Privacy policy
This policy explains what personal data Masar Deutsch collects, why, who receives it, how long we keep it and what rights you have. We have tried to keep it short and exact: it describes what the service really does.
In short
- We keep only what we need to run your account and your course: your email, your name, a scrambled form of your password, your learning progress and some security records.
- We do not sell your data. There are no adverts, no third-party analytics and no tracking cookies. We count how the service is used only as first-party daily totals that contain no personal data (section 2, "First-party statistics").
- Recordings of your voice stay on your device. They are not uploaded.
- If you get a Certificate of Completion, anyone with its check link sees only your initials (or your full name, if you choose), the level, the date and whether it is valid. You can delete it at any time.
- When you use the AI tutor, the text you send goes to our AI provider to get an answer. We do not keep that text.
- Card details are handled by our payment provider (Paymob; Paddle only if we offer payments in US dollars). We never see your full card number.
- You can download or delete your data yourself at any time in the app (Account). You can also ask us to see, correct, download or delete it: write to [email protected].
- 1. Who we are
- 2. What we collect
- 3. Microphone and speech
- 4. On your device
- 5. Purposes and legal bases
- 6. Who receives it
- 7. International transfers
- 8. How long we keep it
- 9. Security
- 10. Your rights
- 11. Age
- 12. Laws
- 13. Changes and contact
1. Who we are
Masar Deutsch (مسار) is run by the business that runs Masar Deutsch (our company details will be published here before paid sales open) ("we", "us"). We decide how and why your personal data is used, so we are the controller of that data.
Privacy contact: [email protected].
This policy covers the website and web app at https://masar-deutsch.com.
2. What we collect
You join Masar Deutsch with an invite code or, when self-serve sign-up is open, by creating an account yourself and confirming your email address. We collect information from you when you create your account and use the course, from the staff member who invites you (if any: your teacher and access dates), and automatically when your browser connects to the service.
| Information | What exactly |
|---|---|
| Account | Email address, the name you give, your role (learner, teacher, admin or owner), your plan, your teacher (if any), your access end date, whether the account is active, and when it was created, changed and last signed in to. |
| Password | Never stored as you type it. We keep only a slow, salted one-way hash (PBKDF2-SHA256, 600,000 rounds). Nobody at Masar Deutsch can read your password. When you choose a new password, we check it against the Pwned Passwords list of passwords exposed in known data breaches (see section 6): only the first 5 characters of a one-way SHA-1 hash of the password leave our server, never the password itself, and nothing about the check is stored. |
| Password reset links | When you ask for a reset link: a keyed hash of the link (not the link itself), the time it was made, used or expired (it works once, for 24 hours) and a hashed IP address. We send the link only to the email address on the account, and we give the same answer whether or not an account exists. |
| Sign-in sessions | A hash of your sign-in token (not the token itself), a hashed form of your IP address, your browser's user-agent string (for example "Chrome on Android"), and the session's start, last-use and end times. |
| Security records | An audit log of account events (for example sign-ins, failed sign-ins, password changes, invite codes used, changes made by staff, blocked requests), with the time, the account involved and a hashed IP address. Counters of failed attempts, keyed by a hashed IP address or hashed email. Invite and reset codes, stored only as hashes. Your agreement to the Terms of use and this policy, when you signed up and each time they change: the version, the date and a hashed IP address. |
| Learning progress | The words and sentences you have studied, your review schedule, units, situations, exam and placement results, your personal Mistake Map, First 30 Days checklist ticks, offline answer queue, downloaded pack metadata, points, streak and app settings. If you join a teacher's class (Teacher Mode), your class membership, assigned tasks, writing submissions, teacher corrections and live-class answers are also stored with your account (never any residence-status data). It is saved on the server so it follows you to any device. |
| Placement test and access | Your Masar Deutsch Placement Test: the questions you were shown, your answers and the time taken, your level, score, sub-scores and the minutes a day you chose. Your 7-day trial end, and the levels open to you with their dates and how they were opened (purchase, Sprint pass or monthly pass, staff grant). Your teacher and our staff can see your result. If you create a share link, anyone with the link sees your first name, level, score and the date until you switch it off. |
| Price region (storefront) | The price region you choose once: Egypt and the Gulf (EGP) or Germany (EUR), whether the one check for the Germany free tier passed (yes or no) and when you chose. For that check our server compares your choice once with the country our hosting provider reports for that one request; we store only the yes or no, never your country, your IP address or any residence status. |
| Certificates of Completion | To check that you completed a level, the server keeps its own records: each unit or Foundations module you passed (which one, your score and the date), and for each sitting of a mock exam the marks it gave the Reading and Listening parts and the time (your answers are marked when they arrive and are not kept). If you ask for a certificate: its random id, the level, the name on your account at that moment, the units completed, your best level-exam score, the date, whether its check page shows your full name or only your initials, and, if we revoke it, the date, who revoked it and why. The check page (the address printed on the certificate, /verify/ and the id) is public to anyone who has the link and shows only your initials or full name, the level, the date and whether it is valid or revoked. It is not listed by search engines and it never shows your email, scores or progress. |
| AI tutor use | How many AI tutor requests you made each day. The text you send to the tutor and its answers are not stored on our servers (see section 6). |
| First-party statistics | To see how well the course works, our own server counts a few events as daily totals only: homepage views, placement tests started and finished, sign-ups, first lessons completed, Trial learners active on day 3, checkouts started, purchases and refunds. We also count, in the same way and by source only (YouTube, Instagram, TikTok, WhatsApp or Facebook), visits through our short campaign links (for example masar-deutsch.com/yt) and the placement tests started and finished after such a visit. Each count is a number for the day (for example "12 sign-ups on 6 October"). It contains no name, email, account id, IP address, cookie or device detail, and nothing is sent to any third party. Our staff also see weekly totals and how many learners keep studying after 7 and 30 days, worked out from the account and activity records described in this section; nothing extra is collected for that. |
| Visit statistics | When a page of the website or the app is opened, our own server adds it to aggregate daily visit statistics: page views per page (without the query part of the address), an estimate of the number of different visitors, the country (taken from the connection), the type of device (phone, tablet or desktop) and where the visitor came from (the website name of the referring site, such as YouTube, Facebook, Instagram, WhatsApp, TikTok, Google or Bing, or "direct"). Only the totals are kept, for up to 25 months. We use no cookies and no script on your device, we do not keep your IP address, and we do not identify anyone. To count a visitor only once a day, the server makes a short code from your connection details and browser type together with a secret key that changes every day; this code cannot be reversed or linked from one day to the next, it is used only to check whether the visitor was already counted that day, and it is not stored for more than 48 hours. Bots and our own staff are not counted. |
| Payments (when you buy a plan) | Your orders: plan bought, amount, currency, VAT included, date, status, receipt number, the provider and its transaction reference, the type of payment (card, mobile wallet or kiosk) and any refund or chargeback. For payments in Egyptian pounds we pass your name, email and the mobile number you enter to Paymob to create the payment; we do not keep the mobile number. We never receive or store card numbers, card security codes or wallet PINs. |
| Self-serve sign-up and free trial | The name, email and password (hashed) you enter at sign-up, kept for up to 24 hours until you open the confirmation link we email you (we keep only a keyed hash of that link). The result of the bot check on the sign-up form (Cloudflare Turnstile). When your trial starts (at your first sign-in): its start and end, and a keyed one-way hash of your normalised email address that lets us offer one free trial per email address. |
| Bank transfer orders (bank transfer is not currently offered; this applies only if we offer it later) | Each order: its reference, what you chose, the price and currency, the version of the terms you accepted and of the payment details shown to you, and its status. What you send us as proof of a transfer: the receipt file (a photo or PDF), the transfer reference, date and payer name, and any note. Please cover balances and other transactions before uploading: we only need the transfer. Our staff's reconciliation record: the bank's transaction reference, the amount, currency and date received, who checked it and when. We never ask for bank passwords, PINs or one-time codes. |
| Support requests and the support assistant | Your support requests and our replies, their category and status, the order they concern, and (only if you tick it) the lesson and page you were on and your browser type; recordings and AI tutor conversations are never attached. Visitors' enquiries: the name, email and/or phone you give, and whether you also asked for news (a separate choice, off unless ticked). Questions you ask the automated support assistant are not stored unless you choose to include the conversation in a support request. Our staff may add private notes to your record. |
| Waitlist | While sign-up is closed, you can join the waitlist: the email address or WhatsApp number you give, the level you prefer, the language of the page, the time and wording of your agreement, the page you came from and any campaign tags in its address (utm_source, utm_medium, utm_campaign, utm_term, utm_content), and a hashed IP address. You can also leave your email address or WhatsApp number on the result page of the free placement test on our website: it is kept in the same way, with the level from your result and the campaign source of your visit, if any. We use it only to tell you when sign-up opens. |
| Free placement test on our website (no account) | For each attempt: the questions you were shown, your answers and the time taken, the result (level, score and sub-scores), the minutes a day you chose, the language of the page, the start, deadline and finish times, a hashed IP address (for abuse limits only) and a hash of the attempt token. Your browser keeps the attempt token in its session storage so that a reload can continue the test. No name or email is asked for. Attempts are deleted automatically once they are more than 30 days old (the clean-up runs when a new test is started). |
| Free sample on our website (no account) | If you ask for AI feedback on the sample writing task, your text is sent to our AI provider to get an answer and is not stored by us. A daily counter keyed by a hashed IP address limits the number of checks (2 a day). |
| Service emails | A log of the service emails we send you (for example the sign-up link, a password reset link, trial started, receipt received, levels active, a reply to your support request): the type, address, time and whether it was delivered. |
| Messages to us | What you write when you contact us, and our reply. |
We do not ask for, and ask you not to send us, sensitive data such as health, religious or financial details. Please do not type such details into the AI tutor or into writing tasks.
Placement test: writing and speaking. The placement test (in the app and on our website) ends with a short writing task and an optional speaking task. What you write, and the text of what you say, are marked by our AI provider (Cloudflare Workers AI) and kept with your attempt for 30 days, then deleted (your level and sub-scores stay with your result). If you record an answer, the recording is sent to our server only to be turned into text (Cloudflare Workers AI speech recognition) and is deleted as soon as that is done: we never store it. Speaking is optional; you can skip it.
Automatic error reports. When something goes wrong in the app or on our website (for example a script error or a request to our server that fails), your browser sends us a short report so that we can fix the fault. It holds the kind of fault, a scrubbed error message (email addresses, long numbers and codes removed), where in our code it happened, the page without its query string, your browser family and version, the operating system, whether the device is a mobile or a desktop, a screen size band and the page language. It holds no account identifier, no email address, no IP address or IP hash, no cookie and nothing you wrote or said in the course. A report is kept for 30 days after the fault last happened, and we use reports only to fix faults.
3. Microphone and speech
- Record and compare. When you press Record, the app records your voice so you can play it back next to the model. The recording stays in your browser's memory on your device, is never uploaded to us, and is gone when you leave the page.
- Speaking exercises. Some exercises turn your speech into text using the speech recognition built into your browser. Depending on your browser, the browser maker (for example Google for Chrome, or Apple for Safari) may process that audio on its own servers under its own privacy policy. We do not receive the audio. We receive the text only if you then send it to the AI tutor for feedback.
- Your browser asks your permission before the microphone is used. You can refuse or withdraw it in your browser settings; the rest of the course keeps working.
4. Information kept on your device
To work quickly and offline, the app keeps some information in your browser's storage on your device: a copy of your progress and settings (including your Mistake Map, First 30 Days checklist, offline answer queue and optional PIN-hashed family profiles on a shared phone), drafts of your written answers, small records of where you stopped in a lesson, downloaded offline packs, and course audio it has already played. When you sign out, the app removes everything it keeps for you on the device: the progress copy and settings, family profile PIN hashes, all drafts (unit writing tasks and Read more answers), the small lesson records (where you stopped, and certificate records waiting to be sent) and the level remembered for this browser session. Course audio and offline packs already downloaded may stay in the browser's cache: they are course content, not personal information. You can remove everything at any time by clearing this site's data in your browser. Details: Cookies.
5. Why we use it, and our legal bases
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and run your account; let you sign in; give you the levels in your plan; let your teacher see your progress summary | Account, password hash, sessions, progress | Performing our contract with you (the Terms of use). Where the law in your country requires consent, your consent when you sign up. |
| Save and sync your progress | Progress | Performing our contract with you |
| Check that you completed a level, issue your Certificate of Completion, let the people you give the link to check it, and revoke a certificate obtained by mistake or misuse | Completion records, exam marks, certificates | Performing our contract with you, at your request (you choose to get a certificate and to share its link); our legitimate interest in certificates that can be trusted |
| Provide AI tutor feedback and keep it within daily limits | What you send to the tutor (not stored), daily counts | Performing our contract with you; your choice each time you press an AI tutor button |
| Understand and improve the course and the sign-up process (first-party statistics) | Daily totals with no personal data; weekly retention worked out from account and activity records | Our legitimate interest in improving the service. The totals do not identify anyone. |
| Keep the service secure: stop password guessing, abuse and fraud; investigate problems | Hashed IP addresses, security records, sessions | Our legitimate interest in a secure service, and our legal duty to protect personal data |
| Take payment, issue receipts, handle refunds and keep accounts | Payment records | Performing our contract with you; legal obligations (tax and accounting law) |
| Confirm your email at self-serve sign-up, stop automated sign-ups and offer one free trial per person | Sign-up details, the Turnstile check, the keyed email hash, trial dates | Performing our contract with you (taking steps at your request before it); our legitimate interest in preventing abuse of the free trial |
| Check bank transfers against our bank records and open the levels you bought (only if we offer bank transfer later; it is not currently offered) | Bank transfer orders, receipts you send, the reconciliation record | Performing our contract with you; legal obligations (tax and accounting law). Sending a receipt file is your choice: the transfer reference is enough. |
| Answer questions with the automated support assistant and handle support requests | Your question, reviewed answers, and (when you are signed in and ask about your account) your own trial, level and order status; support requests | Performing our contract with you; our legitimate interest in answering quickly. A person is always available instead. |
| Refuse passwords that appear in known data breaches; send password reset links | The first 5 characters of a one-way hash of a new password (not stored); reset link records, email address | Our legitimate interest and legal duty to keep accounts secure; performing our contract with you |
| Tell you when sign-up opens (waitlist) | Waitlist entry | Your consent, given when you join the waitlist; you can withdraw it at any time by writing to us |
| Answer your messages and requests | Messages, account | Performing our contract; legal obligations (data protection requests) |
| Comply with the law and respond to lawful requests from authorities | Any of the above, as needed | Legal obligation |
Under Egypt's Personal Data Protection Law (Law No. 151 of 2020), these bases correspond to: your consent; processing needed to perform a contract with you or to take steps you ask for before it; processing needed to comply with a legal obligation or an order of a competent authority; and processing needed for us to exercise our legitimate rights, where this does not override your fundamental rights and freedoms.
We do not use your data for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects. The AI tutor's scores and the placement test are learning feedback only.
We do not send marketing messages. Before we ever do, you will have agreed to receive them and we will hold any permit the law requires. If you ticked the box to receive news when you contacted us, we keep that choice until then; you can withdraw it at any time.
6. Who receives your information
Inside Masar Deutsch, our owner and admins can see account details and security records to run the service, and your teacher can see a summary of your progress. They are bound to keep it confidential.
We use these service providers. They act on our instructions (as processors) unless stated otherwise:
Course audio. The German audio of the course is made in advance on our own computer with free open-source speech software (Piper). It contains course text only, never your data, and no speech provider receives anything from us or from you.
| Provider | What they do | Data they handle | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Cloudflare Pages and Workers), the database (Cloudflare D1), network security, the default AI tutor and support assistant model (Cloudflare Workers AI), bot protection on the sign-up, contact, waitlist and free placement test forms (Cloudflare Turnstile), service emails (Cloudflare Email Service) and private storage of payment receipt files (Cloudflare R2 storage, or the database where R2 is not used) | Everything the service stores, every request to the site (including your IP address as it passes through the network), the text you send to the AI tutor or the support assistant, the email address and content of service emails, and receipt files | Cloudflare's global network; the region of the database's main copy will be stated here before paid sales open; AI requests are processed in Cloudflare locations that Cloudflare chooses, which may be outside Egypt |
| Paymob (when online payment is open) | Card and mobile-wallet payments in Egyptian pounds (EGP) | Your payment details, and the name, email and phone number entered at checkout | Egypt, under Paymob's own terms and privacy notice |
| Paddle.com Market Limited (only if we offer payments in US dollars; not offered now) | Payments in US dollars. Paddle is the merchant of record: it sells the plan to you, charges any sales tax, and handles invoices and payment disputes. For that sale Paddle acts as a separate controller under its own privacy notice. | Your payment details, name, email, billing country and address details Paddle asks for | United Kingdom, and Paddle's own providers, as described in Paddle's privacy notice |
| Have I Been Pwned (Pwned Passwords range service, operated by Superlative Security Pty Ltd) | Checks whether a new password appears in known data breaches | Only the first 5 characters of a one-way SHA-1 hash of the new password, sent from our server (never the password, your email or your IP address). If the service cannot be reached, the password is accepted and you are told it could not be checked. | Served through Cloudflare's global network |
| Anthropic, PBC (only if we switch the AI tutor or the support assistant to Claude) | Alternative AI model | The text you send to the AI tutor, with the lesson context and your level; or your question to the support assistant with reviewed answers and, if you ask about your account, a short summary of your own trial, level and order status (never your name, email, password or receipts) | United States |
If you choose to contact us on WhatsApp, your messages and phone number are handled by WhatsApp (part of Meta) under its own terms and privacy policy, as well as by us. Emails you send to our addresses are forwarded by Cloudflare Email Routing to the mailbox in which we read them, held with our email provider.
The font the app uses (Readex Pro, for English and Arabic) is served from our own site, so no font provider receives your IP address.
The AI tutor receives only the text of the task you choose (for example your writing, a speech transcript, your question or a role-play message, with the recent turns of the same role-play), the lesson context and your level. We do not send your name or email with it. What our AI provider's terms say about keeping this text and using it for training will be stated here before paid sales open.
We may also share information when the law requires it (for example a court order), to protect people's safety or our legal rights, or with a buyer if the business is sold, under this policy. We do not sell personal data.
7. International transfers
Our providers process data in several countries, so your data may be stored or processed outside Egypt, the UAE or your own country, including in the European Union, the United Kingdom and the United States. We use providers that commit by contract to protect personal data (for example Cloudflare's data processing addendum, which includes the European Commission's standard contractual clauses).
Egyptian law (Law No. 151 of 2020) allows personal data to leave Egypt only on the conditions it sets, which can include a licence or permit from the Personal Data Protection Centre or your express consent; UAE law (Federal Decree-Law No. 45 of 2021) sets its own conditions. We transfer your data abroad only where one of those conditions is met. The status of any transfer licence or permit from Egypt's Personal Data Protection Centre will be stated here once it is known.
8. How long we keep it
An automatic clean-up applies these periods. It runs at most once an hour while people are using the service, and the owner can also start it by hand.
| Information | How long |
|---|---|
| Account and progress | While your account exists. You can delete your account yourself at any time in the app (Account, Delete your account); it takes effect at once. If you ask us by email instead, we delete it within 30 days. Learner accounts with no paid order that nobody has signed in to for 24 months are anonymised automatically, in the same way as a deletion. |
| After you delete your account | Your name, email, password hash, progress, sign-in sessions, AI tutor counts and failed-attempt counters are deleted, and your name and email are removed from the audit log. Payment records that tax law requires (order, amount, date, receipt number, refunds) are kept without your name or email, under a new random number that is not linked to you. For a payment by bank transfer (not currently offered), the payer name and note you gave are removed; the transfer reference and date are kept with the payment records, and a receipt file you uploaded is kept until it is deleted 13 months after upload (see below), because it may show your name. A deletion cannot be made while a refund is still being processed or while a subscription still renews (cancel the renewal first). |
| Certificates and completion records | While your account exists. You can delete a certificate yourself at any time (Me, Certificates, Delete the certificate): its check page stops working at once. Deleting your account deletes your certificates, completion records and exam marks at once, and their check pages then say the certificate was not found. A revoked certificate stays shown as revoked until it or the account is deleted. Exam sittings that were never finished are deleted after 7 days. |
| Sign-in sessions | They end after 14 days without use, or 30 days at most (for owner and admin accounts, 12 hours without use, or 7 days at most), and are deleted at the next clean-up. Deleting your account, or "Sign out everywhere", deletes them at once. |
| Failed attempt counters | 30 days |
| Password reset codes | Deleted at the next clean-up once used or expired (codes work for 24 hours) |
| Invite codes | 90 days after they are used, expire or are revoked |
| Audit log | 24 months. Entries that record an agreement to the terms, the use of an invite code, and payment entries are kept longer, as evidence, for a period that will be stated here before paid sales open. |
| Record of your agreement to the terms | While your account exists and, after a deletion, without your name, email or IP address, for a period that will be stated here before paid sales open |
| Daily AI tutor counts | 90 days |
| AI tutor text | Not stored by us. Our AI provider handles it under its own terms (see section 6). |
| Payment provider notifications | Their details are removed after 13 months; the reference, type and result are kept with the payment records |
| Payment records | As long as tax or accounting law requires; the exact period will be stated here before paid sales open |
| Messages to us | A period after the matter is closed that will be stated here before paid sales open |
| Support requests | Their messages, contact details and attached context are deleted 24 months after the request is resolved; deleting your account deletes your support requests at once |
| Sign-up details before confirmation | Deleted when the link is used or after 24 hours |
| One-trial-per-email hash | Kept, without your name or address, for a period that will be stated here before paid sales open, also after your account is deleted, so that the same address cannot take a second trial |
| Bank transfer receipt files (bank transfer is not currently offered) | 13 months after upload, then the file is deleted; the order and the reconciliation record are kept as payment records |
| Password reset links | Deleted at the next clean-up once used or expired (links work for 24 hours) |
| Waitlist entries | Until you ask us to remove them; a fixed period will be stated here before paid sales open |
| Service email log | 90 days |
| Backups | The database keeps restore points for up to 30 days; deleted data disappears from them after that |
9. How we protect it
We use measures suited to the risk, including: encrypted connections only (HTTPS with HSTS); passwords stored as slow salted hashes; sign-in tokens, IP addresses, invite codes and reset codes stored only as hashes; a sign-in cookie that scripts cannot read and other sites cannot send; limits on failed sign-ins; access to each level checked on the server; staff access by role; a strict content security policy; and an audit log of account events. Secrets are kept outside the database.
No online service can be made perfectly secure, and we cannot promise that a breach will never happen. If a breach is likely to put your rights at risk, we will tell the regulator and you within the times the law requires (in Egypt, the Personal Data Protection Centre within 72 hours).
You can help: use a password you use nowhere else, never share invite or reset codes, and use "Sign out everywhere" in your account if you lose a device.
If you find a security problem in the service, please tell us at [email protected].
10. Your rights
Depending on the law that applies to you, you have the right to:
- know and access: be told what data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data, or have it deleted when we no longer need it;
- restrict how we use it in some cases;
- object to processing based on our legitimate interests;
- portability: receive your account and progress data in a common machine-readable format (JSON);
- withdraw consent at any time, where we rely on consent (this does not affect what we did before);
- be told of a data breach that affects you;
- complain to a regulator: in Egypt, the Personal Data Protection Centre; in the UAE, the UAE Data Office; in the EU or UK, your local data protection authority.
How to use them. Email [email protected] from the email address on your account, and say what you want. We may ask you to confirm it is you. We acknowledge your request within 1 working day and complete it within 30 days, or sooner where the law sets a shorter time, and there is no charge. You can also do several things yourself in the app (Account): download a copy of your data as a JSON file (Download my data: your profile, plan history, progress, orders and receipts, your certificates and the completion records behind them, the security records about your account and your AI tutor counts; up to 3 times an hour), delete your account (Delete your account, with your password), change your password and sign out of every device.
If you delete your account, your access ends at once, you are signed out on every device and your progress is lost. We keep only what section 8 describes (for example payment records, without your name or email).
11. Age
Masar Deutsch is for adults aged 18 or over. When you sign up you confirm that you are 18 or older. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data. If you think this has happened, contact [email protected].
12. The laws we follow
- Egypt: the Personal Data Protection Law, Law No. 151 of 2020, and its executive regulations.
- United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
- European Union and United Kingdom: if you use Masar Deutsch from the EU, the EEA or the UK, the General Data Protection Regulation (GDPR) or the UK GDPR may also apply, and so do the rights listed above.
Where these laws give you more protection than this policy, the law applies.
13. Changes and contact
We will update this policy when the service changes (for example before adding a new provider). The date at the top shows the latest version. If a change matters to you, we will tell you in the app or by email before it takes effect, and ask for your agreement again where the law requires it. When the Terms of use or this policy change materially, the app asks you to read and accept the new version the next time you use it.
Questions or requests: [email protected].
This policy is published in English and Arabic. Which version applies if they differ will be stated here before paid sales open.