Skip to content
Legal

Privacy policy

What data we collect, why, and how we protect it — and your rights to control it.

Last updated: October 31, 2026·Applies to Manasatna and every academy hosted on it

1. Introduction

Manasatna is a learning management platform serving educational institutions, teachers and their students. This policy explains how we handle personal data, whether you own an academy or are a teacher, a student or a parent.

  • By using the platform you agree to this policy.
  • If the Arabic version and any translation differ, the Arabic version prevails.
  • Each academy’s data is isolated from the others and is never shared with other academies.

2. The data we collect

We collect the minimum needed to run the service:

  • Account data: name, mobile number, email, and a photo (optional).
  • Academic data: courses, grades, assignments, attendance and student progress.
  • Parent data: a contact number for sending reports and alerts.
  • AI assistant conversations: students’ questions to the academy’s AI assistant and its answers.
  • Assistant memory (TodiAI): short notes the assistant writes from conversations about how a student learns, their goals and what confuses them (and, for an academy team member, how they work), up to 200 notes per student and 500 per member, never including numbers, emails, addresses or anything about health or family. Its owner can see it and delete any part or all of it, and the academy can turn it off.
  • Payment data: processed by the payment gateways; we don’t store card details.
  • Technical data: device type, browser, IP address and sign-in history, for security.
  • Video watching: how many minutes of each lesson a student watched each day, and from which device and IP address each video played, so the teacher can follow their students and detect an account shared by more than one person. The device log is deleted after 6 months and the watch log after a year.

3. How we use the data

Use is limited to the following purposes:

  • Running the service: managing courses, exams, attendance and payments.
  • Automatic follow-up: sending alerts and reports to students and parents on WhatsApp, SMS or email.
  • Teacher follow-up: the academy’s teacher and the team members allowed to see students can read each student’s full conversations with the AI assistant and the assistant’s memory about them, to follow and help them. Students are told this in the chat itself.
  • Improving the experience: analysing performance to give personal learning recommendations.
  • Security: detecting suspicious sign-in attempts and protecting content from piracy.
  • Account communications: notices about invoices, renewals and changes to the service.

4. Sharing data

We don’t sell your data. Sharing is limited to service providers we rely on to run the platform:

  • Payments: XPay (card details are entered directly with them and never reach us).
  • Video: Bunny Stream, to host and play course videos.
  • Lesson video transcription (TodiAI): only the audio of lesson videos (without the picture) is sent to Cloudflare (Workers AI, based in the United States) to be turned into text, and the temporary file is deleted from our servers as soon as transcription finishes. The text is kept with us, and the teacher can edit it or exclude any video.
  • AI (TodiAI): runs on Claude by Anthropic (based in the United States; requests are processed on its servers, and it doesn’t use this data to train its models) — students’ questions to the AI assistant and the lesson content it answers from, answers to essay questions being graded (without the student’s name), student follow-up summaries (without their name or number), and the academy team’s questions to the Manasatna assistant and the data it reads to answer (students appear as codes, without names or numbers).
  • Messages: WhatsApp through the academy’s linked number, SMS for verification codes through Todi SMS, email through an SMTP provider, and Telegram through the academy’s own bot if the academy linked one: alerts to its team containing the student’s or visitor’s name, the order and its amount, and the support ticket’s subject, sent to the chat or group the academy chose.
  • Sign-in and domains: Google (if you choose to sign in with Google), and Cloudflare for academies’ own domains and their certificates.
  • Hosting: the platform’s servers, and the WhatsApp gateway server on Hostinger.
  • Manasatna analytics: PostHog (servers in the European Union) — pages visited and usage events on the Manasatna site, the teacher dashboard and academy sites. Session recording happens only on the Manasatna site and the teacher dashboard, with anything typed masked, and all text masked in the teacher dashboard; academy sites (where students are) have no session recording at all.
  • Manasatna advertising: Meta Pixel on the Manasatna site and sign-up pages only — so we know an ad brought a visit or a sign-up. What reaches Meta: the page visited, and that a sign-up happened and which plan was chosen, with no name, number or email. It is not on the teacher dashboard or on academy sites.
  • Academy analytics: Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel and Microsoft Clarity (which records browsing on the page), only if the academy turns any of them on in its settings, and only on its public pages — not on student pages, lessons, exams or payment. The academy is responsible for its use of those tools’ data.
  • Authorities: where there is a binding legal obligation.

5. Protecting data

We use technical and organizational measures to protect your data:

  • Full encryption of connections (SSL) and encryption of sensitive data (AES).
  • Automatic daily backups.
  • Precise permissions for every user and a full log of operations.
  • Device tracking and automatic blocking of suspicious attempts.
  • Regular review of the internal team’s permissions.
  • Manasatna’s support team may open a teacher’s or student’s account in “view as” mode to help or fix a problem: the visit is temporary, everything done in it is logged under the staff member’s name, and the password, mobile number and sign-in methods cannot be changed during it.

6. Your rights

At any time you can ask to:

  • Get a copy of your data.
  • Correct any inaccurate data.
  • Delete your account and data (except what must be kept for legal or accounting reasons).
  • Unsubscribe from marketing messages — essential service messages continue.
  • Object to automated processing of performance data.

7. How long we keep data

We keep data for as long as needed to provide the service:

  • An active academy’s data: for the length of the subscription.
  • After a subscription ends or is cancelled: the data stays saved so you can pick up where you left off, and the academy’s site closes to students. You can ask for the academy and its data to be deleted permanently at any time from the contact page.
  • Invoices and financial records: kept for as long as the law requires.
  • WhatsApp messages and parents’ conversations with the academy: one year (365 days), then deleted automatically.
  • Students’ and the academy team’s conversations with the AI assistant: one year from the last message, then the whole conversation is deleted automatically.
  • Usage events inside the platform: 180 days, and the security audit log: one year, then deleted automatically.

8. Children’s data

The platform is used by educational institutions with students under 18.

  • Getting parents’ consent is the responsibility of the educational institution using the platform.
  • Student data is never used for any advertising.
  • A parent can ask the institution for a copy of their child’s data or for its deletion.

9. Updates to this policy

We may update this policy from time to time.

  • We’ll tell you about any material change by email or in the platform before it applies.
  • The date of the last update is at the top of the page.
  • For privacy matters: write to us through the contact form or on WhatsApp from the contact page.

Questions about your privacy?

For any request about your data (access, correction, deletion), contact us and we’ll reply within 14 working days.