Privacy Policy

Last updated: July 22, 2026

Array LMS ("Array", "we", "us", "our") provides a cloud-based education-management platform ("the Service") used by schools, training centers, and academies ("Academies") to manage students, instructors, courses, groups, live classes, fees, and related academic operations. This Privacy Policy explains what data we collect through the Service, how we use it, who we share it with, and the choices available to you.

Each Academy that uses Array is the data controller for the personal data of its own students, guardians, instructors, and staff. Array acts as the data processor, operating the platform on the Academy's behalf. If you are a student, parent, or instructor with a question about your data, please contact your Academy first; Array supports Academies in fulfilling their obligations to you.

1. Information we collect

Depending on your role (student, guardian, instructor, or academy admin), the Service may collect:

• Account & identity data: name, email, phone number, role, profile photo, and password (stored as an irreversible hash, never in plain text).
• Student records: date of birth, address, blood group, guardian name/phone/email, enrollment history, attendance, grades, evaluation results, and issued certificates.
• Instructor records: teaching assignments, schedules, attendance, and payroll/earnings calculations.
• Billing & payment data: fee balances, invoices, discount/coupon usage, and payment status. Card and wallet details are handled directly by our licensed payment processor (Paymob) — Array does not store full card numbers.
• Live class data: session schedules, join/leave attendance, and, when an Academy enables recording, a video recording of the class session.
• Communications: in-app chat messages between staff and students, support tickets/complaints, and notifications (in-app, email, and, where an Academy has connected it, WhatsApp).
• AI-assisted learning data: questions submitted to the AI tutor, generated quizzes/summaries, and related usage metadata — processed to provide the feature and not used to train third-party foundation models on your data.
• Technical data: IP address, browser/device type, and login session metadata, used for account security (e.g. detecting suspicious logins) and troubleshooting.

2. How we use information

• To operate core Academy functions: enrollment, scheduling, attendance, grading, certificates, and fee collection.
• To deliver live classes and, where enabled, record and make those recordings available to enrolled students after the session.
• To send transactional communications: enrollment confirmations, payment/installment reminders, session reminders, and account security alerts.
• To provide AI-assisted features (tutoring help, quiz generation, content summarization) requested by the user.
• To maintain platform security: authentication, fraud/abuse prevention, and audit logging of account changes.
• To comply with legal, tax, and accounting obligations (e.g. retaining financial records for the period required by applicable law).

We do not sell personal data, and we do not use student data for third-party advertising.

3. YouTube API Services disclosure

When an Academy enables recording for a live class, the Service automatically uploads the resulting video as an unlisted/private video to that Academy's own YouTube channel. The recording is used solely so that students already enrolled in that course can review the class after it ends. Array does not use YouTube data for any other purpose, and does not use it to build advertising profiles.

By using the recording feature of the Service, the Academy that connects a YouTube channel is also bound by the YouTube Terms of Service and the Google Privacy Policy.

An Academy admin who connected a YouTube channel to the Service can review or revoke Array's access to that Google account at any time from Google Account → Security → Third-party apps with account access. Revoking access stops all future uploads immediately; previously uploaded recordings remain on the connected YouTube channel under that Academy's own control.

4. Who we share data with

We share data only with service providers that help us operate the Service, under contractual confidentiality obligations, and only to the extent needed to provide their function:

• Paymob — payment processing for online/card payments.
• Google / YouTube — hosting of live-class recordings (see Section 3).
• Email delivery providers (e.g. Brevo, or an Academy's own connected SMTP relay) — sending transactional emails.
• Meta / WhatsApp Business Cloud API — sending WhatsApp notifications, only for Academies that have connected this channel.
• AI providers (Groq, Anthropic) — processing AI-assisted tutoring/content requests you submit.
• Self-hosted video infrastructure — for live classes, operated by Array on Academy-dedicated infrastructure.

We may also disclose information where required by law, regulation, or valid legal process.

5. Data retention & deletion

We retain personal data for as long as the Academy's account with us is active, or as needed to provide the Service. Financial records (invoices, payment transactions) are retained for the period required by applicable tax and accounting law, even after a student or instructor record is otherwise deleted.

An Academy admin can request deletion/anonymization of a student or instructor's personal data at any time. On request, we anonymize personally identifying fields (name, contact details, guardian information) while preserving the underlying academic and financial records legally required to be kept, in de-identified form where possible.

6. Security

• Passwords are stored as salted, irreversible hashes — never in plain text.
• Sensitive integration credentials (payment keys, SMTP passwords, messaging tokens) are encrypted at rest.
• All traffic to the Service is encrypted in transit (HTTPS/TLS).
• Two-factor authentication is available, and can be required by an Academy for its admin accounts.
• Each Academy's data is logically isolated from every other Academy on the platform.

7. Children's privacy

Array LMS is designed to be used by Academies to manage students of any age, including minors, under the supervision of the Academy and, where applicable, the student's parent or guardian. Academies are responsible for obtaining any consent required by local law before enrolling a minor and providing their information to the Service. Guardian contact information is collected specifically to support this relationship (e.g. progress updates, fee notices).

8. Your rights

Depending on your location, you may have rights to access, correct, export, or request deletion of your personal data. Requests should be directed to your Academy in the first instance, as they control the underlying student/staff record; Array provides the tools Academies use to fulfil these requests and will assist an Academy directly on request.

9. Multi-academy data separation

Array LMS is a multi-tenant platform: each Academy's students, instructors, courses, fees, and recordings are stored separately from every other Academy's data and are not visible to other Academies. Platform-level administration (billing between Array and an Academy, uptime/security monitoring) does not involve reading individual student records except as needed to provide technical support at an Academy's request.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Service or applicable law. We will update the "Last updated" date above when we do. Material changes will be communicated to Academy admins.

11. Contact us

Questions about this policy or how Array LMS handles data can be sent to: ahmed.reffaey.95@gmail.com.