Privacy policy

The controller

KHAT Education — Tanta, Gharbia Governorate, Egypt. For privacy matters: help@khat.education.

This policy covers khat.education, app.khat.education and every teacher platform operating on it.

Data collected

Teacher account data: name, email address, phone number, the platform name and logo, the subject and school years taught, and the subscription plan.

Student data: entered by the teacher or registered by the student — name, phone number (and sometimes a parent's number), school year and group. Also the student's activity on the platform: lessons opened and how long they were watched, exam answers and marks, attendance, and the payments the teacher records, including receipt images where uploaded.

Technical data: device and browser type, IP address, sign-in times, and content-protection signals such as screen-capture attempts during a lesson. These signals are recorded for the platform owner, because protecting their material is part of the service.

Enquiry data: the name and phone number left in the contact form on the website.

Payment data: card details are sent directly to the payment gateway and do not pass through KHAT's servers and are not stored by KHAT. What reaches KHAT is the outcome of the transaction: success or failure, amount, date, reference, and the last four digits of the card.

Purposes of processing

• Operating the platform: sign-in, lessons, exam marking, reports and collections.
• Presenting follow-up to the teacher: who studied, who stopped, and where each answer went wrong.
• Protecting material from redistribution through watermarking, a signed access token per view, and a capture-attempt log.
• Billing and subscription management.
• Technical support and replies to messages.
• Measuring advertising performance on KHAT's own pages.

Teacher data and student data are never sold to any party, and lesson content and exam answers are never used to train any AI model.

The teacher's role in student data

Student data belongs to the teacher who owns the platform: they decide who joins and who may see what, and they are responsible for obtaining the consent of the student or their parent. KHAT processes this data on the teacher's behalf in order to operate the service.

A student or parent should therefore address a correction or deletion request to the teacher first, who can act on it inside the platform. Where that is not resolved, KHAT will intervene once notified.

Who may see the data

• The teacher: the data of their own platform only. No teacher sees another teacher's students.
• The student: their own data only.
• KHAT: in limited cases — support requested by the account holder, fault diagnosis, suspected fraud or misuse, or a formal legal request.
• The service providers listed below, each within what its function requires.

Service providers and storage locations

Google Firebase / Google Cloud

Hosting, database, files and authentication. Servers are in Europe (Belgium — europe-west1).

Bunny Stream

Lesson video delivery over a content-delivery network, with a signed access token per view.

Meta

A pixel measuring advertising performance on KHAT's pages and within the platform. The data sent is anonymised or hashed.

Payment gateway

Processing payments; it is the party that handles card details.

Data may therefore be transferred to and stored outside Egypt with these providers, which is a condition of operating the service.

Cookies and local storage

• Necessary: the sign-in token and display preferences, without which the platform cannot operate.
• Measurement: the Meta pixel records page views and sign-up steps in order to measure advertising performance, and can be disabled in browser settings without affecting how the platform works.

No advertising cookies track students through their lessons.

Retention

• Data is retained for as long as the subscription is in force.
• After cancellation it is retained for 90 days to allow return or export, then deleted or anonymised.
• Invoice records are retained for the period required by Egyptian law.
• Contact-form entries are deleted after 12 months if they do not become an account.

Rights of data subjects

• Access to the data held.
• Correction of anything inaccurate.
• Deletion of the account and its data.
• A copy of the data in a usable format.
• Withdrawal of consent to marketing contact at any time.

Requests are sent from the registered email address to help@khat.education and are acted on within 30 days.

Students under eighteen

The platform is used to teach students under eighteen. A student joins their teacher's platform with that teacher's knowledge, and the teacher carries responsibility for parental consent as the law requires. KHAT does not build advertising profiles of students, does not target them with advertising, and does not collect more from them than the lesson requires.

Security

• Every request is checked at document level: access is denied unless explicitly permitted.
• Firebase App Check confirms that requests originate from the application itself.
• Lesson video is served with a signed, time-limited access token and a watermark carrying the student's name.
• All traffic is encrypted over HTTPS.

No system is entirely secure. Where a breach affects personal data, the people concerned and the competent authorities are notified as quickly as possible.

Amendment of this policy

Subscribers are notified by email before any material amendment takes effect, and the last-updated date at the top of this page indicates the version in force. For enquiries: help@khat.education or the contact page.