Privacy Policy

Privacy Policy

Last updated: May 9, 2026

MindGrow ("the Platform", "we", "us") is committed to protecting the privacy of its users in accordance with the highest international standards and the personal data protection laws applicable in the Gulf Cooperation Council countries (Saudi Arabia, UAE, Kuwait, Bahrain, Qatar, Oman), the Hashemite Kingdom of Jordan, and the State of Palestine. This policy explains how we collect, use, and protect personal information we receive from you, your dependents, or the educational institution you are affiliated with.

1. Scope of Application

This policy applies to all MindGrow services, including:

• The website mindgrow.school and all subdomains.
• The Parents & Students mobile application on app stores.
• The Schools & Teachers administrative application.
• The Sellers application for the e-commerce marketplace.
• Application Programming Interfaces (APIs) and cloud services connected to all of the above.

2. Definitions

• "Personal Data": Any information relating to an identified or identifiable natural person.
• "User": Parent, child/student, teacher, school administrator, seller, or regular website visitor.
• "Data Controller": The entity that determines the purposes and means of processing personal data.
• "Data Processor": The entity that processes data on behalf of the Controller.
• "Child": Any person who has not reached the age of eighteen as defined by the applicable national law.

3. Data Controllers

MindGrow's role as a Data Controller varies by data category:

• Parents and regular users' data: MindGrow is the primary Controller.
• Students and school data: The school is the primary Controller; MindGrow acts as Processor on its behalf under a separate Data Processing Agreement (DPA).
• Sellers and commercial transactions: MindGrow is the Controller for platform management; sellers are Controllers for their own customer base.

4. Data We Collect

4.1 Account Data

• Full name, email, phone number, password (hashed).
• Gender, date of birth (for children), nationality, national ID number (for sellers and schools only).
• Optional profile photo.

4.2 Children & Students Data

• Name, date of birth, grade, section.
• Attendance records, grades, assignments, behavior logs.
• Child's photo (uploaded only with explicit parental consent).
• NFC card data (numeric card identifier only — no biometric data stored).

4.3 Financial Data

• Billing and shipping addresses.
• Subscription and payment details (processed via Stripe and PayPal — full card numbers are never stored on our servers).
• Transaction history in cafeteria wallet and seller commissions.

4.4 Geolocation Data

• School location (for map display).
• Parent location only during a dismissal request (for geofence arrival detection) — discarded after the request completes.

4.5 Technical Usage Data

• IP address, browser type, operating system, push notification device ID (OneSignal Player ID).
• Login and platform interaction logs for security and analytics.

5. How We Use Your Data

We use data only for the following purposes:

• Service delivery: Account creation, payment processing, classroom management, dismissal coordination, attendance tracking.
• Communication: Order notifications, school updates, security alerts, push notifications.
• Security and fraud: Detecting unauthorized activity, two-factor authentication, account protection.
• Improvement: Analyzing usage patterns to improve features (in aggregated, anonymized form).
• Legal compliance: Responding to lawful requests from competent authorities through proper legal procedures.

6. Legal Basis for Processing

We process your data based on one or more of the following bases:

• Explicit Consent: Especially for children's data and marketing notifications.
• Performance of a Contract: To complete your transactions on the platform.
• Legitimate Interest: To protect the platform from fraud and improve service.
• Legal Obligation: To comply with applicable laws.

7. Children's Data Protection (Under 18)

We apply strict additional safeguards to protect children's data:

• A child may not create an account without explicit parental or school consent.
• The minimum age for an independent child account is 13, subject to parental approval.
• We never share children's data with third parties for marketing purposes under any circumstances.
• The parent has full rights to access, modify, or request deletion of their child's data.
• Upon termination of the relationship between a child and the school, the child's data is securely archived for no more than one year then permanently deleted, unless the parent requests otherwise.

8. The School's Role in Data Processing

When a school subscribes to our services, the school is considered the Controller of its students', teachers', and staff data. The school is responsible for:

• Obtaining necessary consents from parents, teachers, and staff.
• Informing parents of its own privacy policies.
• Managing access permissions within the school panel.

MindGrow acts as a Data Processor under the Data Processing Agreement (DPA) attached to the subscription contract.

9. Data Sharing With Third Parties

We never sell your data. We may share limited data only with:

• Payment providers: Stripe, PayPal, local banks (for transaction processing only).
• Infrastructure providers: Hosting servers, email services (SMTP), SMS services.
• Notification service: OneSignal for push notification delivery.
• AI services: OpenAI / Anthropic / Google when using translation tools (text only, no personal data).
• Competent authorities: Only with a valid court order or legal obligation.

All such parties are bound by strict confidentiality and data processing agreements.

10. Data Security

We apply multiple layers of security:

• SSL/TLS encryption for all communications between browser/app and server.
• bcrypt encryption for passwords stored in databases.
• Two-factor authentication (2FA) via Google Authenticator / Authy for administrative accounts.
• Audit logs for all sensitive operations.
• Daily encrypted backups in multiple geographic locations.
• Regular penetration testing and rapid incident response.

11. International Data Transfer

Your data may be stored or processed on servers outside your country. We always ensure that:

• Recipient countries enjoy a level of protection equivalent to the local law.
• Data transfer agreements are in place with service providers (Standard Contractual Clauses or equivalent).
• The user has the right to object to international transfer with an explicit request.

12. Data Retention

13. Your Rights Under Data Protection Laws

You enjoy the following rights under applicable regional laws (Saudi Personal Data Protection Law 2023, UAE Data Protection Law 2021, Jordanian Data Protection Law 2023, and equivalent GCC laws):

• Right of access: Obtain a copy of your stored personal data.
• Right to rectification: Correct any inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your data in legally specified cases.
• Right to restriction: Request temporary suspension of data processing.
• Right to data portability: Obtain your data in a machine-readable format.
• Right to object: Object to data processing for direct marketing purposes.
• Right to withdraw consent: At any time without affecting prior processing.
• Right to complain: File a complaint with the competent authority in your country.

To exercise these rights, contact support@mindgrow.school. We will respond within 30 days maximum.

14. Cookies

We use essential cookies for:

• Maintaining login sessions.
• Remembering language and currency preferences.
• Protection against CSRF attacks.

We do not use third-party advertising cookies. You can manage cookies from your browser settings.

15. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via:

• Email notification 30 days before the change takes effect.
• In-app notification upon login.
• Updating the "Last updated" date at the top of this page.

Your continued use of the platform after the change notice constitutes acceptance of the updated version.

16. Governing Law and Dispute Resolution

This policy and any dispute arising from it are governed by the laws of the State of Qatar (the country of headquarters). Any dispute is first resolved amicably; if not, it is referred to the competent courts in Doha. However:

• If you reside in a GCC country, Jordan, or Palestine, you have the right to contact your country's data protection authority.
• This provision does not affect your mandatory rights under your country's laws.

17. Contact Us

For any inquiry about this policy or your rights:

• 📧 support@mindgrow.school
• 📱 +974 6601 8814 (WhatsApp)
• 📍 Qatar - Doha
• 🕐 Sunday - Thursday, 9am - 5pm