Privacy Policy

1. Who is responsible for your data

SaffOnline (“we”, “us”) is responsible for your personal data. Contact us about your data at the same addresses as for anything else:

• Email: [email protected]
• Address: Beirut, Lebanon

We handle personal data in line with Lebanese law, including Law No. 81/2018 on Electronic Transactions and Personal Data.

2. What we collect

When you sign up:

• full name
• phone number, if you give one (it is optional)
• university and university email
• major and year of study
• the date you agreed to our terms

When you use the site:

• device information needed to apply the 2-device limit (such as device or browser type, a device name, and when each device was first and last used)
• on an iPhone, a one-use sign-in link between Safari and the app you add to your Home Screen, so both count as one device; without that link, the phone type, iOS version, screen size and time zone, only to ask whether the app is on the same iPhone; we do not fingerprint your device
• your sign-in records (sign-in codes are short-lived and used only to sign you in)
• your study progress: videos watched, quiz answers and scores, flashcard progress, and your exam tries (answers, scores and times)
• your settings, such as theme and email preferences
• security logs, including tamper alerts (what was detected, when, and on which device) and related technical data such as IP address

When you order:

• what you ordered, prices, discounts or codes used, and order status
• your Whish payment: its status, the amount, the Whish reference and the Whish phone number that paid

We do not collect or store card details. Payments happen in Whish, not on our site.

When you contact us: the emails you send us, such as device reset or correction requests and error reports.

Emails we send you: a record of which service emails were sent to you and whether they were delivered.

3. Why we use it

We use your data only to run SaffOnline:

• Your account: to create it, sign you in and check that you are a student at a supported university.
• Access control: to give you the packages you paid for, until your access ends, and to apply the 2-device and one-video-at-a-time limits.
• Watermark: your full name and phone number (your email, if you gave no phone number) are shown on every video and page of notes you view, to discourage sharing.
• Progress: to save where you are in videos, quizzes, flashcards and exams.
• Orders: to process, confirm and activate orders, apply discounts, send payment reminders and keep accounting records.
• Support: to answer your questions and handle your requests.
• Security: to detect and review account sharing, tampering and misuse, and to protect the site and our content.
• Service emails: sign-in codes and order and activation emails (these always send).
• Reminder and offer emails: such as “access ending soon” or a practice offer. You can switch these off in your account settings at any time.

The legal grounds are: performing our agreement with you (your account and orders), your consent (given when you sign up, and which you can withdraw), our legitimate interest in protecting our content and service, and our legal duties (such as keeping accounting records).

4. What we do not do

• We do not sell your personal data.
• We do not show ads, and we do not share your data with advertisers.
• We do not use tracking cookies or advertising trackers.

5. Who we share it with

We use a small number of trusted service providers to run the site. They handle your data only to provide their service to us:

Supabase

Stores accounts and the database

VdoCipher

Delivers and protects the videos (DRM) and draws the watermark, so it receives your name and phone number (or your email, if you gave no phone number)

Resend

Sends our emails, so it receives your email address and the email content

Cloudflare

Hosts the site and protects it against attacks, so it sees technical data such as IP addresses

Whish

Takes your payments, so it receives the order number and the amount, and tells us the payment status and the paying phone number

We may also share data:

• with an ambassador, if you use their ambassador code: they see only your first name and the course, never your contact details or order details;
• when the law requires it, such as a valid request from a Lebanese court or authority;
• to protect our rights, for example where our content has been copied or published.

6. Data stored outside Lebanon

Our service providers may store and process your data on servers outside Lebanon, in Europe or the United States. We choose well-known providers that use strong security. By using SaffOnline, you agree to this transfer.

7. How long we keep it

• We keep your account data, progress and logs for 2 years after your last activity (your last sign-in or order). After that, we delete it or make it anonymous.
• We keep order and payment records for as long as needed for accounting and legal purposes, even after your account is deleted.
• If you ask us to delete your data, we do so (see section 8), except for records we must keep.

8. Your rights

Under Law No. 81/2018, you have the right to:

• Access: ask what data we hold about you and get a copy.
• Correction: ask us to correct data that is wrong. Your name, phone and email can only be corrected by us, because they appear on the watermark.
• Deletion: ask us to delete your data. Deleting your account ends your access, with no refund for activated orders.
• Objection: object to us using your data, for example for reminder and offer emails.

How to ask: email [email protected] from your university email. We may ask you to confirm your identity. We will reply within 30 days.

If you are not satisfied with our reply, you may complain to the competent Lebanese authority.

9. Cookies

We use only the cookies and browser storage needed to:

• keep you signed in;
• remember your settings, such as light or dark theme;
• remember an ambassador’s code from a share link you opened, for 30 days;
• remember that you have seen the cookie notice.

We do not use advertising or tracking cookies. If you block these cookies, you may not be able to sign in.

10. How we protect your data

• Sign-in uses one-time codes sent to your email; we do not store passwords.
• The site uses encrypted connections (HTTPS).
• Videos are protected with DRM and short-lived links.
• Access to the admin tools is limited to SaffOnline’s admins, and the database restricts each student to their own data.
• Our providers keep the data on secure servers.

No system is perfectly secure. If a data breach affects you and puts you at risk, we will tell you as soon as we can.

11. Changes to this policy

We may update this policy. If we make an important change, we will tell you by email or on the site before it takes effect. The effective date at the top always shows the current version.

12. Contact

Questions about your data? Email us at [email protected].