Mollim for Electronic Marketing Service operates the Mollim platform and acts as the data controller that determines the purposes and means of processing personal data through the app, website, and related services.

This policy explains the data we collect about students, teachers, and visitors; where it comes from; why we use it; who may receive it; how long we retain it; and the rights available to data subjects.

This policy applies to the Mollim app and website and to account registration, booking, payment, support, reviews, notifications, and other platform-related services.

We obtain data from:

• You directly when you register, complete a profile, upload documents, or contact support.
• Your use of the platform, including login, booking, payment, interaction, and technical error records.
• Another teacher or student when needed to fulfil a booking or handle a complaint or dispute.
• Login, payment, notification, analytics, and other service providers to the extent necessary to provide the service.

A. Account and Verification Data

• Name, email address, phone number, account type, preferred language, and profile picture.
• Login, verification, and security data, including hashed passwords, verification status, login attempts, and Google, Facebook, or Apple login identifiers when those options are used.

B. Teacher Data

• Date of birth, gender, governorate and city, biography, experience, specializations, education levels, schedules, prices, and professional or social links.
• Verification materials such as a national ID image, a photo holding the ID, certificates and qualifications, and verification review status and outcome.

C. Student Data

• Date of birth, gender, governorate and city, education level and year, preferred subjects, and educational profile information.

D. Booking, Payment, and Wallet Data

• Lesson and package details, schedules, attendance, cancellation, refunds, reviews, and complaints.
• Transaction value, currency, payment method and status, provider transaction identifiers, and settlement and payout records.
• Bank account or electronic wallet details needed to pay teacher earnings.

E. Content and Support Data

• Reviews, complaints, support requests, correspondence, attachments, and the optional reason supplied with an account deletion request.

F. Technical and Device Data

• IP address, device type, operating system and app version, session and request identifiers, usage times, and error, performance, and security logs.
• Notification token, device type and name, and subscribed topics when notifications are enabled.
• Cookies or similar identifiers used to operate the website, secure sessions, and measure performance.

• Create accounts, authenticate users, verify identity, and manage profiles.
• Display teachers and manage bookings, schedules, attendance, reviews, and complaints.
• Process payments, refunds, settlements, and teacher payouts, and prevent fraud.
• Send verification, security, booking, support, and operational notifications.
• Personalize the experience, such as language, education level, and relevant subjects.
• Measure platform performance, diagnose errors, and improve quality, reliability, and security.
• Enforce the terms, investigate misuse, resolve disputes, and protect the rights of the platform and its users.
• Comply with legal, regulatory, accounting, tax, and competent-authority requirements.

We process data only where an appropriate legal basis is available, which may include:

• Contractual necessity: where processing is needed to create an account, fulfil a booking or payment, or provide support.
• Consent: for optional processing, direct marketing, optional notifications, or sensitive-data processing where consent is required.
• Legal obligation: to keep required records, disclose information to competent authorities, or comply with a judgment or lawful order.
• Legitimate interests: to secure the platform, prevent fraud, improve services, and manage claims, provided those interests do not override your rights and freedoms.
• Establishing or defending legal rights: when handling a complaint, dispute, or legal claim.

Withdrawing consent does not affect processing lawfully performed before withdrawal. We may continue processing some data where another legal basis applies.

We may use the following services when enabled:

• Google Analytics for Firebase / GA4: to measure usage, booking, payment, and refund events. Limited transaction metadata and technical account identifiers may be sent, and server-side measurements disable personalized advertising.
• Firebase Cloud Messaging: to deliver notifications using a device token and subscription preferences.
• Sentry: to record crashes, errors, and performance diagnostics with default personal-data collection disabled. Reports may contain a technical user identifier and a sanitized request path.
• Microsoft Clarity: to understand interface use through session recordings or interaction heatmaps where enabled on an interface you use.

You can manage notifications through app or device settings and cookies through browser settings. Some cookies or identifiers are necessary for login and security and cannot be disabled without affecting the service.

We may share the minimum data necessary with:

• Students and teachers: to fulfil a booking, manage the schedule, and communicate as needed for the lesson, without sharing financial details or verification documents.
• Payment and payout providers: such as Fawaterak, to process collections, refunds, payouts, and transaction status checks.
• Hosting and storage providers: including database services and Cloudinary for uploaded images, attachments, and documents.
• Communication providers: such as Firebase for notifications and Resend for email.
• Analytics and security providers: such as Google Analytics, Sentry, and Microsoft Clarity when enabled.
• Advisers and support providers: where needed for accounting, technical support, or legal services and subject to appropriate confidentiality obligations.
• Government and judicial authorities: where required by law, in response to a valid order, or to protect rights and prevent fraud or crime.
• Corporate transactions: in a merger, restructuring, or business transfer, subject to continued data protection and notice where required.

Some service providers may process data in other countries or through distributed cloud infrastructure. Where an international transfer occurs, we apply the requirements, safeguards, and permits or approvals required by the law, Executive Regulations, and Personal Data Protection Center decisions, and limit the transfer to data necessary for the stated purpose.

• We retain account data while the account is active and then for as long as needed to complete settlements, respond to complaints, meet legal obligations, and protect legal rights.
• When an account deletion request is accepted, the account is deactivated, active sessions are revoked, associated notification tokens are deleted, and deletion procedures are scheduled after required reviews and settlements.
• Transaction, payment, refund, complaint, and security records may be retained for periods required by law or needed for claims and fraud prevention, even after account deletion.
• Limited copies may remain in backups until replaced through the normal backup cycle, with use restricted to restoration and security.
• Aggregated or anonymized data that no longer identifies an individual may be retained for statistics and service improvement.

• We apply technical and organizational measures appropriate to the data, including access controls, password hashing, secure communications, logging and monitoring, backups, and data minimization.
• Access to personal data is limited to those who need it for their work, with access review and action taken where misuse is suspected.
• No electronic system is completely secure, so we review and update safeguards according to risk and technical developments.
• If a personal data breach occurs, we take containment, investigation, and remediation steps and notify the Personal Data Protection Center and affected data subjects where and within the time required by law.

Subject to legal exceptions and mandatory retention, you may request:

• Information about the data we process, the processing purposes, and potential recipients.
• Access to and a copy of your personal data.
• Correction of inaccurate data or completion of incomplete data.
• Erasure of data or restriction of processing where legal conditions are met.
• Withdrawal of consent or objection to processing based on consent or legitimate interests, and objection to direct marketing at any time.
• Submission of a complaint to us or to the Personal Data Protection Center.

We may request information to verify your identity before fulfilling a request and will respond within the legally required period. If a request cannot be fulfilled in whole or in part, we will explain the reason where the law permits.

• We send necessary operational messages, such as account verification, booking, payment, security, and support messages, because they are required to provide the service.
• We send electronic marketing only in accordance with applicable consent and legal requirements. Marketing messages identify the sender and purpose and provide a free and easy opt-out method.
• You may withdraw marketing consent or change notification preferences at any time without affecting necessary operational messages.

The platform may contain links, payment pages, or independent services operated by third parties. Data you provide directly to those parties is governed by their privacy policies. We encourage you to review those policies; this policy does not cover websites or services we do not control.

We may update this policy to reflect service, legal, or processing changes. We will publish the updated version with its effective date and provide appropriate in-app or email notice of material changes. If a change requires new consent, we will not rely on prior consent alone.

To exercise your rights, ask a privacy question, or report a data-related incident, contact Mollim's privacy contact:

support@mail.mollim.cloud