Privacy Notice

1. Who We Are

This Privacy Notice is issued by Huwar ai Company Technical, a limited liability company incorporated in the Kingdom of Saudi Arabia under Commercial Registration No. 7052865636, engaged in software publishing and computer programming activities, and having its registered office in Riyadh, operating under the commercial name "Huwar" (and hereinafter referred to as "Huwar", "we", "us" or "our").

Huwar operates an Arabic-first digital platform for preparing for the General Aptitude Test (Qudurat / GAT) and the Achievement Test (Tahsili / AT). The Service is delivered through the website and practice application at (huwar.ai), through Huwar's online practice applications for Qudurat and Tahsili, and through the reviewer and contributor portal at (teach.huwar.ai) (collectively, the "Service"). Huwar is the controller of all personal data processed through the Service, including the personal data of a User who uses the practice features and the personal data of a User who applies for or holds reviewer or contributor access through (teach.huwar.ai).

Contact: (privacy@huwar.ai)

2. Scope of this Notice

This Notice applies to personal data we collect from, or generate about, any User who uses the Service, whether by creating an account on (huwar.ai) or on (teach.huwar.ai), browsing the public website, contacting us for support, applying for reviewer or contributor access, or subscribing to a paid plan. It also applies to limited personal data we receive about a person who has not yet created an account, for example a person whom a User invites to the Service or a guardian or legal representative who is asked to give consent on a User's behalf.

3. Personal Data We Collect

We collect personal data directly from you when you use the Service, from third-party sign-in providers where you choose to use them, and automatically when you interact with the Service. We collect only what we need to deliver the Service.

3.1 Data you provide to us

Account credentials: your email address and, where you create an account directly, your password.

Third-party sign-in data: where you choose to create or access an account using a supported third-party sign-in provider (currently Google), we receive from that provider a unique account identifier (the provider's "sub"), your email address and whether it is verified, and your name (which we store as a first name and a last name). Where you use such a provider to register for reviewer or contributor access, we also receive and store your profile photo.

Learning profile: your educational stage (grade level) and the examination track you are preparing for, such as the General Aptitude Test (Qudurat / GAT), the Achievement Test (Tahsili / AT), or any other track Huwar supports, together with the relevant subject stream.

Self-reported examination and academic results: where you choose to enter them, your self-reported examination or high-school results, the related examination type, and the date of the result. These are stored as a history (a correction or update is added as a new entry) and are used to provide features such as your weighted-score and progress views. They are not shown to other Users and are not displayed publicly.

Reviewer and contributor profile: where you apply for reviewer or contributor access through (teach.huwar.ai), the professional and biographical information you provide (which may include your years of experience, area of speciality, university, major, the subject you focus on, your preferred language, your institution, and a contact phone number) and any curriculum vitae or résumé file you upload. A résumé file you upload may contain further personal data, so please do not include more information than is necessary for your application, and please do not include sensitive identifiers (such as national identity numbers) unless they are necessary.

Communications and uploads: any information you include when you contact us by email, complete a support form, or respond to a survey or feedback request, including any free-text comments, together with any file you upload to us through a support or contribution flow. Free-text fields may contain personal data, so please do not submit information that is not necessary.

Guardian or legal-representative contact details: where you do not have full legal capacity and your guardian or legal representative is asked to give consent on your behalf, we collect the guardian's or legal representative's phone number in order to send the approval request and to record the decision (see Section 6.3 and Section 12).

Confirmation given at registration: when you accept the Terms and Conditions and this Notice, you confirm that you have full legal capacity under the laws of the Kingdom of Saudi Arabia, or, where you do not have full legal capacity, that your guardian or legal representative has reviewed and accepted them on your behalf. See Section 12.

Payment data: when you subscribe to a paid plan, your payment is processed by a licensed payment service provider. We do not store your full card number. We hold limited card metadata returned by the payment service provider (such as the card brand and the last four digits) and a reference that allows the payment service provider to charge the card you have authorised for recurring payments.

3.2 Data we collect automatically

Learning activity: the questions you attempt, your answers, time spent, correctness, and derived scores.

Device and technical data: IP address, browser type and version, operating system, language preference, and log timestamps.

Location data: a location derived from your IP address. Depending on the provider we use, this may include your country, region and city, and may include geographic coordinates (latitude and longitude). You can set or correct your city in your account, and the city associated with your account is used to compute the city ranking described in Section 6.2.

Login and security-event data: each time you sign in, we record information about the login event, including the IP address, information about the device and browser used, and the location derived from the IP address (which may include geographic coordinates, namely latitude and longitude), to help keep your account and our systems secure and to detect unusual activity.

First-party usage analytics: pages visited, features used, and session duration. We use this on the basis of our legitimate interest in measuring and improving the Service, using aggregated and de-identified data where possible.

Analytics and performance technologies: where you have given your consent, we use analytics and performance technologies, including Google Analytics loaded through Google Tag Manager, to understand in aggregate how the Service is used so that we can measure and improve it. This is described in our Cookie Policy and in Section 11.

Derived learning-behaviour signals: patterns inferred from your learning activity, used to personalise the learning experience (Section 4).

4. Purposes of Processing

We process your personal data for the purposes below, and for no other purpose unless we separately notify you and, where required, obtain your consent.

Account creation and authentication: registering you, including through a supported third-party sign-in provider, verifying your identity at login, and password reset.

Delivering the exam-preparation service: routing you to the practice content appropriate for your track, tracking progress, scoring attempts, and showing your results to you.

Personalising your learning experience: analysing your past activity to adapt content and interface, recommend topics to revisit, sequence questions by your observed difficulty, and surface study tips tuned to your behaviour. Personalisation is integral to the Service; consent to personalisation is given at registration when you accept the Terms and Conditions and this Notice, and withdrawal of that consent requires closure of the account.

Community and ranking features: operating features that are visible to other Users, including the leaderboard and the city ranking described in Section 6.2, on the basis described in that Section.

Sharing your performance data with a teacher you choose to link: where you give the separate consent described in Section 6.3, making your identity and performance analytics available to a teacher you have chosen to link to your account.

Reviewer and contributor administration: where you apply for reviewer or contributor access, assessing your application, administering your access, and managing your contributions.

Service communications: account-related messages such as password reset, service updates, security notices, and billing notices.

Security and fraud prevention: detecting unusual login activity, recording login and security events, preventing abuse, and keeping systems secure.

Guardian or legal-representative approval: where you do not have full legal capacity, contacting your guardian or legal representative to request and record their approval (see Section 6.3 and Section 12).

Referrals and invitations: where a User invites another person to the Service, processing the invitee's email address and name in order to send the invitation and administer any referral discount.

Legal and regulatory compliance: meeting our obligations under applicable law, including tax and accounting law, and responding to lawful requests from competent authorities.

Service improvement and aggregate analytics: understanding how the Service is used so we can fix problems and improve it. Activity is aggregated and de-identified where possible.

Marketing and optional engagement communications: only if, and to the extent, you have separately opted in at signup or in your account settings, we may send you news, study tips, and study-progress updates, together with achievement and engagement notifications (such as rank changes, city-ranking milestones, and study-streak milestones). Where you have opted in to study-progress or study-update emails, those emails may include a summary of your own learning performance (for example your accuracy, your weakest subject, your recent activity, and the number of days remaining in any complimentary period), and we may record whether you open them and which links you select. These communications require your separate, express marketing opt-in, an in-app notification preference is available to manage them, and they are off by default. You may withdraw your consent at any time.

5. Lawful Basis for Processing

Personal data may be processed only if a lawful basis recognised under applicable law applies. For Huwar, the primary lawful basis is your consent, given when you register and when you tick specific consent boxes for optional processing (such as marketing or sharing your performance data with a teacher you link to).

Where you do not have full legal capacity, the consent required is given by your guardian or legal representative when they accept the Terms and Conditions and this Notice on your behalf, in accordance with the Acceptance clause of the Terms and Conditions. Your guardian or legal representative is responsible for your use of the Service. Consent may be withdrawn at any time (see Section 10); depending on the consent withdrawn, this may require us to close the account.

Specific bases for specific purposes:

Service delivery: your consent given at registration.

Personalisation of the learning experience: your consent given at registration. Personalisation is integral to the Service; withdrawal of consent for personalisation requires closure of the account.

Service communications and security, including login and security-event logging: your consent given at registration, supported by our legitimate interest in running a secure service and protecting your account.

First-party usage analytics and service improvement and aggregate analytics: our legitimate interest in measuring and improving the Service, using aggregated and de-identified data where possible.

Community and ranking features visible to other Users: your consent, as described in Section 6.2.

Sharing your performance data with a teacher you link to: your separate, specific consent, as described in Section 6.3.

Reviewer and contributor administration: your consent given when you apply for reviewer or contributor access.

Referrals and invitations: where you invite another person, our legitimate interest in operating the referral programme, on the basis that you confirm you have the right to share that person's contact details (see Section 6.3).

Guardian or legal-representative approval: where you lack full legal capacity, our legitimate interest in obtaining and recording a valid approval, and the guardian's or legal representative's own consent to being contacted for that purpose (see Section 6.3 and Section 12).

Analytics and performance technologies: your consent, as described in Section 11 and in our Cookie Policy.

Legal and regulatory compliance: compliance with a legal obligation to which Huwar is subject.

Marketing and optional engagement communications, including study-progress emails and achievement and engagement notifications: your separate, optional consent given by ticking the marketing box.

6. Who We Share Your Data With

We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes. We share your data only with the categories of recipient described in this Section, and only as strictly necessary to provide the Service (our processors), or as you have specifically consented (features visible to other Users and sharing with a teacher you link to).

6.1 Our service providers ("Data Processors")

We engage carefully selected third-party service providers to help us operate the Service, and we engage each such provider under a written data-processing agreement that requires them to process your data only on our instructions, protect it with appropriate security measures, and return or delete it at the end of the engagement.

Current categories, with the providers we use by function:

Payment processor: the licensed payment service provider that processes your subscription payments and securely stores your card (held by the provider as card-on-file) so that authorised recurring charges can be made on a merchant-initiated basis. We currently use Tap.

Messaging provider (WhatsApp and SMS): the provider that sends one-time verification codes by SMS and, for the purposes described in this Notice, WhatsApp or SMS messages, including a transactional approval message to a guardian or legal representative (see Section 6.3) and, where you have opted in, marketing messages. We currently use Unifonic.

Identity and sign-in provider: the provider of the third-party sign-in you choose to use, which authenticates you and provides us with the identifiers described in Section 3.1. We currently use Google.

Email provider: the provider that sends our service emails and, where you have opted in, marketing and study-update emails, and which may record email engagement such as opens and link selections. Where you have opted in to study-progress or study-update emails, those emails contain a summary of your own learning performance, so that learning-performance content is processed by the email provider for the purpose of delivering those emails.

Location-derivation (IP-geolocation) provider: a provider that derives a location from an IP address for the location and security purposes described in this Notice. Where this lookup uses a provider that does not support encrypted transport, we minimise the data sent.

Development and technical support vendors: engaged to build and maintain the Service. Access is limited to what is necessary for the engagement and is subject to confidentiality, security, and audit obligations.

Hosting and infrastructure providers: host the Service's database, servers, and the storage in which uploaded files (such as résumé files) are held.

6.2 Features visible to other Users

Certain features of the Service display limited information about a User to other Users. We provide these features on the basis of your consent, and they are designed to limit what is shown by default.

Leaderboard. The leaderboard shows each ranked User's rank and accuracy to other signed-in Users. Your name is shown on the leaderboard only where you have opted in to display it; by default your name is masked. The lawful basis for displaying your name is your consent, which you give by turning on the leaderboard name display, and which you can withdraw at any time in your account settings to return your name to its masked form. Turning off name display masks your name, but your rank and accuracy continue to be shown to other signed-in Users in masked form; there is no separate opt-out of the ranking row itself.

City ranking. The city ranking shows Saudi cities ordered by the average accuracy of the Users associated with each city. The city ranking is presented at the level of cities and does not identify you to other Users. While you have a city associated with your account, your accuracy contributes to that city's aggregate ranking; because the ranking is city-level and not individually identifying, there is no separate per-User exclusion from it, and setting or correcting the city associated with your account in your account settings is the available control.

Collaborative review. Where you participate in collaborative review through the reviewer and contributor portal, your display name and, where set, your profile photo are visible to the other Users who participate in that review (for example in revision history and comments), so that contributions can be attributed and audited. This is limited to participating Users and is on the basis of your consent given when you take part in collaborative review.

6.3 Sharing performance data with a teacher you link to, and guardian or legal-representative approval

Sharing with a teacher you link to. The Service allows you to choose to link your account with another User (a teacher) and to share defined performance data with that teacher. Where you do this, the teacher receives your identity (your first and last name, your email address, and your educational stage) and a package of your performance analytics (which may include your overall number of questions answered and correct, your overall accuracy, your recent score history, your study streak, your total study hours, your accuracy broken down by examination, topic, chapter and lesson, your top strengths and weakest areas, and your topic-mastery levels). The teacher receives this data as an independent recipient for their own use, and not as a processor acting on Huwar's instructions. The lawful basis is your separate, specific, opt-in consent, given for each teacher you choose to link. This consent is granular (it applies only to the teacher you choose), it is revocable at any time with immediate effect through the controls in your account, and it is time-limited: it is valid for ninety (90) days, and you may extend it. The sharing ends automatically when the link ends, when your consent ends, or when the consent period expires without being extended, and we re-check that a valid consent exists each time the teacher seeks to view your data.

Guardian or legal-representative approval. Where you do not have full legal capacity, your guardian or legal representative is asked to approve the data-sharing (and your use of the Service) on your behalf. For this purpose we collect the guardian's or legal representative's phone number and send a message over WhatsApp or SMS, through our messaging provider, containing your first name, the name of the teacher concerned, and an approval link. The approval link contains limited information (your first name and the name of the teacher concerned) so that your guardian or legal representative can identify the request. This message is transactional and is not marketing. We record the guardian's or legal representative's decision (approval, rejection, or revocation) and keep a log of the message sent (see Section 8). Your guardian or legal representative may revoke the approval at any time, and is responsible for your use of the Service.

Invitations. Where a User invites another person to the Service, we collect and process that person's email address and name in order to send the invitation. The inviting User must have the right to share that person's contact details with us. The invitation may reveal limited information to the person who receives it, such as the inviting User's display name and eligibility for a referral discount.

6.4 Legal and regulatory disclosures

We may disclose personal data where required by applicable law, court order, or a binding request from a competent regulatory authority.

7. International Transfers of Personal Data

Your personal data may, from time to time, be transferred to, stored in, or processed in jurisdictions outside the Kingdom of Saudi Arabia, including by service providers described in Section 6. Several of the providers we use may process personal data outside the Kingdom, including the payment processor, the messaging provider, the identity and sign-in provider, the email provider (including any learning-performance content in study-update emails), the location-derivation provider, and certain hosting and development vendors. Any such transfer takes place solely for the purposes set out in this Notice and is subject to the safeguards described below. We do not otherwise transfer your personal data outside the Kingdom.

We take the following steps:

Where a transfer outside the Kingdom takes place, it is carried out under a transfer mechanism recognised under applicable law, including, where appropriate, standard contractual clauses approved under applicable data-protection legislation, and we apply reasonable technical and organisational safeguards to protect your personal data.

We complete a transfer risk assessment for each destination country, documenting the legal environment and any additional safeguards required.

8. How Long We Keep Your Data

We keep personal data only for as long as we need it for the purposes set out in this Notice, unless a longer retention period is required by law.

Active account data (profile, learning activity, self-reported examination and academic results): kept for the duration of your account. Self-reported examination and academic results are kept as a history for the duration of your account; where you request deletion, we delete all entries in that history.

Closed or deleted accounts: kept up to 1 year after closure, then anonymised or deleted.

Reviewer and contributor application data, including any uploaded résumé file: kept for the duration of your reviewer or contributor access; where an application is rejected or withdrawn, the application data and any uploaded résumé file are kept for up to 6 months and then deleted.

Communications and support content, and uploaded files (support attachments and contribution-flow files other than reviewer résumés): kept for as long as needed to handle your request and for a defined period thereafter, and then deleted or anonymised.

Data-sharing consent records: the record of each consent to share performance data with a teacher you link to is kept as evidence of the consent's existence and its withdrawal or expiry; a record relating to a consent that has ended is anonymised or deleted within 2 years after the consent ends.

Guardian or legal-representative phone number and the consent message log: the guardian's or legal representative's phone number and the record of any approval message sent are kept as evidence of the approval for as long as the related consent is in effect, and are then anonymised or deleted within 2 years after the related consent ends.

Login and security-event data: 12 months.

Backups containing personal data: rotated and purged on a defined schedule, typically within 90 days of primary deletion.

Server and security logs: 12 months.

Marketing consent records: duration of the marketing relationship plus 2 years (evidence of consent).

Accounting and tax records: 10 years from the end of the financial year, under Saudi accounting and tax law.

9. How We Protect Your Data

We apply organisational and technical measures proportionate to the nature of the personal data we process, including:

Encryption of personal data in transit across the Service; where a limited technical lookup uses a provider that does not support encrypted transport, we minimise the data sent.

Encryption of personal data at rest.

Per-user accounts and multi-factor authentication for every person, whether employee or vendor, who accesses production systems.

Storage of uploaded files, such as résumé files, in non-public storage accessible only to authorised personnel.

Access logs retained for a minimum of 12 months and reviewed in the event of a suspected incident.

Written information-security and access-control policies, reviewed at least annually.

Contractual security obligations on every data processor we engage.

No security measure is perfect. If we become aware of a personal-data breach likely to cause harm to you, we will notify you and the competent regulatory authority in line with the timelines required by applicable law (currently within 72 hours of becoming aware).

10. Your Rights

You have the following rights in relation to your personal data, and we aim to respond to any request within thirty (30) days.

Right to be informed: to know what personal data we hold about you and how it is processed. This Notice is part of how we meet that right.

Right of access: to request a copy of your personal data, including your login and security-event history, subject to our need to retain certain security data for fraud-prevention purposes.

Right to correction: to have inaccurate or incomplete personal data corrected.

Right to deletion: to request deletion of your personal data, subject to any legal retention obligation. Where data is held as a history (such as your self-reported examination results), a deletion request covers all entries in that history.

Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time. This includes withdrawing your consent to display your name on the leaderboard, your consent to share performance data with a teacher you link to, your consent to marketing and optional engagement communications, and your consent to analytics and performance technologies. Withdrawing consent does not affect processing carried out before the withdrawal.

Right to object and to restrict processing more generally, in the circumstances provided for by applicable law.

Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible. A data export covers the categories of personal data we hold, including your login and security-event history, subject to the security and fraud-prevention retention basis described in this Notice.

To exercise any of these rights, email us at (privacy@huwar.ai) from the email address associated with your Huwar account. We may ask you to verify your identity before we act on a request.

11. Cookies and Similar Technologies

We use cookies and similar technologies, including the browser's local storage and session storage, on the Service. This Section summarises our use; full details are set out in our Cookie Policy, which should be read together with this Notice.

We use cookies and similar technologies in two categories. Essential and functional technologies are required for the Service to operate, to keep you signed in, and to remember basic preferences such as your language. They are always active and do not require your consent. Analytics and performance technologies help us understand, in aggregate, how the Service is used so that we can measure and improve it. They are not essential, and we set them only after you have given your consent.

The analytics and performance technologies we use include Google Analytics, which we load through Google Tag Manager on (huwar.ai) and through Google Analytics on (teach.huwar.ai). Because analytics and performance technologies are not essential, we ask for your consent before we set them: when you first use the Service, you are shown a cookie notice that allows you to accept or decline non-essential cookies, and you can change your choice at any time through the cookie settings available on the Service. Until you accept, only essential and functional technologies are used.

We do not use advertising cookies, and we do not use cookies to serve third-party advertisements or to track you across unrelated websites. Huwar authenticates each request using a sign-in token stored on your device; it does not set a server-side session cookie.

12. Capacity and Consent

When you accept the Terms and Conditions and this Notice, you confirm that you have full legal capacity under the laws of the Kingdom of Saudi Arabia to do so. Where you do not have full legal capacity, your guardian or legal representative reviews and accepts the Terms and Conditions and this Notice on your behalf, gives any consent required for the processing described in this Notice, and is responsible for your use of the Service, as set out in the Acceptance clause of the Terms and Conditions.

Where you do not have full legal capacity and the Service asks your guardian or legal representative to approve the sharing of your performance data with a teacher you link to, that approval is given through the guardian-approval process described in Section 6.3. We process the guardian's or legal representative's phone number and approval decision for that purpose only.

We log each acceptance with the date and the version numbers of the Terms and Conditions and of this Notice that were displayed at the time, as a record of consent.

If you are a guardian or legal representative and you believe that a User in your care has used the Service without your authorisation, you may contact us at (privacy@huwar.ai) to request termination of the account.

13. Changes to this Notice

We may update this Notice from time to time. The current version number and its effective date are shown at the top of this Notice.

For material changes, including any change to the categories of data processed, the purposes of processing, the lawful basis, the recipients, or the international-transfer posture, we will:

Send you an email at the address associated with your Huwar account;

Display an in-app notice the next time you log in; and

Ask you to confirm that you have reviewed the updated Notice before you continue to use the Service.

For non-material changes, including clarifications, linguistic corrections, and updates to our contact details, we will update the published Notice and revise the version number.

14. How to Contact Us

For any question about this Notice or about how we handle your personal data:

Email: (privacy@huwar.ai)

If we cannot reach a resolution together, we will direct you to the appropriate regulatory channels.

15. Language

This Notice is issued in Arabic and in English. In the event of any discrepancy or conflict between the two versions, the Arabic version shall prevail and be legally binding. The English version is provided for convenience and reference only.

End of Notice