Privacy Policy

This policy applies to the Academz marketing website, the vendor consoles, and every academy platform we host on behalf of our customers.

Academz is a multi-tenant Software-as-a-Service learning management system. A single platform serves the vendor (Academz) and thousands of subscribing academies, each running its own isolated space for teachers, staff, and students. This policy describes how personal information flows through that system and who is responsible for it at each stage.

It covers information we handle as the operator of the service. It does not cover the independent practices of the academies that use Academz to run their own institutions, nor the third-party websites, payment gateways, or tools they choose to connect. Where an academy is the party that decides how student data is used, that academy — not Academz — is responsible for its own privacy notice to its learners.

Academz is the company that builds and operates the platform. Depending on the situation, we act in one of two roles, and this distinction decides who is responsible for the data.

Controller

For our own website visitors, account holders, and billing customers, we decide why and how information is used — so we are the data controller.

Processor

For the students and content inside an academy, the academy decides how the data is used and we process it on their instructions — so we are the data processor and the academy is the controller.

This means that if you are a learner on an academy platform, your first point of contact for privacy questions is usually the academy that enrolled you. We support that academy in meeting its obligations, and we hold your data under strict isolation and security controls described below.

We collect only what we need to provide, secure, and improve the service. The categories below describe the kinds of information involved.

Information you provide

• Account details — your name, email address, phone number, and password when you register.
• Academy profile — the name, branding, domain, and settings you configure for your platform.
• Billing information — the plan you choose and the details needed to process a subscription; card numbers are handled by our payment providers, not stored by us.
• Content you create — courses, lessons, quizzes, media, certificates, and messages you author on the platform.
• Support communications — the messages, tickets, and attachments you send when you contact us.

Information collected automatically

• Usage data — the pages you view, features you use, and actions you take, so we can keep the service reliable.
• Device and log data — IP address, browser type, operating system, and timestamps, recorded for security and troubleshooting.
• Cookies and similar technologies — as described in our Cookie Policy, used to keep you signed in and to understand aggregate usage.

Information from third parties

When you sign in with a third-party provider, pay through a gateway, or an academy imports your record, we receive the limited information those parties share with us to complete the action you requested.

We use the information we collect for the following purposes, and for no undisclosed ones:

• To provide the platform — create your account, host your academy, and deliver the features of your plan.
• To process payments — manage subscriptions, invoices, renewals, and the payouts an academy earns from its sales.
• To secure the service — detect fraud, prevent abuse, enforce isolation between tenants, and investigate incidents.
• To support you — answer questions, resolve tickets, and send essential service notices about your account.
• To improve the product — understand which features help and fix what does not, using aggregated and de-identified data wherever possible.
• To comply with the law — meet tax, accounting, and legal obligations, and respond to lawful requests.

We do not use your content to train advertising profiles, and we never sell personal information. Marketing emails are sent only where permitted, and every one includes a one-click unsubscribe.

Where data-protection law such as the GDPR applies, we rely on one of the following lawful bases each time we process personal information:

Contract

Processing needed to deliver the service you signed up for — running your academy, billing your plan, and giving you support.

Legitimate interests

Keeping the platform secure, preventing abuse, and improving the product, balanced against your rights and expectations.

Consent

For optional cookies and marketing where consent is required; you can withdraw it at any time without affecting the core service.

Legal obligation

Retaining invoices and tax records, and responding to lawful requests from authorities.

Where we act as a processor for an academy, the academy is responsible for establishing the lawful basis for processing its learners' data, and we act only on its documented instructions.

We use cookies and similar technologies to keep you signed in, remember your language and theme, protect against cross-site request forgery, and understand aggregate usage so we can improve the platform. We do not use advertising cookies that follow you across other websites.

You can control non-essential cookies through your browser and through the choices we offer. Blocking strictly necessary cookies may stop parts of the platform from working.

We share personal information only in the limited circumstances below, and only to the extent necessary:

• Sub-processors — vetted vendors that host our infrastructure, send email, process payments, and provide analytics, each bound by a data-processing agreement.
• Your academy — if you are a learner, the academy that enrolled you can see the records it needs to run your enrollment, exactly as it could in a classroom.
• Legal and safety — where we are required by law, or where sharing is necessary to protect the rights, safety, or property of users and the public.
• Business transfers — if the company is involved in a merger or acquisition, data may transfer as part of that transaction, subject to this policy.

We do not share personal information with data brokers or advertisers. Every sub-processor is held to confidentiality and security obligations at least as protective as those in this policy, and we maintain an up-to-date list available on request.

Academz operates globally, and our sub-processors may be located in different countries. When we transfer personal information across borders, we use recognized safeguards — such as standard contractual clauses and adequacy decisions — so your data keeps a comparable level of protection wherever it is handled.

Enterprise academies with data-residency requirements can arrange a dedicated database in a specific region; the business logic is unchanged, only the location of storage differs. Contact our team to discuss residency options.

We keep personal information only for as long as we need it for the purpose it was collected, and then we delete or anonymize it. Retention depends on the type of data:

When an academy closes, we provide a window to export data before it is permanently removed from active systems, subject to any records we must retain by law. Backups are cycled and expire on their own schedule.

Security is built into the platform, not added on top. We apply layered technical and organizational measures to protect personal information against loss, misuse, and unauthorized access:

• Encryption in transit — every connection is protected with modern TLS.
• Tenant isolation — a data layer that enforces the boundary between academies on every read and write, not by remembering a filter.
• Access control — role-based permissions, least-privilege staff access, and audited administrative actions.
• Payment safety — card data is handled by PCI-compliant providers; we never store full card numbers.
• Monitoring — continuous logging, error reporting, and rate limiting on sensitive endpoints such as login and payment.

Subject to the law that applies to you, you have rights over your personal information. You can:

1. Access — ask for a copy of the personal information we hold about you.
2. Rectify — correct information that is inaccurate or incomplete.
3. Erase — ask us to delete your information where there is no overriding reason to keep it.
4. Restrict — ask us to pause certain processing while a concern is resolved.
5. Port — receive your data in a structured, machine-readable format, or have it sent onward.
6. Object — object to processing based on our legitimate interests, and opt out of marketing at any time.

To exercise a right, contact us using the details in the final clause. We will verify your identity and respond within the timeframe the law requires. If you are a learner on an academy platform, we may direct your request to that academy as the controller of your data. You also have the right to complain to your local data-protection authority.

Academz is a tool for institutions, and much of the learning it supports involves students who may be minors. We do not knowingly collect personal information directly from children through our own marketing site.

Where an academy enrolls students who are minors, that academy is the controller of the students' data and is responsible for obtaining any consent the law requires from a parent or guardian. We process that data on the academy's instructions and protect it with the same isolation and security controls as all other data on the platform.

Isolation is the core promise of a multi-tenant platform, and we treat it as a security control rather than a convenience. Every academy operates in its own tenant, and the boundary is enforced at the data layer for every query.

• One academy can never see, query, or change another academy's students, staff, content, or records.
• Cache, storage, and background jobs are namespaced per academy, so nothing leaks between tenants.
• An attempt to reach another tenant's data is treated as if the record does not exist — it is refused, not merely hidden.

Enterprise academies can take isolation further with a dedicated database, keeping their data physically separate from the shared platform while using exactly the same features.

We may update this Privacy Policy as the platform evolves or the law changes. When we make a material change, we will update the version and effective date at the top of this page and, where appropriate, notify you by email or an in-app notice before it takes effect.

Your continued use of Academz after an update takes effect means you accept the revised policy. We keep previous versions on record and can provide them on request.

If you have any question about this policy, want to exercise a right, or wish to raise a concern, reach our privacy team using any of the channels below. We aim to respond promptly and to resolve concerns directly.

• Privacy & data protection [email protected]
• Legal team [email protected]
• General support [email protected]
• Operated by Academz — Cairo · Riyadh · Dubai