سياسة الخصوصية

Privacy Policy (English)

ClassArch Companion — last updated 2026-09-05. The Arabic text above is the governing version; this summary is provided for convenience.

The data controller is ClassArch (a Saudi company, commercial registration [CR number]), reachable at support@classarch.com. The extension is designed to collect no personally identifying information: it never reads your chats, never tracks browsing, and never asks for your name, phone number or email.

What we collect

• License key (authentication information) — entered once to activate; stored on the server only as a keyed one-way hash; not retained by the extension after activation.
• Device id (authentication information) — a random identifier the extension generates on first run, stored hashed; used to bind a license to at most 2 devices, together with an optional device label you choose.
• Usage counters (user activity) — per license per day: number of content requests, textbook chunks served and lessons organised for the first time. Deleted after 90 days.
• Lesson text (not personal data) — the first time a lesson is requested, the textbook text of that lesson — curriculum content, never your data — is sent to an AI model through Cloudflare AI Gateway at Google (Gemini) to be organised; the organised text is then stored on our server and served to every teacher afterwards without reprocessing. No license or device identifier, and nothing from your chats, accompanies it.
• Abuse signals (user activity) — per license, device and day: country code and network ASN as determined by Cloudflare, plus a request count. No IP address is stored in our database. Deleted after 90 days.
• Server logs — Cloudflare processes your IP address and technical request data to serve the API and to rate-limit abuse; logs are kept under Cloudflare's own retention (currently up to 7 days for Workers Logs).

We do not collect chat content, browsing history, or any name, phone number or email address through the extension.

Why

• Entitlement — verifying that a license is valid, covers the requested curriculum and is used on no more than 2 devices.
• Abuse prevention — daily quotas, rate limiting, and a weekly report of unusual signals that a person reviews; nothing is blocked automatically.
• Reliability — diagnosing and fixing faults from technical logs.
• Organising lesson text — turning raw textbook text into a tidy text that fits one message (see "What we collect").

Where (cross-border transfer)

The API and database run on Cloudflare, an international infrastructure provider. The data listed above is therefore processed and stored outside Saudi Arabia. No adequacy decision under the Saudi Personal Data Protection Law currently covers the countries where this data is stored. The service minimises the impact: nothing transferred contains a direct personal identifier, and the license key and device id are stored only as hashes.

The lesson text sent to the AI model (see "What we collect") is textbook content only; it passes through Cloudflare to Google outside Saudi Arabia and carries no personal data or identifiers of you or your device.

Payment and Salla

Purchases are made through our store on Salla. Salla processes the payment and the customer data attached to the order (name, mobile, email, payment method) as an independent controller under its own privacy policy. We never receive card or payment details. Our server receives order notifications from Salla (order number, status, purchased product) for audit, refunds and stock tracking, keeps only a minimal record, and deletes the full notification body after 7 days.

Retention

• Usage counters and abuse signals: 90 days.
• Full Salla notification bodies: 7 days (a minimal order record remains).
• Device session token: up to 180 days from last use; it stops granting any access the moment the device is signed out or the license is revoked, and the record is deleted when it expires.
• License–device binding: for the life of the license; bindings idle for more than 90 days are released automatically when a new device needs the slot.
• Hashed license record: up to 12 months after expiry or revocation.
• Cloudflare server logs: Cloudflare's retention (currently up to 7 days).

Your rights

Under the Saudi PDPL you may access, correct, delete, object to the processing of, or obtain a copy of your data. Because we hold no personal identifier, we will ask for your license-key prefix (first 8 characters) or Salla order number to locate the related records. Send requests to support@classarch.com; we commit to responding within 30 days. You also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).

Security incidents

If you suspect unauthorised access to your data or your license key, contact support@classarch.com immediately with "Security report" in the subject line. Should a breach affect your data, we will notify you and the competent authority as the law requires.

Chrome Web Store compliance

The extension does not use Google APIs to access user data. As required by Google:

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Permissions requested: local storage (device id and session only), side panel, and inserting text into the three supported sites only (chatgpt.com, claude.ai, gemini.google.com). The extension loads no remote code.

Changes to this policy

Updates are published on this page with a new "last updated" date; material changes are announced inside the extension before they take effect.

Governing law

This policy is governed by the laws of the Kingdom of Saudi Arabia, in particular the Personal Data Protection Law and its Implementing Regulations. The supervisory authority is SDAIA, with which you may lodge a complaint.