Privacy policy

1Who we are

The data controller is Mutaz Abdulaziz Masoudi, under freelance licence no. FL-929420819, who is responsible for mmasoudi.com and the Mu3een platform (mu3een.com). All requests about your data are made through the contact form only (“My data and privacy”); the controller’s official correspondence address is privacy@mmasoudi.com.

Services for individuals are completely free, so we never ask for payment details.

2What we collect and why

• Account: email and name, to run your account and keep your results.
• “Request this subject” form (every field is optional except the subject): job title, sector, employer, city, years of experience, goal and expected exam month — to understand who each subject helps and to plan and improve the material; “how did you hear about us” — to know which channels reach you; a LinkedIn URL if you add one — opened by hand only when arranging training for an organisation, never collected automatically.
• Marketing messages: a separate box that is not ticked in advance; we send them only if you tick it, and every message lets you unsubscribe.
• Contact form: your email, your first name if you give it, the request type and what you write, with a code sent to your email and an automatic bot check — to reply and prevent misuse.
• “Report a mistake” reports: the question's number, subject and exam, your answer and your note — to review and correct the question and tell you the outcome.
• Device binding: your account is bound to one device through a technical device and browser identifier, to protect the content from sharing and copying.
• Technical data: IP address, browser type and security logs, to protect the service.
• Reminder emails: if you agreed to marketing messages, we send a reminder when you leave an attempt open or stay away from the platform, at most one every 7 days and two in 30 days. Every message carries a “pause for 30 days” link and an “unsubscribe” link. The deletion notice sent 30 days before a year has passed since your last sign-in is a statutory message you receive even if you stopped reminders.

On Mu3een we do not ask for ID, a phone number or a date of birth, and there are no profile photos or file uploads. We do not knowingly collect data from anyone under 18.

3No sensitive data

We do not ask for or keep any sensitive personal data as defined by the Personal Data Protection Law: racial or tribal origin; religious, intellectual or political belief; membership of civil associations; criminal and security data; biometric and genetic data; health and credit data; and geolocation data. There is no need to include any of these in your messages to us.

4Storage and statistics

Requests, reports and results are kept in a cloud database to follow up on the service and produce internal statistics: requests per subject, who started and who finished, average results, and visit sources.

“Mu3een in numbers” shows only anonymised totals (questions, answers, practitioners, organisations and cities) that identify no one.

5Only in your browser

Reading preferences (text size and colour mode) and form drafts are kept in your browser only; they never reach us and are cleared with your browser data.

Cookies come in two kinds: essential ones for sign-in, security and form protection, always on and never used for measurement; and comfort preferences (your language and display mode), saved only with your consent. We run no measurement or tracking at present, and you can change your choice at any time from the “Privacy” button.

6Sharing

We do not sell your data or use it for anyone else’s advertising. It is processed on our behalf, only as far as needed, by technical providers: a cloud hosting provider for the platform, Cloudflare to run and protect both sites and store contact requests, Resend to send email, and Google Drive for encrypted backups. We disclose it to no one else except a competent authority under a binding legal request.

7Storage outside the Kingdom

Our technical providers are international, so your data is stored or processed outside the Kingdom by the providers listed above, only as far as needed to provide the service, with encrypted connections and encrypted backups. Since we collect no sensitive data, none of it is transferred.

8Retention

An account and its results are deleted a year after the last sign-in, with an email notice 30 days before (signing in once cancels it). Security logs are kept for 6 months and correspondence for a year, then deleted or anonymised.

Encrypted backups are renewed daily and each is deleted after 7 days; the encrypted archive after one year.

9Your rights

• To know how and why your data is collected.
• To access your data and receive a copy.
• To correct or update it.
• To have it deleted once it is no longer needed.
• To withdraw your consent, including to marketing emails, without affecting anything done before.

To use any of these rights, choose “My data and privacy” in the contact form. We verify your identity with a code sent to your registered email and reply within 30 days.

10Security

We use encrypted connections, restricted access and encrypted backups. If a breach occurs, we notify the Saudi Data and AI Authority (SDAIA) within 72 hours of becoming aware of it, and tell you without delay if it could harm you. We will never ask for your password or verification code by email or phone; deal only with mmasoudi.com and mu3een.com.

11Complaints

If you are not satisfied with our response, you may complain to the Saudi Data and AI Authority (SDAIA).

12Changes

We may update this policy and will publish any change here with its date. It is governed by the laws of the Kingdom of Saudi Arabia, and the Arabic text prevails if the two versions differ.