Privacy policy

First draft — under reviewLast changed: 28 August 2026
The five things that matter
1
We collect what the course needs to work, and nothing else.Your name and email (and your phone number if you gave it), the picture of your transfer receipt, and your study progress.
2
We do not sell your data and do not use it for advertising.Nobody outside the team sees it — and each of us only as much as our role needs.
3
Lecture audio and text are sent to AI services outside Egypt.For transcription and generation. Nothing about you goes with them — not your name, your email or your progress.
4
Your receipt is seen by the reviewing admin only.A private place, never a public link, kept with the order.
5
You may see, correct and delete your data.Write from your registered email to privacy@medafera.com; we answer within 30 days.

01What we collect

  • When you sign up: your name, email, and phone number if you enter it (optional).
  • When you pay: a picture of the transfer receipt — which usually shows your name and the last digits of your account or wallet — and a transfer reference if you enter one.
  • While you study: which lectures you opened and where you stopped, which cards you reviewed and how you rated them, and which questions you answered — right and wrong.
  • For the one-session rule: your browser and device type and the last IP address you signed in from.
  • If you sign in with Google: your name, email and picture from Google only — nothing else from your account.

02What we use it for

  • Opening the courses you bought and reviewing payment orders.
  • Arranging your revision: the cards due are computed from your ratings, and the streak from your study.
  • Protecting the account: preventing sign-in from more than one device at a time.
  • Notifications about you: an order approved or rejected, a lecture published, cards due. Those about orders and security always reach you; the rest you can switch off in settings.

We do not use your data for advertising, and we do not sell it to anyone.

03Who sees your data

  • The Medafera team — access is limited by role; not everyone sees everything. Every decision touching your order or your access is logged under the name of whoever made it.
  • The lecturer — does not see your payment details or your progress.
  • Technical providers — hosting (a server in Germany), the email service, and the service that stores and streams the videos and receipts.
Lecture audio and text are sent to external AI services.

To transcribe the audio and generate the summaries, cards and questions, we send the lecture's audio and text to providers outside Egypt. No personal data about you goes with it — not your name, your email or your progress.

04Payment receipts

A receipt picture holds sensitive details, so it is handled apart:

  • It is stored privately, never on a public link, and opened by the reviewing admin only, through a temporary link.
  • It is kept with the order — the amount, the date and the order number — so that any financial dispute has an answer.

05How long we keep it

  • Your account details — for as long as the account is active.
  • Orders, receipts and access — kept as a financial record.
  • Your study progress — for as long as the account is active.
  • Sessions and the action log — kept for security.

Nothing deletes itself. If you ask to delete your account, we close it and remove your personal details from it; the financial record stays without your name.

06Cookies

We use essential cookies only: the one that keeps you signed in, and the ones that remember your language and your light or dark preference. No advertising cookies and no third-party tracking.

07Your rights

Under Egypt's Personal Data Protection Law (No. 151 of 2020), you may:

  • see the data we hold about you;
  • correct anything that is wrong;
  • delete your account;
  • object to how we use your data.

Write from your registered email to privacy@medafera.com; we answer within 30 days. Deleting an account is not a refund request — refunds have their own path in the terms.

08Security

The connection to the platform is encrypted, and passwords are stored hashed so that nobody can read them — not even us.

If a breach ever touches your data, we will tell you and the competent authority within the period the law sets.