Privacy Policy
Review draft • Version 1 • 1 November 2026. Not a legal certification or a record of acceptance.
Operator display: ElmEngage.com • Saudi Arabia
Who handles information
ElmEngage.com is the confirmed operator display in Saudi Arabia, not registered-entity proof. Institutions determine educational purposes, enrollment, assessment policies and authorized disclosure; the operator handles account security, service operations and support and may process learning data on institutional instructions. Exact controller/processor allocation and contracts require review. This notice is a development draft, not a compliance certification.
Information actually processed
Managed account identity/session and MFA data; private presentation profiles; account status, scoped memberships and roles; institution-scoped text student identifiers and rosters; attendance facts/corrections; assignments, frozen forms, answers, timing, scores, manual marks and releases; live responses and teams; private images and provenance; AI source text, suggestions, evidence, quotas and operation state; support messages and signed-in feature suggestions; security and audit history. Contact names and reply addresses are optional; only example.invalid addresses are accepted during development. No identity-document uploads are accepted by Contact Us.
Purposes and access
Information supports authorized teaching, attendance, formative feedback, released results, recovery, security and human-reviewed support. Learners see their own authorized released evidence; staff access is scoped. Platform or institution labels do not grant global support access. A separately assigned operator role with genuine MFA is required to read and handle the private support inbox. There is no public message search or suggestion directory.
Browser storage and diagnostics
Essential managed authentication session storage is used for sign-in/security. Language and appearance use taqeemz_locale / taqeemz_theme cookies and taqeemz.locale / taqeemz.theme local storage only when remembering preferences is allowed; cookies last up to one year unless withdrawn. A minimal versioned preference-choice cookie records allow/reject, not identity or authority. No optional analytics or marketing tracker is installed by the application. Hosting, image delivery and error diagnostics may process requests and errors; their contractual retention and regional arrangements require launch review. Receipt secrets and message drafts are kept only in mounted page memory, not URLs or browser persistence.
Service providers and AI transfers
The service uses Lovable Cloud for managed authentication, database and private storage, hosted delivery and diagnostics, and the configured external AI gateway/model for explicitly requested synthetic teaching-text advice. Text and bounded relevant response/rubric evidence may be sent for a request; identity documents and image/document bytes are not forwarded for AI marking. Server-recorded model metadata is not independent provider attestation. We do not claim all data stays in Saudi Arabia, that no third parties are used, or any unverified provider retention/training commitment. Contracts and any international transfer safeguards require official Saudi-law review before real data use.
Retention, corrections and deletion limits
Academic versions, responses, marks, releases, enrollment links and audit/quarantine records preserve provenance and cannot be automatically erased or rewritten by a public request. New support messages have no automatic timed deletion: authorized MFA staff can close a request and then explicitly redact its name, reply address and body with a reason; status, receipt/payload hashes and append-only handling audit remain. Backup/provider copies and legal retention obligations require review. No fixed retention days are promised. A request starts human review, not automatic erasure.
Your questions and requests
Use Contact Us, selecting Privacy question or Personal data request, to ask about information, seek access/correction or request destruction where applicable, withdraw optional presentation preferences, or raise concerns. Describe the request minimally; do not include passwords, student records or ID documents. Any necessary identity verification and coordination with your institution happen outside the public form using a separately approved secure process. Legal conditions and lawful retention may limit an action; rights are not waived by this notice. No response deadline or automatic email is promised during development.
Before real-user launch
Confirm the registered operator, required identity/contact disclosures, actual support staffing and response channel, lawful bases and notices, institution contracts, age/guardian requirements where applicable, retention and backup procedures, hosting/provider locations, transfer safeguards, incident response and policy approval. No universal age threshold or registered address is invented. Publishing this draft does not establish consent or complete these gates.