This is a preliminary version pending legal review.
Privacy Policy
Last updated: July 9, 2026
Introduction
This Privacy Policy explains how Afham ("the Platform", "we") collects, uses, and protects personal data when you use our online educational services, built for elementary and secondary students in the Kingdom of Saudi Arabia.
By using the Platform, you agree to the practices described in this Policy.
Who we are
Afham is an online educational platform that helps students understand the Saudi Ministry of Education curriculum by answering their questions based exclusively on the text of official textbooks, and helps teachers generate worksheets and exams built on the same curriculum. Every registered user on the Platform is an adult; children never have independent accounts — see "Children's data" below.
Data we collect
We collect only the following categories of data, all of which are necessary to provide the service:
- Account data
- Email address, name, and password (stored hashed with bcrypt and never saved in plain text), and account type (parent or teacher).
- Child profiles
- For parent accounts only: each child's name and grade level, entered by the parent when creating a "child profile" under their own account. The child never creates the profile and never has separate login credentials.
- Questions asked
- The text of each question and the generated answer are stored in a history tied to the child profile the question was asked under (for parent accounts), or in the teacher's usage history (for teacher accounts).
- Teacher-generated documents
- Worksheets and exams that teachers request, including the inputs they specify such as subject, grade, and question count and type.
How we use your data
We use the data above solely for the following purposes: operating and authenticating your account; generating accurate answers to your child's questions or teacher documents grounded in official textbooks; showing the parent or teacher their past question history within their own account; improving answer quality and preventing abuse; and contacting you about your account when necessary.
We never use your data for advertising purposes, and we show no ads anywhere on the Platform.
AI processing and cross-border data transfer
To generate answers and documents, question text along with the relevant textbook excerpts are sent to third-party AI processing providers we contract with for this purpose. Some of these providers are located outside the Kingdom of Saudi Arabia, meaning this data may be processed on servers in other countries.
We contract with these providers under terms that require them to process data solely to generate the requested answer or document, and prohibit them from using it for any other purpose such as training their general models or sharing it with other parties. We never send any data that identifies your child, such as their name, to these providers — only the question text and the relevant curriculum excerpt are sent.
Children's data and the parent as data controller
No child ever has an independent account on Afham. The adult parent creates a "child profile" — limited to name and grade level — under their own account, and remains the legal and factual data controller for their child's data under this Policy. All creation, editing, and deletion of a child profile happens exclusively through the parent's account.
It is the parent's responsibility to ensure the accuracy of the information they enter about their child, and to ensure the Platform is appropriate for their child's age and grade level.
Data retention
We retain question history and documents for as long as the account remains active. When a parent deletes a specific child profile, that child's question history is permanently and immediately erased and cannot be recovered. When an entire account is deleted — a parent's or a teacher's — all data tied to it, including account data, child profiles, question history, and documents, is permanently erased.
Data security
We apply technical and organizational measures to protect your data, including: hashing passwords with bcrypt so that we ourselves never see your plain-text password; restricting data access to authorized staff for operational purposes only; isolating each account's data from every other account's; and encrypting the connection between your browser and our servers (HTTPS).
That said, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
Your rights under the Personal Data Protection Law
As a resident of the Kingdom of Saudi Arabia, the Personal Data Protection Law (PDPL), issued by the Saudi Data & AI Authority (SDAIA), grants you rights over your data, including:
- Right of access
- You can view your account data, your children's profiles, and their question history at any time from within your account.
- Right of correction
- You can edit your own name or your child's data (name or grade level) directly from your account settings.
- Right of erasure
- You can delete any child's profile from within your account, which permanently erases their question history, or delete your entire account from account settings, which permanently erases all your data and your children's data tied to it.
To exercise any of these rights or for assistance, contact us using the details below.
Third parties
We share your data with only two categories of third parties, and only to the minimum extent needed to provide the service: AI processing providers (see the section above) for the purpose of generating answers and documents; and a payment processor, once paid plans go live, solely to process payment — we never store your card data on our own servers.
We never sell your data to anyone, and we never share it for marketing or advertising purposes.
Cookies
The Platform uses a single functional session cookie to keep you signed in. It is protected with the httpOnly flag so no script can access it, and it is used exclusively for authentication. We use no cookies for tracking, advertising, or marketing analytics.
Contact us
For any question about this Policy or to exercise your data rights, email us at privacy@fahhamni.com.
Changes to this Policy
We may update this Policy from time to time to reflect changes to the service or legal requirements. We will post any material change on this page and update the "last updated" date above; continued use of the Platform after a change is posted constitutes acceptance of it.