01Introduction
Chaatr is an education platform based in the Kingdom of Saudi Arabia, serving students in grades 4–8 (roughly ages 9–14) along with their parents, teachers, and schools. By using the platform through our apps or website (chaatr.com and its subdomains) you confirm that you've read this policy and accept its terms.
We operate in line with the KSA Personal Data Protection Law (PDPL) and its implementing regulations, as well as any applicable laws in the GCC countries where we provide service.
02Data we collect
We only collect what's needed to run the service:
• Account data: name, email, phone number, date of birth (for age verification), role (student, parent, teacher, school), and a hashed password.
• Student learning data: grade level, curriculum, learning progress, exercise results, XP earned, and achievements.
• Transaction data: family wallet, approved rewards, and any in-app purchases.
• Technical data: IP address, device type and OS, app version, and usage logs for security and performance.
We don't collect precise geolocation, health data, or any sensitive information beyond what's listed above.
03Children's privacy and parental consent
Because our platform serves children under 18, creating a child account requires explicit consent from a parent or legal guardian. The parent creates the account, sets the age band for the child, and turns any feature on or off.
We don't show tracking ads to children, we don't share their data with third parties for marketing purposes, and we don't ask children for any personal data beyond what's necessary for educational use.
A parent can review, edit, or fully delete a child's account at any time from the parent app settings.
04How we use data
We use the data we collect for these purposes only:
• Operating the account and providing the service (personalising lessons, calculating XP, tracking progress).
• Enabling parent-teacher communication within the platform.
• Processing top-ups and reward redemptions in the family wallet after parental approval.
• Sending important notifications about a child's activity (not marketing unless you opt in).
• Improving service quality, diagnosing errors, and protecting the platform from abuse.
We don't use children's data to train AI models beyond personalising their learning experience inside the platform.
05Data sharing
We don't sell your data or your children's data to any third party, and we don't share it for advertising purposes.
We may share some data with trusted service providers (such as cloud infrastructure, payment processors, email delivery) only as needed to operate the service, and under agreements that bind them to the same security and confidentiality standards.
We may disclose data if compelled to do so by a valid legal order from a competent authority in KSA or in the GCC countries where we operate.
06Data storage and protection
User data is stored on secure servers within KSA or in regional data centres compliant with the Personal Data Protection Law. We use encryption in transit (TLS 1.2+) and at rest (AES-256) for all sensitive data.
We enforce strict access controls, regular security reviews, and clear internal policies about who can access data and when. If we detect a breach that could affect your data, we'll notify you within 72 hours at most, as required by law.
07Your rights
As a data subject or parent of one, at any time you have the right to:
• Access your data or your child's data.
• Correct any inaccurate information.
• Request deletion of the account and all associated data (subject to any legal obligations requiring retention of certain records for a limited period).
• Withdraw your consent to data processing at any time.
• Object to any processing you consider unnecessary.
To exercise any of these rights, contact us at the email listed at the end of this document.
08Cookies
We use essential cookies on our website to maintain user sessions and remember language preferences. We don't use third-party advertising trackers, and we don't share browsing behaviour with ad networks. You can disable cookies in your browser settings, but this may affect some site features.
09Data retention
We retain data for as long as you use the service. When the account is deleted, we delete personal data within 30 days, except where we're required to keep certain records for accounting or legal purposes under applicable KSA regulations.
10Updates to this policy
We may update this policy from time to time. If we make material changes, we'll notify users via the registered email address or via an in-app notification at least 14 days before changes take effect. The last-updated date stays visible at the top of this page.
11Contact us
For any question or request related to this policy or your data protection rights, email us at support@chaatr.com. We'll respond within 30 working days at most.