Privacy Policy

1. Who we are and what this policy covers

Rubwa Education (“Rubwa”, “we”) is a digital school serving KG through high school. We are the controller of the personal data described in this policy.

This policy covers the rubwaeducation.com website and the Rubwa app on the App Store and Google Play. The app is a wrapper around the same website: it collects no additional data from your device, requests no device permissions (camera, photos, location, contacts), and uses no advertising identifiers.

Address: 2826 King Abdullah Branch Rd, Al Sharafiyah District, Jeddah, Saudi Arabia. Privacy contact: info@rubwaeducation.com — phone +966557889286.

2. Data we collect

We collect only what you enter yourself and what is technically required to run the service. We do not buy data from third parties.

Parent account

Name, email, mobile/WhatsApp number, password (stored hashed with Argon2 — we cannot read it), and a profile photo if you upload one.

Student details

First and last name, date of birth, gender, national/residency ID (optional), grade and track. Entered by the parent about their child.

Admission applications

Chosen grade, billing period, application status and its history, and the messages exchanged with our admissions team.

Payments

Invoice number, amount, currency, chosen payment method, and the gateway's transaction reference. We never receive or store your card number or CVV — those are entered directly with the payment gateway.

Website forms

Contact form, free trial-week booking, FAQ questions and lecture registrations: your name, email, phone and the text you send.

Job applications

If you apply for a role: name, email, phone, the CV file you upload, and your professional details.

Marketers and influencers

For marketing partners only: wallet and commission records, plus the bank account holder name and transfer details when a payout is requested.

Technical data

IP address and browser/device string (User-Agent) recorded with website forms and login sessions, last login time, and the cookies described in section 6.

3. Why we use your data, and on what basis

We make no automated decisions with legal effect on you, and we do not profile student data.

Performing our contract

Creating your account, processing the application, issuing and collecting the invoice, delivering the education service, and contacting you about your application.

Legal obligation

Keeping invoices and financial/tax records for the period Saudi regulations require.

Legitimate interest

Platform security, fraud and abuse prevention, and improving our content and service.

Your consent

Marketing measurement tools, non-essential cookies, and marketing messages. You can withdraw consent at any time.

4. Children's data

The platform is aimed at parents, not children. We do not create student accounts, students do not log in, and we never ask a child for data directly.

Student details (name, date of birth, gender, ID number) are entered by the parent or legal guardian, who confirms they are entitled to provide them.

We do not use student data for advertising, do not share it with any ad network, and do not build interest profiles from it. The measurement tools in section 6 run on public marketing pages only and receive no student data.

A parent may view, correct or request deletion of their child's data at any time — see section 9.

5. Who we share data with

We do not sell or rent your data. We share it only with the providers below, only as far as needed, and each is bound to protect it to a standard no lower than ours:

Telr — payment gateway

Your name, email, phone and invoice amount, to process the payment. Privacy policy: telr.com

Tamara — instalment payments

If you choose instalments: your contact details and invoice information so they can complete the transaction. Privacy policy: tamara.co

Google Cloud — hosting

Hosts the application, database and files. Accessed only to operate the infrastructure.

Meta — campaign measurement

Anonymised browsing events from public marketing pages (such as a page view or a completed registration) to measure our ad performance. No student data is sent. Active only after you accept cookies.

Email provider

Your email address and the content of messages we send you (registration confirmations, receipts, replies).

Authorities

Where there is a lawful request or court order, or to defend our legal rights.

6. Cookies and measurement tools

• Essential cookies: keep your login session working and secure and remember your language. The platform does not function without them.
• Measurement and marketing cookies: Meta Pixel, to measure our ad campaigns. These run only after you accept them in the banner shown on your first visit.
• To withdraw consent: clear this site's cookies in your browser settings and the consent banner will appear again. You can also adjust ad preferences in your Meta account settings.
• We use no device advertising identifier and do not track you across other apps or websites.

7. Where your data is stored and transferred

The platform and database are hosted on Google Cloud in data centres in the European Union (Belgium), while media files are stored in Google Cloud's Dammam data centre in Saudi Arabia.

This means your personal data may be transferred and processed outside the Kingdom. We rely on a provider bound by contractually recognised protection safeguards, and transfer no more than is needed to run the service.

8. How long we keep it

After that, data is deleted or anonymised so it can no longer be linked to you.

Parent account and student data

For as long as you use the service, and up to 24 months after your last activity unless a legal obligation requires longer.

Invoices and financial records

For the period required by Saudi tax and commercial regulations, even if you ask us to delete your account.

Contact messages and enquiries

24 months from the last reply.

Job applications and CVs

12 months from submission unless you ask us to delete them sooner.

Login records and IP addresses

12 months, for security and abuse detection.

9. Your rights

To exercise any of these, email info@rubwaeducation.com. We respond within 30 days at the latest, and may ask you to verify your identity first to protect your account.

• Access your data and your children's data, and receive a copy of it.
• Correct or update anything inaccurate.
• Request deletion of your account and data — see section 10.
• Withdraw consent for measurement tools or marketing messages at any time, without affecting your education service.
• Object to a particular processing activity or ask us to restrict it.
• Complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) if you believe we handled your request improperly.

10. Account and data deletion

You can request deletion of your account and your children's data at any time from our dedicated account deletion page, which is public and needs no login.

That page sets out exactly what is deleted, what we are legally required to keep (invoices), and how long the process takes.

11. Security

• All traffic to the website and app is encrypted with HTTPS/TLS.
• Passwords are stored hashed with Argon2 and cannot be recovered, even by us.
• Staff access to data is governed by per-role permissions.
• Card details never reach our servers; they are entered directly with the payment gateway.
• If a breach affects your data, we will notify you and the competent authority as regulations require.

12. Changes to this policy

We may update this policy as our services or the applicable regulations change. The last-updated date appears at the top of this page, and for any material change we will notify you by email or an in-platform notice before it takes effect.

13. Contact us

For any privacy question or request: info@rubwaeducation.com — phone +966557889286 — WhatsApp +966557884074.

Address: 2826 King Abdullah Branch Rd, Al Sharafiyah District, Jeddah, Saudi Arabia.