Privacy policy

This page describes how Mithaq handles data. It is a practical statement of current practice, not a legal statement of compliance with any regulation without independent review.

What we collect

• Account data: name, email and role. No national ID, precise location or full date of birth.
• Learning sessions: current page, selected question, student messages and assistant replies, attempts, check results and reports.
• Operational logs: request counts to the AI provider, tokens and latency, without conversation text.

What is sent to the AI provider

When a connected model is enabled, we send only the question text, the student's text and selected passages from the student book. Never the student's name, email or any identifier. When no model is enabled, nothing is sent to any provider.

Who sees what

• A student sees only their own sessions.
• A teacher sees students of their classes, struggling skills and reports, and a full conversation only when reviewing a report about it.
• An admin sees content and user management, the action log and aggregate usage, not conversation text.

Retention and deletion

Data lives in the platform database on its server. Deleting a user cascades to their sessions, messages and attempts. Retention periods must be agreed with the school before a real pilot.

Training

The platform does not use student data to train any project-specific model. Provider-side retention is governed by the provider's terms and must be reviewed before enabling it in a school.