [Commercial Registration number], [Registered address], Riyadh, Kingdom of Saudi Arabia.

For any privacy question or request, contact us at info@um-allughat.com.

2. Personal data we collect

Account data (all users):

Name, email address and password. The password is stored only as a one-way hash.
If you choose to sign in with Google: your Google account ID, name and email address.
Preferred language and account status.

Student profile:

Profile photo, Arabic level, reasons for learning Arabic and preferred learning style.
Teacher preferences such as teacher gender and country.
Nationality, native and second languages, countries you plan to travel to, and time zone.

Teacher application and profile:

Phone number, gender, nationality, current workplace and job title.
Bio, skills, teaching methods, qualifications, field of study, experience and languages.
Documents you upload, such as certificates, and your profile photo.
Availability, ratings and reviews.
For payouts: bank name, account holder name and IBAN.

Lessons and activity: bookings, free trial requests, lesson times and status, cancellations and their reasons, reviews and ratings, subscriptions and packages, and for teachers, wallet and withdrawal records.

Payments: amount, package, promo code, status, date and payment method type. Card details are entered on the page of our payment provider and are processed by it. We do not receive or store your full card number.

Video lessons: live audio and video are transmitted through our video provider so that the lesson can take place. We do not record lessons.

Messages to us: when you use the contact form or in-app support, we receive your name, email, phone number if given, subject and message.

Device and technical data: the push notification token and platform of your device, and server logs such as IP address, request times and errors, which we keep for security.

Website analytics: the website uses first-party analytics only. We record pages visited, the referring site, campaign tags, language, a random session ID kept in your browser's session storage until you close the tab, and a hashed form of your IP address, never the IP address itself. Your language choice is kept in your browser's local storage. The website does not use advertising cookies or third-party trackers.

3. How we use your data

To create and manage your account and verify your email address.
To match students with teachers, show teacher profiles and schedule, run and manage lessons.
To review teacher applications and verify qualifications.
To process payments, subscriptions, refunds and teacher payouts.
To send verification codes, service emails and push notifications such as lesson reminders and booking changes.
To answer your requests and provide support.
To keep the Services safe, prevent fraud and abuse, and secure our systems.
To improve the Services using aggregated statistics.
To comply with legal obligations.

4. Legal bases

We process personal data because it is necessary to provide the Services you request under our Terms & Conditions, because you have given consent, for example to optional profile details and push notifications, because of our legitimate interests in security and improving the Services, or because the law requires it, for example accounting and tax records.

Where processing relies on consent, you may withdraw it at any time. This does not affect processing that took place before.

6. International transfers

Some of our service providers process data outside the Kingdom of Saudi Arabia. We transfer personal data abroad only as permitted by the PDPL and with appropriate safeguards.

7. How long we keep data

Account and profile data: while your account is active, and until it is deleted as described in section 8.
Payment, subscription and wallet records: for the period required by Saudi accounting and tax law.
Server logs: [90 days].
Website analytics: [13 months].
Contact and support messages: [24 months] after the request is closed.

8. Deleting your account

You can request deletion at any time in the app from the menu, under Delete Account, or by emailing info@um-allughat.com.

While the request is pending, your account is locked and you can cancel the request from the app. Once the request is approved, normally within [30 days], we:

cancel your future lessons and active subscriptions;
sign you out on every device and remove your notification token;
delete or anonymise your name, email address, photo, phone number, bio and other profile details.

We keep anonymised lesson, payment and wallet records, and a one-way hash of your email address, to meet accounting obligations and prevent fraud.

9. Your rights

Under the PDPL you have the right to:

be informed about how your personal data is processed;
access your personal data and obtain a copy in a readable format;
request correction of inaccurate or incomplete data;
request destruction of data that is no longer needed;
withdraw your consent.

To exercise these rights, contact info@um-allughat.com. We may need to verify your identity, and we will reply within the period set by law. You may also lodge a complaint with the Saudi Data & AI Authority (SDAIA).

10. Security

We protect personal data with encrypted connections (HTTPS), one-way hashing of passwords, secure storage of sign-in tokens on your device and access limited to authorised staff. No system is completely secure, so please keep your password private and tell us at once if you suspect unauthorised access.

11. Children

Users under 18 may use the Services only with the consent and supervision of a parent or guardian, who creates and manages the account. [Confirm the minimum age and whether children may book lessons.] If we learn that we collected data from a child without such consent, we will delete it.

12. Device permissions

The apps ask for the camera and microphone to run video lessons, for photos to set a profile picture or upload documents, and for notifications to send reminders. You can change these permissions at any time in your device settings, but some features will stop working without them.

13. Changes to this policy

We may update this policy. The date at the top shows the latest version. If we make significant changes, we will tell you in the app or by email before they take effect.

14. Contact us

[Company legal name], [Registered address], Riyadh, Kingdom of Saudi Arabia. Email: info@um-allughat.com.