Terms & conditions

1.1. These Terms and their related appendices constitute a legally binding agreement, drafted in accordance with the Electronic Commerce System issued by Royal Decree No. (M/126) dated 7/11/1440H, the Consumer Protection System, the Personal Data Protection Law (PDPL), and other relevant regulations in the Kingdom of Saudi Arabia, between:

1.1.1. [Qader 3aididak Alali Establishment] (the "Establishment" or "We"), a registered entity in the Kingdom of Saudi Arabia with Commercial Registration No. [CR 7050636419] and headquartered at [Al Khobar, Al Olaya, Bseil Tower], and which term "Establishment" includes — for the purposes of legal protection and liability limits — its subsidiaries, holding companies, and branches within and outside the Kingdom.

1.1.2. And the natural or legal person who accesses or uses the Service (the "User" or "Client"). In the case of educational institutions, acceptance by the institution’s representative constitutes acceptance by the "Institutional Client," and the person who clicks "I Agree" acknowledges that they are legally authorized to contract and commit on behalf of the entity.

1.2. No director, employee, agent, or subcontractor is considered an independent party to this Agreement; however, the liability limits, warranty disclaimers, and indemnity provisions set forth herein extend to them as "third-party beneficiaries," to the extent permitted by law.

1.3. The term "Service" includes all websites, applications, portals, dashboards, APIs, features, educational materials, artificial intelligence components, and technical support provided by the Establishment.

1.4. The Privacy Policy, Cookies Policy, Data Processing Addendum (DPA), Service Level Agreement (SLA), and Purchase Orders/School Agreements — if any — form an integral part of this Agreement. The order of precedence specified in Clause (100) shall apply. The Arabic version and the latest published version according to Clause (1) shall prevail.

1.5. When the User is a minor, the account shall not be activated except through the consent mechanisms of the guardian or educational institution and the provisions of Clauses (9-11). Acceptance that does not satisfy guardianship conditions shall lead to a suspension of future use after reasonable verification, without creating any right to a refund for periods already paid for.

1.6. If the Service is used for an institutional purpose without proper authorization, the person who completed the acceptance shall bear responsibility towards the Establishment for actual damages and reasonable collection costs arising therefrom, without prejudice to the right of recourse against the entity they claimed to represent, to the extent permitted by law.

2.1. Definitions and Cross-References.

2.2. Effective Date: The date indicated at the top of this document as the date on which the version becomes effective.

2.3. Version Number: A unique identifier for the version (e.g., vX.Y.Z) used for reference and comparison.

2.4. Last Updated Date: The timestamp of the last substantive or editorial modification made to this document.

2.5. Effect of the Version and Effect on Previous Versions.

2.6. The latest published version under the stated version number shall prevail and supersede all conflicting previous texts as of the Effective Date.

2.7. Drafts or unpublished materials shall have no contractual effect.

2.8. The foregoing shall not prejudice any rights or obligations that arose and were in effect under a previous version before the Effective Date of the new version, unless expressly stated otherwise.

2.9. Scope of Application by Client Category.

2.10. Updates apply immediately to new users upon account creation.

2.11. For existing clients, updates apply as of the announced Effective Date, subject to the notification and re-acceptance mechanisms for substantive amendments referred to later in the "Acceptance" and "Amendments" clauses.

2.12. If there is a signed agreement/purchase order with the educational institution that contains an express conflicting text regarding the Effective Date, that text shall prevail within its subject matter and to the extent that it does not undermine the rest of the provisions.

2.13. Governing Language and Translations.

2.14. The Arabic language shall be the governing and binding text for these Terms and all their appendices and documents.

2.15. Translations — if provided — are for convenience only, and in case of any conflict, the Arabic text shall prevail.

2.16. No text in another language shall be considered a governing text unless it appears in a specialized appendix that is expressly signed and indicates the applicability of that language to that appendix alone; however, its Arabic translation remains the interpretative reference.

2.17. Time Controls and Reference Timestamps.

2.18. All dates and times related to publication and modification shall be calculated according to the time zone of the Kingdom of Saudi Arabia (UTC+3) unless otherwise stated.

2.19. Publication logs, internal logs, and distinctive version timestamps shall be adopted as technical evidence of the Effective Date and the fact of the update, unless their manifest error is proven.

2.20. Notification of Amendments and Transparency.

2.21. Any updates shall be published with a Version Number and a Last Updated Date, along with a reasonable summary of changes outlining the most significant modifications. The User of the Site is required to periodically review the Terms and Conditions page to be aware of any changes.

2.22. A message shall be sent to Users upon the occurrence of any updates through the Site's notification system, or via email.

2.23. Urgent amendments imposed by regulatory or security considerations are exempt from prior notice, provided that notification is completed within a reasonable period.

2.24. Archiving and Availability of Previous Versions.

2.25. Previous versions and the amendment log shall be retained for a period of no less than twenty-four (24) months and shall be made available upon request to legal authorities for reference purposes.

2.26. The Company may shorten or extend this period if there is a conflicting regulatory obligation or a preponderant security interest, with reference to that in the version log.

2.27. Non-Retroactivity as a General Principle.

2.28. Amendments shall not have retroactive effect on periods already served or amounts already due, unless the law stipulates otherwise or the Parties expressly agree in writing.

3.1. Establishment/Establishment: "Qader 3aididak Alali Establishment", registered in the Kingdom of Saudi Arabia, referred to in this document as the "Establishment" or the "Establishment," and the pronouns "We/Us/Ours" refer to it.

3.2. Platform/Service: All digital products and services provided by the Establishment, including websites, applications, APIs, artificial intelligence tools, dashboards, content, related features, and technical support, as available from time to time.

3.3. Educational Institution: Any school, educational institution, or professional entity that contracts for subscriptions on behalf of its students/members, whether as a data controller or processor, as determined by the Data Processing Addendum (DPA).

3.4. Intellectual Property Rights: All rights legally protected, including copyright and neighboring rights, database rights, trademarks, trade names, designs, patents, and trade secrets, registered and unregistered, as detailed in their respective clauses.

3.5. User: Any natural or legal person who uses the Platform or creates an account on it, includes — depending on context —:

3.6. Student: The minor or adult user who uses the Platform for learning/training purposes, whether through an individual subscription or via an educational institution.

3.7. Guardian: The person legally authorized to supervise and represent the minor and grant necessary consents, including registration and withdrawal of consents according to the controls set forth in these Terms and the DPA.

3.8. Teacher: A user authorized by the educational institution to manage classes/student groups and view performance reports within specified permissions.

3.9. School Principal: An administrative user accredited by the educational institution who holds permissions to manage licenses and seats, compliance settings, consent logs, and incident notifications.

3.10. User Information: Collectively refers to the "Personal Data," "Sensitive Data," and "Technical Identifiers" of the User as defined in these Terms, the Privacy Policy, and the DPA, including account data, educational activities, and telemetry, according to the legal bases for processing in its clause.

3.11. Content: Everything displayed, uploaded, or generated via the Platform, including educational materials, user-generated content (UGC), artificial intelligence outputs, discussions, files, and media, includes:

3.12. User Content: Any data, texts, images, videos, audio materials, documents, or inputs uploaded by the User or provided to the Platform, and any AI-generated outputs based on those inputs specific to that User.

3.13. Establishment Content: All materials, software, interfaces, designs, databases, documentation, and educational content owned by the Company.

3.14. Third-Party Content: Any content or service provided by a third party and subject to its separate terms.

3.15. Prohibited Content: Any content that violates the law, Community Policies, or the rights of others, includes, by way of example and not limitation: illegal, pornographic, violent, inciting, racist, defamatory, or intentionally misleading content, or content that infringes intellectual property or privacy, or contains harmful software/code/scripts, fraudulent attempts, identity theft, leaking exam solutions, or any materials harmful to security or reputation. Removal and restriction procedures under (15), (82), and (16) apply.

3.16. Personal Data: Any information relating to an identified or identifiable natural person, directly or indirectly, in accordance with the Personal Data Protection Law (PDPL) in the Kingdom.

3.17. Sensitive Data: Personal data whose disclosure or misuse could result in significant harm, includes — by way of example and not limitation — exam results, behavioral and interaction indicators, voices, images, videos, conversations, and any data relating to minors classified as sensitive under the law.

3.18. Technical Identifiers: IP addresses, device and browser identifiers, advertising identifiers, cookies/LocalStorage, timestamps, and system logs necessary for operation, security, and compliance.

3.19. Minor: A person who has not reached the age of majority according to the laws in force in the Kingdom at the time of use/contracting. If the legal definition changes, the updated age shall be adopted without requiring an explicit amendment to these Terms.

3.20. Business Days: Sunday through Thursday – inclusive of Sunday and Thursday - excluding public/ official holidays.

3.21. Calendar Month: The period from the first day to the last day of the same Gregorian month. Activation: The subscription is considered activated upon the occurrence of any one of the following actions: (a) logging in to any portion of paid content, or (b) starting to solve any test or exercise, even if not completed, or (c) viewing any part of an educational video, even for a few seconds, or (d) using any AI tool, including sending any query, or (e) downloading, opening, or previewing any digital file, or (f) participating in any study group or "Study with Me" session or educational game, or (g) accessing any paid content page. Activation is proven through the Platform's electronic logs (including server logs and access logs), which shall be conclusive evidence unless the User provides a valid technical evidence proving otherwise. Material Technical Fault: Any failure in the Platform's systems or servers that completely prevents the subscriber from accessing paid content for a continuous period exceeding four (4) hours, provided that the fault is solely from the Platform's side and not due to misuse, telecommunications provider outages, or third-party services. Partial interruption while the majority of content remains accessible is not included.

3.22. Written Notice: Notice sent via the dashboard within the Platform, or to the registered email address, or phone number, or any other registered method, or any official channel specified in the Notices Clause; the sending or publishing shall be considered the start of the notice's effectiveness.

3.23. Core Feature: Any essential function necessary for the ordinary use of the Service as described in product documentation and the SLA (e.g., account creation, login, conducting educational sessions, progress tracking, contracted integrations).

3.24. Monthly Availability: The percentage of Service availability during a calendar month, calculated according to the formula stated in the Service Level Agreement (SLA) Appendix, with exemptions for pre-announced maintenance, force majeure, telecommunications provider outages, third-party services outside the Establishment's control, and misuse.

3.25. Material Defect: A continuous or repeated failure that reduces Monthly Availability below (99%) or disables a Core Feature for a period exceeding (72) consecutive hours within a single calendar month, after written notice and granting a remediation period of no less than (48) hours.

3.26. Misuse: Any use that does not comply with learning plans/recommendations/technical requirements/announced Community Policy, includes — by way of example and not limitation —:

▐ Failure to complete setup requirements, placement tests, or required assignments.

▐ Disabling necessary features or ignoring notifications affecting usage.

▐ Using unsupported devices/browsers or an unstable internet connection.

▐ Violating the Community Policy or engaging in cheating/deceptive patterns.

▐ Not adhering to the proposed schedule within the Platform.

▐ Blocking necessary permissions (e.g., microphone) when required for a specific feature.

▐ Entering misleading or incomplete data affecting the accuracy of recommendations.

▐ Misuse is not attributed to the User when there is a technical disability whose requirements were not clearly announced, or which was due to an external provider outside their control.

3.27. Service Level Agreement (SLA): The appendix that defines performance and availability metrics, response times, and the framework for requesting credits, and serves as the governing reference for measuring technical failures and their remedies.

3.28. Service Credits: Non-cash compensation calculated as credit for future usage/fees within the current subscription period exclusively, not convertible to cash or deferrable beyond the period, and shall be the sole and exclusive remedy for Service Level failures to the extent permitted by law.

3.29. Force Majeure: An event beyond the reasonable control of the affected party that impedes the performance of obligations, includes — by way of example and not limitation —:

▐ Natural disasters.

▐ National telecommunications network outages.

▐ Emergency regulatory orders or service blocks.

▐ Large-scale security disruptions.

3.30. Reference Records: The Establishment's monitoring logs, logs, status dashboard, and rate management systems (WAF/Firewall/Rate Limiter) shall be considered a technical reference evidence for measuring availability, outages, and request rates, unless their manifest error is proven by an independent technical report according to industry standards.

4.1. Scope of Exclusivity: For any failure related to Service Levels — including "Material Defect" — the sole and exclusive remedy shall be the granting of "Service Credits" according to the Service Level Agreement (SLA) Appendix, without termination or monetary refund, to the extent permitted by law.

4.2. Eligibility for Credits (B2B): Service Credits apply to contracting educational institutions subject to the SLA signed with them. Eligibility requires compliance with published technical requirements and payment of due fees.

4.3. Individual Support (B2C): For individual Users, technical support is provided on a "Best Effort" basis, without a commitment to a specific response time, and without any right to Service Credits or financial compensation.

4.4. Regulatory Exceptions: This clause does not prejudice any mandatory rights conferred by Saudi law that cannot be contractually violated. In case of an unavoidable conflict with the law, the application of this clause shall be adjusted to the extent necessary without affecting its validity in other respects.

4.5. Claim Mechanism: A Service Credit request must be submitted through the channel specified in the SLA within (30) days from the end of the affected month, stating the date/duration of the outage and the affected feature. Failure to submit within the deadline constitutes a waiver of the claim for that period.

4.6. Credit Caps: Credits are calculated according to the SLA schedule, with a maximum of (25%) of the fees for the affected month, and an aggregate cap of (10%) of the annual contractual fees per contract. Credits do not accumulate across years.

4.7. Nature of Credits: Credits are non-cash, non-transferable, non-exchangeable, and non-deferrable beyond the current subscription period. They are automatically consumed against subsequent invoices during the same period and lapse upon its expiry.

4.8. No Set-Off/Suspension: The Client shall not set off or suspend payment based on alleged outages except by a final court judgment or written consent from the Establishment.

4.9. Exclusions: Outages resulting from the following are not counted:

▐ Pre-announced maintenance (with notice exceeding 24 hours).

▐ Force Majeure.

▐ Telecommunications provider outages.

▐ Third-party service failures outside the Establishment's control.

▐ Misuse and non-compliance with published technical requirements.

4.10. Authority of Records: The Establishment's monitoring records, status dashboard, and rate management systems shall be considered a technical reference evidence for measuring availability and outages. A counter technical evidence is not acceptable unless provided by an independent accredited entity using a pre-agreed measurement methodology.

4.11. No Termination Right Created: Credits — nor the technical failures covered by the SLA — shall create any right for the Client to terminate the contract or obtain a monetary refund for periods already served, to the extent permitted by law.

4.12. Effect of Termination/Suspension: Any suspension or termination resulting from the Client's breach of the Terms or technical requirements does not entail any refund, and fees remain due for the contracted period; unused Credits lapse.

4.13. Relationship with Other Documents: In case of conflict, the provisions of this clause and the SLA appendix shall prevail over any conflicting text in Purchase Orders/vendor portals, unless a specific appendix expressly conflicting is signed by both parties.

4.14. No Guarantee of Academic Results: Failure to achieve a specific academic result or performance decline is not considered a Service Level failure and does not create a right to Credits or refunds.

4.15. This clause is subject to the exclusivity of remedy established in Section [K] and Appendix 7 (SLA).

5.1. Scope of Agreement and Parties: This Agreement constitutes the governing framework for the use of "Qader" by (a) individuals, and (b) educational institutions in their professional capacity; the School Principal/legal representative is considered an authorized representative binding the entity and all its affiliated Users, to the extent permitted by law.

5.2. Express Acceptance Requirement (Clickwrap): No account shall be created, and no Core Feature shall be made available except after an express acceptance within the product (Clickwrap), with a link leading to the effective version of the Terms and Conditions at the time of acceptance. Relying on "browsing constitutes acceptance" (Browsewrap) is prohibited.

5.3. Accessing, browsing, or downloading any part of the Site — without creating an account — constitutes preliminary acceptance of the applicable Terms and Policies (including the Privacy Policy and the Cookies Dashboard), to the extent permitted by law, provided that express acceptance (Clickwrap) remains a necessary condition for opening an account or using any Core Feature.

5.4. If you do not agree to the Terms, you must immediately stop using the Site and not access any part of the Service.

5.5. Upon any substantive amendment, express acceptance will be re-requested for accounts. Continued general browsing after the amendment is published constitutes preliminary acceptance of the updated Terms until express acceptance is requested when accessing Core Features.

5.6. If you are a minor, no account shall be created, and Core Features shall not be made available except through the Guardian's consent mechanisms and the provisions of Clause 10; general browsing may be restricted in accordance with minor protection policies.

5.7. Acceptance Credentials and Audit Trail: Each acceptance is linked to a timestamp, IP address, device/browser identifier, Terms version number, and a digital hash of the accepted version's content. Records are retained in a tamper-resistant audit repository for no less than (24) months from the end of the relationship, and digitally signed excerpts may be made available upon legitimate request.

5.8. Acceptance of Affiliated Users (B2B): The educational institution's agreement to the Terms constitutes the basis for the B2B contract. Each affiliated User (student/teacher/admin) is required to give express acceptance upon first login. The entity is obligated to inform its internal users of the Terms' content.

5.9. Minors and Guardianship: A minor's account shall not be created except according to the Guardian/Institution consent mechanisms detailed in the Minors Clause. The account is immediately suspended upon proof of the absence of valid consent, without liability on the Establishment for any resulting data loss.

5.10. Informing the School Principal, Integrations, and Login Flows (SSO/API): Informing the School Principal – in writing and documented via one of the communication methods with them, such as email, phone number, or Platform account – of the Guardian's consent, or successful authentication via a trusted identity provider (SSO) such as Nafath or the Guardian's phone number – if activated in the future – shall be considered evidence of the Guardian's acceptance of the Terms. The School Principal bears responsibility – in the first case – if proven otherwise.

5.11. Substantive Updates and Re-Acceptance: Upon any substantive amendment affecting core obligations or materially altering the User's rights, express acceptance will be re-requested upon the next subsequent login after reasonable notice within the product/dashboard. Failure to accept leads to the suspension of Site access.

5.12. Non-Substantive Updates and Continued Use: Clarificatory, organizational, or non-material rights-affecting amendments become effective from the "Last Updated" date. Continued use after notice within the product constitutes agreement thereto, to the extent permitted by law.

5.13. Refusal of Acceptance and Termination of Use: Those who do not agree to the Terms or a mandatory substantive update must cease use and delete the account or request its closure. Refusal does not create any refund for periods already paid for, according to billing and refund clauses.

5.14. Nature of Legal Relationship: This Agreement does not create an employment, agency, partnership, or franchise relationship between the User/Entity and the Establishment. The relationship is an independent service contract.

5.15. Electronic Admissibility: The User/Entity acknowledges the validity of electronic contracting and the reliability of acceptance records and digital communications as admissible evidence, to the extent permitted by law.

5.16. Priority of Documents: These Terms apply along with signed Purchase Orders/Agreements, Privacy Appendices, and the SLA according to the order of precedence stated in the "Entire Agreement and Order of Precedence" Clause. Any printed terms/vendor portal terms do not apply unless incorporated into an appendix expressly signed.

5.17. Language of the Governing Text: The Terms are presented in Arabic, which is the governing and binding text. Any translation is for convenience only, and in case of conflict, the Arabic text shall prevail.

5.18. Notice of Acceptance of Version: A confirmation message is sent to the User/School within the product/verified email, including the accepted Version Number and a reference timestamp. The Establishment's records shall be considered technical evidence of the completion of acceptance unless manifest error is proven.

5.19. Warranty of Authorization: The educational institution warrants that the person who completed acceptance on its behalf is legally authorized, and bears sole responsibility for any consequences arising from incorrect authorization or unauthorized use.

6.1. Accessing, browsing, or using any part of the Service constitutes acceptance of these Terms, the Privacy Policy, and related Appendices, to the extent permitted by law, without prejudice to mandatory rights that cannot be contractually violated.

6.2. No account shall be created, and Core Features shall not be made available except after express acceptance (Clickwrap) documented with a timestamp, IP address/device ID. Acceptance will be re-requested upon any substantive amendment. The acceptance record is kept in an audit repository.

6.3. When using the Service for an institutional purpose (e.g., schools), the person who clicks "I Agree" acknowledges they are legally authorized to represent the contracting entity. This acceptance creates an obligation on that entity for fees and terms, while any individual use remains subject to minor and legal guardianship policies where applicable.

6.4. In the case of minors, activation only occurs through the Guardian/Educational Institution consent mechanisms stipulated in the Minors' clauses. That consent remains revocable according to the stated effects, without creating a right to a refund for periods already served.

6.5. If the User believes an acceptance or login was made in error or without proper authorization, they must notify us via the channel specified on the "Contact" page within five (5) Business Days of the incident; the effect is limited to suspending future use after reasonable verification, without prejudice to what has been already provided.

6.6. Not reading the Terms does not exempt one from adhering to them after completing express acceptance or continuing to use the service, without prejudice to the invalidity of any consent proven to have been given under legally established duress.

6.7. If you do not agree to any substantive amendment, the solution is to stop using the service and cancel the subscription for the future according to cancellation mechanisms, without a refund for what has already been provided, according to the fees and termination clauses.

6.8. The published Arabic version and its latest edition shall prevail. Notices within the dashboard or sent to the registered email are effective from the time of publication/sending.

7.1. Scope of Electronic Consent: The User/Educational Institution agrees to conduct business and communicate with us electronically, including — without limitation —:

▐ Service, security, and privacy notices.

▐ Terms updates, billing messages, and receipts.

▐ Operational alerts.

▐ Support correspondence.

▐ In-product consents/acknowledgments.

Through approved channels including — without limitation —:

▐ The registered email address.

▐ In-platform/dashboard notifications.

▐ SMS messages (OTP/alerts).

▐ In-app push notifications, to the extent permitted by law.

7.2. Evidentiary Value of Electronic Contracting and Signatures: Electronic consents — including: clicking the "I Agree" button (Clickwrap), entering a verification code (OTP), entering a name/signature via an approved electronic signing platform, or any electronic action indicating acceptance — are considered valid, binding, and equivalent to a handwritten signature in terms of legal effect. In school contracts, the acceptance issued by the School Principal/legal representative binds the educational institution within the limits of their authorization.

7.3. Approved Sending Channels: "Qader" adopts the following channels for notification:

▐ Publication within the Platform/dashboard.

▐ The registered email address.

▐ SMS/authentication messages (OTP).

▐ In-app notifications.

More than one channel may be used for the same incident when required by legitimate interest or security requirements.

7.4. Reference Receipt Rules: The receipt rules established in the "Service Notices" Clause apply. A notice is considered received upon publication within the dashboard or upon sending to the registered email address — whichever is earlier — unless manifest error is proven.

7.5. Minimum Technical Requirements: The User/Entity is responsible for providing a modern device and browser, a stable internet connection, enabling receipt of emails from our domains, and maintaining the validity of communication means. Any failure arising from the User's environment (email filtering/full mailbox/domain blocking/notification disabling) does not impose liability on the Establishment.

7.6. Updating Contact Data and Authorized Entity (B2B): The educational institution is obligated to designate a "Communications Officer" and update their email/number within the dashboard. We may rely on the last data provided until a documented update is received. In case of non-designation, the School Principal shall be considered the Communications Officer.

7.7. Managing Preferences and Withdrawing Consent: The User may withdraw their consent to marketing communications at any time through account settings. This does not affect necessary service, security, privacy, and billing notices, which remain electronic as a condition for providing the Service. General withdrawal of consent for electronic communication may lead to the restriction or suspension of some features due to the inability to provide them via a paper alternative, to the extent permitted by law.

7.8. Paper Copies Upon Request: A paper copy of a specific agreement or notice of a contractual nature may be requested through the announced channels; a reasonable fee may be imposed to cover preparation/printing/shipping. This does not prejudice the electronic version being the governing version.

7.9. Archiving Records and Admissibility: We retain audit records of sending, receiving, and acceptance processes (timestamp, IP/device ID, version number, and digital hash of the notice/agreement content) in a tamper-resistant repository throughout the relationship and for a period of no less than (24) months thereafter. Digitally signed excerpts may be made available upon legitimate request.

7.10. Governing Language: Primary contractual communications are provided in Arabic and may be accompanied by a translation for convenience. In case of conflict, the Arabic text shall prevail.

7.11. SMS and Provider Costs: Verification codes/alerts may be sent via SMS; the telecommunications provider may impose charges borne by the User/Entity.

7.12. Security of Communications and Fraud Alerts: Our correspondence is sent from announced domains and protected by encrypted channels where possible. We will never ask for your password. The User must immediately report any suspicious correspondence via official channels.

7.13. Regulatory Exemptions: If applicable laws require providing a notice or document in a non-electronic form for a specific incident, we will comply with that limit without affecting the validity of electronic communications for other incidents. For minor accounts, the Guardian/Institution consent mechanisms stipulated in the Minors Clause shall be observed.

7.14. You confirm that you possess the legal capacity to enter into contracts, are not subject to any legal restriction or sanction list preventing you from using the Service, and that your use is within the Kingdom according to Clause (78).

7.15. Use of the Service is prohibited if you have previously been suspended or had your account terminated for any legitimate reason; the prohibition includes any attempt to re-register directly or through others. We may block associated devices/addresses.

7.16. For Educational Institutions: The person completing acceptance acknowledges they are legally authorized, and the institution bears the consequences of any unauthorized use.

7.17. You must provide accurate and complete data and update it periodically. We reserve the right to request reasonable verification (OTP/Identity/School verification).

7.18. The Service may be suspended or restricted upon providing misleading data or refusing verification, without any entitlement to a refund for previous periods.

8.1. Service Description and Limits: "Qader" is an AI-powered educational platform providing learning tools, interactive content, progress tracking, and advisory recommendations. The Platform does not provide professional consultations (academic/legal/medical/psychological), does not act as an academic accreditation body or official student evaluation, and is not a substitute for the role of the teacher/advisor/school.

8.2. Educational Purpose and Non-Professional Reliance: All outputs — including analyses and recommendations from AI models — are advisory for educational purposes only and must be subjected to appropriate human review. They should not be relied upon for high-impact decisions (e.g., official evaluations, academic admission, or behavioral reports) without independent human verification.

8.3. No Guarantee of Results: The Platform does not promise achieving specific grades or performance improvement; outcome variability depends on the User/Institution's commitment to learning plans, the technical environment, and individual factors.

8.4. Service Provision "As Is" and "As Available": The Service is provided "AS IS" and "AS AVAILABLE" without any warranties of any kind — express or implied — including fitness for a particular purpose or freedom from errors or interruptions, to the extent permitted by law. "Qader" strives to maintain high availability and minimize any disruptions through commercially reasonable efforts, without guaranteeing uninterrupted continuity, to the extent permitted by law.

8.5. Without Prejudice to Mandatory Rights: The foregoing does not prejudice any mandatory rights conferred by law on consumers within the Kingdom of Saudi Arabia, and these rights shall be applied when they are mandatory.

8.6. Digital Accessibility: The Establishment makes reasonable efforts to align interfaces with WCAG 2.1 principles within the limits of technical and practical capabilities, without a contractual commitment to achieve a specific compliance level. Channels are available to request reasonable accommodations where possible.

8.7. Third-Party Content and Services: The Service may include links or integrations with external providers (including AI models/components or educational media). Their use is subject to their separate terms, and the Establishment makes no warranty regarding their accuracy, availability, or security.

8.8. Service Evolution and Feature Modification: The Establishment reserves the right to develop, modify, or discontinue any features – if it becomes apparent they are harmful in any way to the Establishment or the User – provided this does not reduce the essence of the educational service or eliminate the primary purpose of the Site, which is to facilitate the learning process, according to the "Amendments to Terms, Policies, and Services" clauses, and without creating any obligation to guarantee a specific performance.

8.9. High-Risk Scenarios: The Service is not used in contexts requiring professional reliance or specific regulatory compliance (e.g., officially accredited evaluation tools, disciplinary decisions, or pedagogical diagnosis) except with additional written controls and express approvals from the educational institution.

8.10. Limits of Educational Content: The Establishment strives to update its content to keep pace with the modernity of each educational subject and the nature of test contents at all times, but does not guarantee this. The educational institution/User is responsible for verifying suitability and alignment with current curricula and the nature of the tests before relying on them.

8.11. Operational Alternatives Instead of Warranty: In the event of partial failures or reasonable slowdowns, the Establishment may provide alternative paths/temporary workarounds through reasonable efforts. For school subscriptions subject to the Service Level Agreement (SLA), Service Credits — where their conditions apply — are the sole and exclusive remedy, without any commitment to a professional warranty of results.

9.1. The Platform, its Services, Content, and AI model outputs are provided "AS IS" and "AS AVAILABLE," without any express or implied warranties — including, without limitation: fitness for a particular purpose, merchantability/quality warranty, accuracy, completeness, freedom from defects, non-infringement — to the extent permitted by law.

9.2. Accuracy, Currency, and Reliability: The Establishment does not guarantee the accuracy, currency, or completeness of any material or content within, linked to, or produced by the Platform. The User is responsible for conducting appropriate verification before relying on any content, especially for academic/professional/commercial purposes.

9.3. No Guaranteed Results/No Professional Advice: All recommendations/indicators/analyses — including AI-generated ones — are advisory and may be incorrect. They are not a commitment to achieving a specific grade/result and are not a substitute for academic/professional/legal advice.

9.4. Service Availability and Security: The Establishment does not guarantee uninterrupted, error-free, virus/malware-free, interruption-free, or delay-free availability. It is not responsible for telecommunications provider outages or third-party services/systems outside its control. The sole remedy for Service Level failures is according to the SLA (non-cash Service Credits), and no right to a monetary refund arises.

9.5. Relations with Third Parties: The Establishment is not a party to any relationship, dealing, or transaction arising between Users or between them and advertisers/third parties. It provides no warranties regarding them, and the risks and liabilities remain solely with the creator of the relationship.

9.6. Third-Party Content/Advertisements: Any content, material, or advertisement provided by a User/advertiser/third party is their sole responsibility, without any acknowledgment or warranty from the Establishment. The Company has the right to remove/disable content if it violates laws or policies.

9.7. Limits of Liability: The Establishment does not bear any indirect or consequential losses (loss of profit/business interruption/data loss, etc.) to the extent permitted by law. This does not apply to liabilities that cannot be legally limited (such as intentional fraud or gross bodily harm).

9.8. Mandatory Consumer Rights: This clause does not prejudice any mandatory rights conferred on consumers that cannot be contractually violated under applicable laws.

10.1. Scope of Eligibility and Geographic Purpose: The Service is directed to Users within the Kingdom of Saudi Arabia. Joining requires the individual to have the legal capacity to contract or to possess a legally authorized representative from the educational institution/entity. The registrant acknowledges they are not subject to sanctions or watchlists, and that they are not a resident of prohibited zones under laws or relevant compliance instructions.

10.2. Minors and Their Representation: A minor's account is created only according to the mechanisms stated in the "Minors, Guardian Consent, and Supervision Mechanisms" and "Registration via an Educational Institution" clauses. The educational institution acknowledges that it has obtained Guardian consents according to the law and bears responsibility for the correctness of the school identity linkage and the accuracy of records.

10.3. Data Accuracy and Duty to Update: The User/Educational Institution is obligated to provide accurate, complete, and up-to-date data upon registration and throughout the period of use, including legal name, title, school identity, and contact means. The Company may suspend/restrict/cancel the account upon proof of misleading or incomplete data or refusal to update it within a reasonable period.

10.4. Identity and Authorization Verification: The Company may verify using means including: one-time password (OTP), verification via institutional email/school registry, matching with device ID/IP address, or requesting supporting documents (e.g., authorization, business card, or institutional letter). Registration may be rejected or cancelled, or permissions restricted if verification fails or ineligibility is proven. Timestamps, acceptance records, and linkage are retained as audit evidence.

10.5. Prohibition of Identity Theft and Multiple Accounts: Impersonating others or using a misleading name/title (e.g., claiming to be a teacher/principal without basis) is prohibited. One individual account per User is permitted, and one seat per actual User in school licenses. Selling, transferring, or sharing accounts beyond what the license specifies is prohibited.

10.6. Usernames and Trademark Fairness: The Establishment reserves the right to refuse/withdraw/modify a username that violates the law, infringes on trademarks, suggests endorsement or an official capacity, or causes confusion. Names may be reserved for operational/security interests.

10.7. Teacher and Principal Accounts: Require documented linkage to the educational institution and role-based permissions. The educational institution is responsible for assigning roles, granting the minimum necessary permissions, and reviewing them periodically. The Company may review evidence, request updates, or suspend privileges upon change of status.

10.8. Technical Requirements for Activation: Account activation and continued operation are conditional upon meeting published technical requirements (devices/systems/browsers/stable connection/permissions). Failures arising from not meeting these requirements are not considered "non-provision of service" and do not create a right to refund, while the Establishment's duty to support remains within the specified limits.

10.9. Right of Acceptance and Suspension: Submitting a registration request does not obligate the Establishment to create an account. The Establishment, when finding a legitimate reason (security/compliance/fraud/ineligibility/serious risks), may refuse the request or restrict/suspend/cancel the account, with a commitment to reasonable notice where possible and without prejudice to security or legal necessities.

10.10. Records and Retention: Records of creation, acceptance, linkage, and changes, including timestamps, IP/device ID, are retained according to the schedules in "Appendix 2" for compliance, auditing, and dispute resolution purposes.

10.11. Inactive Accounts: The Company may — after reasonable prior notice — cancel or archive an account that has not logged in or had substantial use for a period exceeding twenty-four (24) consecutive months, after sending a notice thirty (30) days before cancellation to the registered email, with an option to export data according to the announced policy where applicable.

11.1. Responsibility for Confidentiality of Login Credentials: The User/Educational Institution is obligated to maintain the confidentiality of the username, password, any verification codes, or access keys, and not to share or disclose them to others. All activities performed through the account are attributed to its owner until immediate reporting of suspicion and handling according to this clause.

11.2. Immediate Reporting of Suspicion: Must be reported without delay, and where possible within 24 hours of reasonable suspicion, of any unauthorized login, lost device, password disclosure, phishing, or suspicious activity. This must be done via the dashboard/support channels or the announced security channel. The Company may request information/documents for verification and take urgent containment actions.

11.3. Multi-Factor Authentication (MFA/2FA): Enabling two-factor authentication is mandatory where available and is required for high-privilege accounts (e.g., School Principal/Supervising Teacher/Administrative roles) or when accessing sensitive student data. The Company may enable risk-based/device-based authentication or re-verification upon change of location/device/behavior.

11.4. Passwords and Complexity Policy: A strong, unique password must be used, and it must not be reused on other services. The Company may impose periodic changes, disable compromised passwords, and mandate reset upon security incidents. Procedural details are subject to the applicable security policy.

11.5. Session and Device Management: The User must review the device/session log, terminate unknown sessions, periodically update systems and browsers, and refrain from using insecure public devices for login. Lost or stolen devices must be reported immediately.

11.6. Programmatic Access Keys (If Applicable): API keys and webhooks are credentials treated with the highest level of confidentiality, stored in secure secret vaults, rotated periodically, and not embedded in client applications, distributed code, or public repositories. Exceeding request rates or technical circumvention justifies immediate suspension and claims for actual damages.

11.7. School Permissions and Identity Management: The educational institution must apply the principle of least privilege, designate an administrator/supervisor for permission management, update memberships immediately upon changes in staff roles, and complete off-boarding procedures upon their departure. In case of integration via an Identity Provider (SSO/IdP), the school is responsible for correct configuration, directory management, and role attribute accuracy.

11.8. Establishment's Incident Response: The Company may — as a precaution — temporarily suspend the account/feature, request re-verification, enforce 2FA, terminate sessions, or reset credentials, when a security risk or reasonable suspicion exists. Access is restored after verification and containment. Preventive suspension does not create a right to extend the period or a refund.

11.9. Technical Authority of Records: Monitoring logs, logs, identity management systems, and rate limiting systems are considered strong technical evidence for proving usage/access/violations, unless their manifest error is proven by an independent technical report compliant with industry standards.

11.10. Liability for Negligence and Financial Impact: Any losses/damages/claims arising from sharing login credentials, disabling security controls, failure to activate 2FA, or neglect of duties under this clause are borne by the violating party, including reasonable investigation and remediation costs. This does not entail a refund or compensation, to the extent permitted by law.

11.11. Reference Policies: The provisions of this clause are to be read alongside the "Cybersecurity Policy" and "Appendix 2 — Retention, Deletion, and Backup," and the detailed measures contained therein shall be applied to the extent they do not conflict with these Terms.

12.1. Scope of Application and Definition of Minor: The provisions of this clause apply to all minor Users according to the definition and age stipulated in the laws in force within the Kingdom. The "best interest of the minor" is interpreted as the governing principle in any conflict.

12.2. Prior Consent Requirement: A minor's account shall not be created, nor shall Core Features be activated, except after obtaining explicit and documented consent from the Guardian and by the method specified in §10 (Verification of Guardian Consent). Consent, withdrawal, and update records are kept with timestamps, IP addresses/device IDs in an audit repository.

12.3. Registration via an Educational Institution: When registering via a school/educational institution, the entity is considered to have obtained Guardian consents according to its policies and the law, and bears primary responsibility for that, while enabling the Establishment to rely on this representation in good faith. The entity is obligated to notify us immediately upon the withdrawal of any consent or change of status.

12.4. Guardian Oversight Tools: The Platform enables the Guardian to view the "Smart Educational Profile" and progress reports, adjust privacy preferences, and enable/disable optional features (chats, camera/microphone, "Study with Me" groups, private messages) where available.

12.5. Default Access Restrictions: Conservative privacy settings are applied by default to minor accounts, including: limited public visibility, restricted private messaging, disabled behavioral advertising, and blocking sharing outside authorized classes/groups, with easing only permitted with Guardian consent or via the educational institution.

12.6. Media Processing and Sensitivities: Camera/microphone is not activated, and media for minors is not processed, except with explicit in-product consent consistent with §30. No facial recognition/voiceprint or biometric feature extraction is performed. Media is used for communicative educational purposes only and can be disabled at any time.

12.7. Protection from Harmful Exposure: Inappropriate content or questions outside the permitted educational framework are prohibited for minors. Filters, block lists, automated/human review with an immediate reporting mechanism are applied. The Company may suspend/restrict the account upon suspicion of safety risks.

12.8. Primary Supervision Responsibility: The school and/or Guardian bear the primary responsibility for supervising the minor and their proper use of the Platform. The Establishment's roles are limited to providing tools, controls, and technical processing, without a commitment to comprehensive prior monitoring of all activities.

12.9. Withdrawal of Consent and Its Effect: The Guardian has the right to withdraw or restrict their consent through specified channels. The withdrawal effect applies only to the relevant minor's account. It may result in feature restriction or account suspension. Withdrawal does not create any right to a monetary refund or compensation. In the case of a school contract, the seat may be replaced with another User within the same license, to the extent permitted by law (§33, §58).

12.10. Periodic Verification and Prevention of Fraud: The Company may re-verify age or Guardian status periodically or upon significant changes in account/device behavior. Any fraud on age controls or identity theft of guardianship justifies immediate suspension and referral to appropriate disciplinary procedures.

12.11. Communication and Notifications to Guardian: Essential alerts (e.g., permission changes, joining a group, abuse report) are sent to the registered Guardian communication channel or via the dashboard. A notice is considered received upon sending/publishing according to §§71–72.

12.12. Messages and Interactions: Private messages between minors are restricted according to Community Policies (§15), and blocking and reporting tools are available. A "Supervised Learning" mode may be activated that restricts interaction to classroom spaces managed by the school.

12.13. Direct Marketing: Direct marketing to minors is prohibited unless revocable Guardian consent is obtained, consistent with §§32–33. Withdrawal of marketing consent does not affect essential service notices.

12.14. Referrals and Legal Safety: When there are serious risks to the minor's safety or suspicion of a legal violation, the Company may disclose to competent authorities within legal limits (§38), notifying the educational institution/Guardian where permitted.

12.15. Authority and Records: Consent records, feature permissions, preference changes, access/devices are considered technical reference evidence, accessible confidentially upon request from educational institutions and competent authorities according to the law.

12.16. No Guarantee of Educational Results: Platform recommendations are advisory and not a commitment to achieving academic results. No right to a refund arises if a specific result is not achieved, while the mandatory rights of minors conferred by law remain reserved (§28, §58).

13.1. Scope and Definitions: "Guardian" means the person legally authorized to care for and represent the minor. The provisions of this clause apply to every minor's registration, whether via an educational institution or individual registration. The "best interest of the minor" takes precedence over other considerations in case of conflict, to the extent permitted by law.

13.2. School Path (Reliance on School): When linked to a documented school identity, the school is considered to have obtained Guardian consents according to its policies and the law. The Establishment may rely on this in good faith. The school is obligated to retain the original consents and present them upon request and provide a copy of its consent collection policy and mechanism.

13.3. Certified Principal's Acknowledgment: The acknowledgment signed by the School Principal or their written delegate — along with proof of the signatory's capacity — is considered sufficient evidence of obtaining consents. The educational institution alone bears legal responsibility if proven otherwise, including indemnifying the Establishment for any claims arising from deficiencies in collection or management of consents.

13.4. School's Representations and Warranties: The educational institution acknowledges it has a legal basis for processing its students' data and is authorized to obtain and manage consents. It undertakes to notify the Establishment immediately upon withdrawal of any consent or change of guardianship status and to enable data subjects to exercise their rights through its channels or through the Establishment (§§31, 44–45, and DPA Appendix for B2B contracts).

13.5. Providing Consent Collection Policy and Mechanism: The educational institution — upon request — must provide the Establishment with an up-to-date copy of its Guardian consent collection policy, mechanism, and legal basis, along with proof of its actual application. Unjustified refusal or delay is grounds for suspending school linkage or restricting features until compliance.

13.6. Individual Path (Outside School): A minor's account is not created except after documented Guardian consent via one of two options: a one-time password (OTP) sent to a mobile number legally registered in the Guardian's name, or uploading a valid guardianship document and manual verification. The Company may request any supplementary proof upon reasonable suspicion.

13.7. Non-School Path and Phone Verification: During individual minor registration, the minor provides the Guardian's phone number. The Establishment sends a one-time password (OTP) to that number. Entering the code is considered explicit consent valid for reliance in good faith. The data enterer acknowledges the number is legally owned by the Guardian and that they are authorized to communicate. The entering entity and/or Guardian bear responsibility for any incorrect representation. The Establishment reserves the right to request additional documents or suspend the account upon reasonable suspicion, and sensitive features (e.g., camera/microphone/community groups) are not activated before verification is complete.

13.8. Consent Record Elements: An immutable audit log is maintained showing: timestamp, IP address and device ID, number/method of the consent process, version of Terms/Policies at the time of acceptance, scope of consent (features covered, media, community), any supporting documents or their identifiers, and the identity of the staff member or system interface that processed the request.

13.9. Withdrawal and Update Management: The Guardian has a permanent channel to withdraw or restrict consent from account settings or via the school. The request is processed within a reasonable period not exceeding 30 days from identity verification, and the requester is notified of the effect of withdrawal on the service. The effect applies only to the relevant minor's account.

13.10. Effect of Withdrawal on Subscriptions: Withdrawal or restriction of consent does not create any right to a monetary refund or compensation. In the case of a school contract, where possible, the seat may be replaced with another User within the same license without extending the period or transferring funds, to the extent permitted by law (§§33, 55–58).

13.11. Re-Request of Consent: Guardian consent is re-requested upon any substantive change in processing purposes, enabling sensitive optional features (e.g., camera/microphone or open community groups), transferring data outside the Kingdom according to §35, or a material change in relevant Terms.

13.12. Resolution of Guardianship Conflicts: In case of a dispute or conflicting claims regarding guardianship, non-essential features are suspended, and a "Preservation Mode" is activated until a decisive official document (guardianship/custody deed or equivalent) is presented. The Company may rely on the apparently strongest document and make a precautionary decision to protect the minor.

13.13. Age of Majority and Control Transition: Upon the User reaching the age of majority according to the law, management of consents and rights is transferred to the account itself. The Guardian is notified of this where possible, and records are updated accordingly.

13.14. Reliability and Authority of Evidence: Audit logs, logs, and express acceptance (Clickwrap) are considered strong technical evidence of the existence/scope and withdrawal of consent. They may be shared confidentially with competent authorities or the school unless their manifest error is proven.

13.15. Safety and Content: Media is not activated, and sensitive minor data is not processed except with explicit and specific-purpose consent. No facial recognition, voiceprint, or biometric feature extraction is performed. Media can be disabled at any time (§30).

13.16. Retention and Deletion: Consent and withdrawal records are retained throughout the subscription period and for an additional period of no less than five years or as required by law. They are masked/deleted in backups within 30–90 days according to the backup cycle (§§43, 81).

13.17. Legal Compliance as Basis for Processing: Processing is based on Guardian consent and/or the execution of an agreement with the school/user and any mandatory legal obligations, considering the minor's best interest and data minimization (§31).

13.18. Notifications and Communication: Essential notices regarding consent or account activity are sent to the registered Guardian channel or dashboard. A notice is considered received upon sending/publishing according to §§71–72.

13.19. Violation and Fraud: Any fraud on age controls, providing incorrect data/documents, or unauthorized use of guardianship justifies immediate account suspension and taking appropriate enforcement actions, with the Establishment retaining the right to claim actual damages and reasonable collection costs.

14.1. Primary Responsibility for Supervision: The educational institution and/or Guardian bear primary responsibility for supervising the minor and controlling their use. The Platform's function is limited to providing supportive monitoring tools, oversight enablement, and educational content; it is not a substitute for family/school supervision.

14.2. Scope of School Accounts and Entity Representation: School accounts are created and managed within a dedicated space linking users to a documented school identity (official email domain/SSO/LMS integration or school rosters) or phone number. The educational institution acknowledges that all whom it adds or links via this identity are legally authorized and that it bears responsibility for the accuracy of their data and continued eligibility.

14.3. Role Matrix (Controller/Processor/Joint): Within the scope of school use limited to the educational institution's students, teachers, and principals, the educational institution is considered a "data controller" and the Establishment a "processor" as defined in the DPA. For general or social optional features, anonymized analytics, or any features outside the strict school space, the Establishment may be an independent controller or joint controller — depending on the nature of the feature — according to the detail and precedence in the DPA.

14.4. Educational Institution's Obligations as Data Controller: The educational institution must provide a valid legal basis for each processing (valid consent, contract execution, balanced legitimate interest, legal obligation), issue necessary privacy notices to its students and staff, manage data subject rights requests (access, rectification, erasure, objection, portability) within legal deadlines, conduct any required impact assessments (DPIA), ensure data minimization, accuracy, and updates, and designate a competent contact point for communication with the Establishment on compliance matters.

14.5. Establishment's Obligations as Processor/Controller: The Establishment — when acting as a Processor — must process data according to the documented instructions of the educational institution and the DPA, with reasonable security controls, publish a list of sub-processors and prior notice of additions, provide reasonable assistance to the educational institution in responding to rights requests, and notify incidents within specified frameworks. When acting as an independent/joint controller, it must comply with the applicable controller duties under the PDPL and DPA.

14.6. Guardian Consent and Reliance on School Identity: Linking to school identity is sufficient evidence — which the Establishment relies upon in good faith — that Guardian consent was obtained according to the educational institution's policies when processing minor data. The Establishment maintains audit logs of linkages and related processes. The educational institution bears any legal consequences arising from its failure to obtain or manage valid consents.

14.7. Linking Permissions to Identity and Access Management: Roles within the Platform (Student/Teacher/School Principal) and their permissions are assigned based on school identity and technical integrations (SSO/LMS/User Lists). The educational institution must apply the principle of least privilege, enable multi-factor authentication where available, periodically review permissions, isolate/remove users upon status change (graduation/transfer/end of relationship), and provide the Establishment with any necessary updates without undue delay.

14.8. Delegation to "School Principal" and Limits of Responsibility: The educational institution designates one or more principals with the title "School Principal" within the Platform. Any action/setting/consent issued by them is binding on the educational institution. The entity acknowledges that any misuse, inappropriate granting of permissions, or sharing of login identifiers is its responsibility. The Establishment is not liable for resulting damages unless due to a material security breach on its part.

14.9. Audit Records and Their Authority: The Establishment maintains technical timestamped records of school account creation, identity linkage, and role/permission changes. These records are considered a strong reference evidence for proving technical facts and compliance unless their manifest error is proven by an independent technical report compliant with industry standards.

14.10. Indemnification and Release: The educational institution indemnifies the Establishment against any claims, fines, or reasonable actual damages (including legal fees) arising from: failure to obtain or manage Guardian consents, absence of a valid legal basis for processing, misuse of accounts/permissions, or violations of privacy policies/laws by the entity or its staff; subject to the liability limits stipulated in these Terms.

14.11. Suspension/Stoppage for Non-Compliance: Upon reasonable suspicion of a material failure regarding consent requirements, legal basis, or access management, the Company has the right — after reasonable notice — to suspend school linkage or restrict sensitive features until remediation, without creating any right to a monetary refund; the maximum remedy — where applicable — remains Service Credits according to the SLA.

15.1. Use of the Platform is subject to the eligibility and acceptance conditions in Clauses (4), (7–10), and (73). Access or use by those who lack legal capacity, are prohibited under applicable laws, or have had their accounts suspended is prohibited.

15.2. Any illegal, fraudulent, abusive, or disruptive use that violates public order or harms the Platform, its Users, or its reputation is prohibited. This includes incitement to violate laws or Community Policies.

15.3. Unauthorized access or attempts to bypass or circumvent security controls and rate management, or using rotating proxies or obfuscated identities to circumvent technical restrictions, is prohibited.

15.4. Reverse engineering, decompiling, creating derivative works from our software or interfaces, public benchmarking, or automated scraping/extraction without prior written consent is prohibited.

15.5. Uploading or sending viruses, malicious code/commands/scripts, or any activity that leads to overload, disruption of the Service, or negatively affects its integrity or the experience of other Users is prohibited.

15.6. Creating accounts or logging in through automated means, via bots, or impersonated identities, or creating multiple accounts to circumvent restrictions, incentive programs, or integrity policies is prohibited.

15.7. Collecting, harvesting, or attempting to infer data, contact addresses, or any personal information about other Users without a legal basis and explicit consent according to the Privacy Policy and Developer Guide (if any) is prohibited.

15.8. Deleting, altering, or obscuring any copyright notices, trademarks, or proprietary footers appearing within the Platform, its documents, or its outputs is prohibited.

15.9. Scope of License: Individual Users are granted a personal, internal, educational, non-exclusive, non-transferable, and non-sublicensable right. Resale, rental, providing the service to others, or enabling its use via a network or intermediary allowing simultaneous use by more than one device/person beyond the permitted seat or session limit is prohibited. Use by educational institutions is subject to an institutional license with seats/packages according to Clauses (54–58) and these Terms.

15.10. Attempts at academic dishonesty, exchanging exam solutions, bypassing identity/time mechanisms, or enabling others to do so are prohibited; disciplinary procedures apply according to the scale (16), with the right of immediate suspension for serious violations.

15.11. Enforcement Standards: Our technical records (WAF / Rate-Limiter / Firewall / Status Dashboard) are considered a technical reference evidence for facts related to exceeding limits, overload, or bots, unless their manifest error is proven by an independent report compliant with industry standards.

15.12. These restrictions do not prejudice what is stated in (85) Liability Limits, (83–84) Availability, (87) Force Majeure, and (19) Third-Party Services; reference is made to them regarding disclaimers and caps.

15.13. Scope of Application: These rules apply to all use within the Platform and its ancillary services (published content, chats, private messages, groups, "Study with Me," streaks, file uploads, comments, profiles, and any school integrations).

15.14. Abuse, Harassment, and Hate Speech: Any content or behavior involving personal abuse, harassment, bullying, threats, blackmail, or incitement to violence, hate, or discrimination based on race, religion, gender, nationality, disability, or any protected class under the laws in force in the Kingdom, or any message considered offensive under local laws, is prohibited.

15.15. High-Risk Prohibited Content: A strict prohibition on any sexual or sexually suggestive materials concerning or targeting minors, graphic violence, promotion of drugs or criminal behavior, extremist/terrorist materials, pornography, content containing reserved rights, or material violating public morals, local values, and laws in the Kingdom of Saudi Arabia. Any such activity will result in immediate suspension and reporting to the relevant authorities where necessary. The publisher bears full responsibility for any content with reserved rights.

15.16. Fraud, Misrepresentation, and Impersonation: Impersonating the identity or capacity of the Establishment's/school's employees, forging identities or certificates, disseminating misleading information, manipulating results, reviews, or Platform statistics, or entering false data affecting Platform recommendations or outputs is prohibited.

15.17. Privacy and Data Protection: Publishing personal data of others without a legal basis or explicit consent (images, voices, videos, addresses, contact numbers, documents), or collecting/tracking/reusing it outside its educational purpose, or "doxxing," or recording others without their knowledge where contrary to law is prohibited. Restrictions are tightened when processing minor data.

15.18. Platform Security and Operational Integrity: Uploading or passing malicious software/viruses/backdoors, unauthorized penetration testing, attempting to bypass or weaken security controls, or attempting unauthorized access to accounts/systems/interfaces is prohibited. Details of advanced technical restrictions (reverse engineering, scraping, circumventing rate management...) are expressly stated in the subsequent "Technical Use Restrictions" clause.

15.19. Spam and Misuse of Community Tools: Sending unsolicited bulk messages, excessive flooding, malicious/phishing links, misusing reporting systems (vexatious reporting), or creating accounts/groups for the purpose of nuisance, tampering, or manipulating points/streaks/leaderboards is prohibited.

15.20. Unauthorized Commercial Exploitation: Advertising, marketing, fundraising, referral or network marketing programs, selling goods/services, or any commercial exploitation within the Platform without prior written permission from the Establishment, especially any direct marketing to minors, is prohibited.

15.21. Communication with Minors and Its Controls: Teacher-student communication is limited to educational purposes within approved channels. Requesting or exchanging personal contact details with minors outside approved school channels or encouraging direct meetings without the educational institution's and Guardian's consent according to applicable policies is prohibited.

15.22. Safety and Integrity of the Educational Environment: Enabling cheating, sharing exam solutions, bypassing time/identity controls, circumventing exam mechanisms, or any behavior that undermines academic integrity is prohibited. Details and disciplinary consequences are in the subsequent "Exam Integrity" clause.

15.23. Intellectual Property Rights: Publishing or sharing content that infringes the rights of authors, publishers, or assessment/testing entities (including question banks) or software licenses is prohibited. Violating content may be removed, and the account suspended according to the Community Policy (Appendix 3) and the rights reporting procedures.

15.24. Enforcement and Disciplinary Escalation: Upon reasonable suspicion or confirmation of a violation, the Company may remove the violating content, restrict/suspend/terminate the account/access, block IP addresses/devices, request additional verification, or take any appropriate preventive action. For serious violations (especially those related to minors, security, or terrorism), immediate suspension and reporting to competent authorities may occur without a right to a monetary refund, with the possibility of applying the "Disciplinary Procedures Scale" stated in a separate clause.

15.25. Reporting Violations: Reporting channels are available within the product/dashboard. Relevant links/evidence must be attached. Vexatious or abusive reports are prohibited, and action may be taken against misuse.

15.26. Authority of Records and Cooperation: Automated Platform records (logs/status dashboard/security indicators) are considered strong evidence for proving technical facts. The User must cooperate with the compliance team during investigations and provide necessary information within a reasonable period.

15.27. Access to the Service is limited to the interfaces and means documented and announced by the Establishment. Bypassing security controls, rate management, or any verification mechanism is prohibited.

15.28. We reserve the right to activate immediate preventive measures (blocking/restriction/device blocking) and take urgent legal measures when necessary, to the extent permitted by law.

16.1. Scope of Prohibition: Any form of reverse engineering, disassembly, decompilation, or attempts to extract source code, logical structures, AI models, training data, weights, or recommendation algorithms is expressly prohibited. Automated scraping/crawling/harvesting/data mining of the Platform's interfaces, content, APIs, or data for any purpose is also prohibited.

16.2. Automation, Bots, and Proxies: Using bots, headless browsers, automation (RPA/Macros), or any scripts to access or interact with the Service, including via Proxies/Bots/Rate-Bypass, or any means to circumvent Platform controls or consume them in a non-human manner is prohibited.

16.3. Prohibition of Technical Circumvention and Identity Concealment: Circumventing security mechanisms, rate management, CAPTCHA, authentication, login sessions, or device restrictions is prohibited. Using rotating proxies, VPN chains, forging identifiers/headers/user agents, tampering with device/browser fingerprints, or any method to conceal identity to bypass Platform restrictions is also prohibited.

16.4. API and Integration Controls: Using any undocumented API or circumventing the restrictions stipulated for documented APIs is prohibited. Dedicated keys for each client must be used according to published rate limits; sharing, selling, renting, re-licensing, or intercepting them is prohibited. Any use of automation via API outside official limits/documentation is a serious violation.

16.5. Public Benchmarking/Disclosure: Conducting or publishing any public performance measurement, comparison, announcement regarding availability rates, response times, failure rates, or stress test results without prior written and scope-specific consent is prohibited. Permitted internal tests must not cause disruptive load and must not exceed rate limits.

16.6. Research Exception: Non-disruptive academic/research work may be exceptionally permitted within the scope and after prior consent specifying the purpose, scope, duration, rate limits, and authorized test accounts. This exception remains revocable immediately upon any violation. Any results that violate privacy, security, or disclose confidential information are not valid.

16.7. Prohibition of Creating Competing Databases: Collecting, storing, or reusing Platform data/outputs/interfaces/visual elements to create databases or to train/improve competing models or services is prohibited, unless there is an explicit independent license.

16.8. Company's Technical Measures: The Company has the right to monitor, measure, and rate-limit, block or restrict IP addresses/ASNs/devices/geographic regions, deploy technical honeypots and verification measures, and suspend or terminate access — wholly or partially — without compensation upon reasonable suspicion of violation.

16.9. Measurement and Publication: Any automated scraping, attempts to bypass Platform restrictions, or public publication of performance measurement results without prior written and scope-specific consent is prohibited. The Company may seek urgent injunctive relief and recover actual losses and reasonable legal fees.

16.10. Authority and Technical Evidence: In any technical dispute regarding request rates, exceeding limits, or use of bots, internal measurement records (Rate-Limiter/Firewall/WAF/Telemetry) are considered a decisive reference evidence unless their manifest error is proven via an independent report with a pre-agreed methodology.

16.11. Penalties and Remedies: Upon violation, the Company has the right to immediately suspend/terminate the account, block addresses/devices, seek urgent injunctive relief, and claim actual damages including investigation, remediation, digital forensics, and downtime costs.

16.12. Indemnification and Enforcement Costs: The violator must compensate for actual losses and bear enforcement costs and reasonable legal fees associated with the breach of this clause, without prejudice to the Establishment's other rights and without replacing Service Credits with monetary amounts.

16.13. Channel for Exceptional Permission Requests: Requests for research approval or exceptional permits should be sent to the dedicated email: [email protected], stating the objective, methodology, and proposed usage limits.

16.14. Publishing or promoting illegal, abusive, threatening, discriminatory, hateful, intentionally misleading, or media-manipulative content, or content that infringes property rights or privacy, is prohibited.

16.15. Impersonating any person or entity, creating misleading profiles/content (including audio/visual simulation), or attempting to collect user credentials is prohibited.

16.16. The license is individual and non-transferable unless otherwise stated in an institutional agreement; any non-personal use, resale, or rental of access requires prior written consent.

16.17. Precedence of this Clause: This clause prevails over any conflicting text in Purchase Orders, vendor portals, or printed terms unless a specific appendix expressly altering it is signed.

16.18. Any license granted to you automatically terminates upon a material breach, and you must stop using the service and destroy any materials/copies/extracts obtained from the Service — including caches — while the Establishment retains all its rights.

16.19. Sending viruses, malware, or spam/testing/survey/bulk messages via the Service's channels or to its Users is prohibited.

16.20. Use of Content is limited to what is necessary for operating the Service within the account. Copying, publishing, deriving, translating, or trading without written license is prohibited.

16.21. Not being aware of updates does not exempt you from adhering to them once notified according to the Notices clause and within limits.

17.1. Scope of Prohibition and Definition of Violating Acts: It is prohibited, by any means, to request, exchange, or publish exam questions/solutions, answer keys, or question bank content before/during/after the exam or Qiyas center leaks, including selling, buying, bartering, and sharing via the Platform or outside it when the purpose is to influence the integrity of the assessment.

17.2. Enabling Others and Unauthorized Assistance: Enabling others to take the exam or providing unauthorized assistance is prohibited, including sharing login credentials, opening the session from another device or location on behalf of the User, screen sharing, remote control, "group solutions/outsourcing," or using AI models when expressly prohibited by the assessment instructions, and any use of the Site by another person falls under this point.

17.3. Technical Circumvention of Identity/Time/Location/Supervision: Any means of circumvention such as concealing/falsifying identity or location (VPN/Proxies/Spoofing), tampering with the system clock or time limit, running multiple accounts for the same individual, disabling or deceiving monitoring means (camera/microphone/secure browser), using bots/macros/headless tools or any unauthorized automation is prohibited.

17.4. Scope of Application Inside/Outside the Platform: This prohibition applies to activity inside and outside the Platform when it relates to or directly or indirectly affects Platform assessments.

17.5. Means of Proof and Authority of Records: Means of proof include — by way of example and not limitation — login, usage, and telemetry logs, monitoring footage and signals, device/browser fingerprints, browsing patterns, similarity and collusion indicators, and materials provided by the school/teacher. Our automated records are considered a reference evidence unless their manifest error is proven by an independent report compliant with industry standards.

17.6. Disciplinary Measures and Escalation: Treatment for the violator or those who enabled them may include invalidating/canceling the exam attempt or its result, zeroing the grade, withdrawing badges/achievements, immediately suspending or terminating the account, blocking devices/addresses, removing violating content, and notifying the school/Guardian. The appropriate measure may be applied directly without escalation depending on the severity of the violation.

17.7. Financial Impact and Non-Entitlement to Refund: No disciplinary action or fraud investigation creates a right to refund or compensation. The Establishment retains the right to claim actual damages, enforcement costs, and reasonable legal fees.

17.8. Educational Institution Obligations and Cooperation: The educational institution must apply integrity policies among its students and teachers, cooperate in investigations, designate a contact point, and provide the Establishment with necessary records/notifications within a reasonable period; it bears the consequences of any supervisory failure or enabling violations using its tools.

17.9. Legitimate Exceptions and Accommodation Arrangements: Health conditions/disabilities/force majeure/proven outages are addressed through support channels according to pre-announced controls and do not justify circumvention or breach of identity/supervision requirements.

17.10. Appeal Path and Human Review: The User/School may request a review within 3 Business Days of the action notice, attaching available evidence. The review is completed — where possible — within 7–10 Business Days and the concerned party is notified of the reasoned outcome.

17.11. Repeat Offender and Reporting to Competent Authorities: In case of repeated violations or proof of an organized cheating system, the Company has the right to permanently terminate the subscription/access and block associated devices/addresses, notifying the competent authorities or national test providers upon suspicion of crimes or legal violations.

18.1. Purpose and Scope: These controls apply to all interaction spaces within the Platform, including discussions, posts, comments, private messages, groups, the "Study with Me" feature, and motivational features like "Streaks."

18.2. User Responsibility and Content Ownership: The User/School remains fully responsible for the legality, accuracy, and licenses of their content and acknowledges that the Platform is a host that has the right to remove/restrict without compensation when content violates these controls or the law. The Establishment does not conduct comprehensive prior review of content.

18.3. Definition of Prohibited Content (Non-Exhaustive Examples): Incitement to violence, hate, or discrimination; harassment and personal abuse; exploitation of minors or any sexual/suggestive content involving a minor; explicit nudity; religious abuse or contempt of beliefs; self-harm or encouragement thereof; illegal substances or incitement to unlawful acts; sharing personal data of others (Doxxing) or privacy violations; hacking and malicious software/links; spam and unauthorized commercial promotion; intellectual property infringement; leaking exam questions/solutions or enabling cheating; identity theft or forgery of capacity; any content that violates laws or the rights of others.

18.4. Interaction Conduct Rules: Discuss with respect, avoid offensive or provocative language, adhere to the group/lesson topic, and do not repeatedly post the same content (Spam). Manipulating motivational features (e.g., Streaks) through artificial means or via multiple accounts/devices is prohibited.

18.5. "Study with Me" Groups and Supervision: The group creator/moderator must set clear rules and respect these controls. The Company may enable or isolate moderators and close violating groups. Recording or broadcasting sessions without the explicit consent of all parties is prohibited. Storage of recordings — if any — is subject to the PDPL and retention appendices.

18.6. Private Messages and Their Safety: The Platform may use automated filters indicating violations (offensive language/malicious links/harmful polarization indicators) with selective human review upon suspicion, to protect minors and community safety, to the necessary extent, and according to a declared legal basis (PDPL). This does not imply comprehensive human monitoring of all messages.

18.7. Rapid Removal Procedures and Escalation: The Establishment reserves the right to immediately remove/hide/restrict content, features, or accounts without prior notice for serious or urgent violations, with the possibility of applying the scale of procedures (warning, temporary restriction, suspension, termination) according to the general discipline clause. The Platform retains the right to apply the appropriate measure directly for serious violations, without an obligation to restore content.

18.8. Evidence and Authority of Records: Platform logs, supervision reports, telemetry, and security indicators are considered reference evidence for proving violations unless their manifest error is proven by an independent report compliant with industry standards.

18.9. The Company's Rights and Effects of Violation: The Company may modify/truncate/hide violating or ambiguous content, stop rewards/points/streaks resulting from violating activity, block devices/addresses, and notify the school/Guardian when necessary. This does not create any right to refund or compensation.

18.10. Reporting Mechanism and Response: Clear reporting channels are available (in-product button/dedicated email). Reports are filtered, and priority is given to those concerning minor safety/security. An initial response is provided within a reasonable period, and the reporter may be asked for supporting information.

18.11. Appeal Path: The concerned party may request a review of the removal decision within 3 Business Days of the notice, with a brief justification and supporting evidence. The human review is completed — where possible — within 7–10 Business Days, and the reasoned outcome is communicated.

18.12. Repeat Offender: In case of repeated or organized violations, the subscription/access may be permanently terminated, associated devices/addresses blocked, and the competent authorities or academic partners notified where appropriate.

18.13. Consistency with PDPL: Any data necessary for supervision and enforcement is processed on a declared legal basis (contract execution/balanced legitimate interest/legal obligation), with data minimization and limited retention according to privacy appendices.

18.14. Referral to Detailed Policy: These controls are interpreted with the "Community and Prohibited Content Policy" (Appendix 3). In case of conflict, the Arabic version attached to these Terms prevails.

18.15. We reserve the right to suspend, terminate, or restrict access for any legitimate reason, including reasonable suspicion of violating terms, security risks, or non-payment. We may block associated devices/addresses and prevent any re-registration directly or via others.

18.16. A brief notice is provided where possible and does not endanger the security of the Service or any party; suspension/termination does not create any right to a refund for periods already paid for.

18.17. Upon intentional or repeated publication of "Prohibited Content" as defined in the Community Policy Appendix, the account may be permanently terminated and re-registration or creation of alternative accounts blocked, with a brief notice where possible.

19.1. Definition and Scope: This clause includes any tools, add-ons, SDKs, payment platforms, cloud/AI model providers, content sources, and external links not owned or managed by the Establishment.

19.2. Independence and Third-Party Terms: Use of any third-party service/content is subject to its independent terms and policies. The User/School remains responsible for reading and complying with them. Listing a link or enabling an integration does not constitute endorsement, recommendation, or approval by the Establishment.

19.3. Disclaimer and Non-Liability: Third-party services and content are provided "AS IS" and at their exclusive responsibility. The Establishment makes no warranties or representations regarding their accuracy, availability, security, or suitability, and assumes no liability for their failures, breaches, practices, or any resulting losses, to the extent permitted by law.

19.4. User/School Responsibility and Compliance: The User/School must ensure the legality of content, necessary licenses and rights, and comply with third-party terms (including usage limits, intellectual property, geographic restrictions, and export/sanctions laws). Any violating use entails the responsibility of the User/School alone, without recourse to the Establishment.

19.5. Data Processing and Privacy (PDPL): Operating certain integrations may require sending specific categories of data to the third party. This is done only on a declared legal basis, to the extent necessary for operation, and according to appropriate agreements (DPA/contractual clauses) where applicable, and in accordance with Appendix 1 (DPA) and the Sub-processors/Data Flows page. The school remains responsible for providing the legal basis when linking its students' identities. The User/School must review the third party's privacy policies before activation.

19.6. Minor and Sensitive Data: The User/School is prohibited from enabling the sending of sensitive minor data to a third party except as permitted by these Terms and privacy appendices, with necessary and declared consents. If the school objects to a sub-processor according to the declared framework, it is addressed according to the objection mechanism in the privacy appendices, without any monetary refund for previous periods.

19.7. External Links and Content Sources: The Platform may contain links to external channels/pages/files. The Establishment does not control their content, updates, or availability and assumes no responsibility for any harm resulting from following them. Access is at the User's own risk.

19.8. Failures and Availability: Partial failures, slowdowns, or downtime resulting from a third party (telecom/hosting/payment provider/model provider) do not create a right to compensation or refund. The remedy — where applicable — is limited to Service Credits according to the SLA for schools, without conversion to monetary amounts.

19.9. Additional Fees and Costs: The third party may impose fees/commissions/currency exchange differences/independent transfer charges borne by the User/School. The Establishment does not refund these fees even during any legally permissible credit processing.

19.10. Activation, Deactivation, and Changes: The Establishment reserves the right to provide/suspend/remove, modify, or replace any third-party integration for reasonable technical/security/legal or commercial reasons, without any obligation to provide a similar alternative and without any monetary refund; the maximum remedy is a future waiver or Service Credit as applicable.

19.11. Third-Party Intellectual Property Rights: All trademarks/logos/software/content of third parties remain their property and are subject to their licenses. Copying or reuse outside what these licenses permit is prohibited.

19.12. Channels Outside the Platform: Any external groups or channels (e.g., chat/video platforms/content repositories) that Users connect to are their responsibility. Compliance with their terms remains their duty, and the Establishment assumes no obligations arising from them.

19.13. Evidence and Authority of Records: Platform logs, monitoring systems, and status dashboards are considered a reference evidence for proving that the disruption/impact is due to a third party or external factor, unless manifest error is proven by an independent report compliant with industry standards.

19.14. Regulatory Referral: These provisions are read with Appendix 1 (DPA), Appendix 6/Sub-processors/Data Flows page, and cross-border data transfer clauses. The Arabic text prevails in case of conflict.

19.15. The Platform may include links, integrations, or operational components (SDK/APIs/SSO/media players) provided by third parties. The presence of any link or integration does not constitute a recommendation, endorsement, or warranty by "Qader," and the stated trademarks and content remain owned by their owners.

19.16. Use of any third-party service or content is subject to its independent terms and policies (including privacy and cookies). The User/Educational Institution is responsible for reviewing and complying with them. "Qader" bears no responsibility for failures, outages, privacy practices, or security of third parties, and such failures are not counted in outage minutes for SLA purposes, provided that the total planned maintenance windows do not exceed eight (8) hours per month or four (4) windows, whichever is less.

19.17. No Prior Review: "Qader" is not obligated to monitor or review the content or updates of third-party sites or services. However, the Establishment applies a notice and takedown policy for violating links: reports are sent to the published channel on the Contact/Support page, including the link address and reason for violation, and are evaluated and removed/disabled within a reasonable period if the violation is established.

19.18. Service Integrity: "Qader" may disable/block any link, integration, or outgoing requests affecting performance/security or violating terms or regulatory requirements, with subsequent reasonable notice where there is no emergency.

19.19. Advertisements and Marketing Relationships: Some links may contain advertising content or arrange a commission/marketing benefit for "Qader." In such cases, this is clarified where possible according to applicable laws, without affecting prices or the independence of editorial content.

19.20. SDKs and Cookies: Non-essential identifiers or SDKs are not activated before explicit consent via the cookie preference dashboard and can be withdrawn at any time. Please refer to the Cookie Policy and relevant appendix.

19.21. Linking to "Qader": Honest text links pointing to our pages are permitted, provided they do not mislead or harm the reputation. Framing, inline linking, or any use of our trademarks or interfaces implying partnership or sponsorship without prior written permission is prohibited.

19.22. Rights of Others: Publishing links to content that infringes intellectual property rights, privacy rights, or applicable laws is prohibited. The publisher must remove the violating link immediately upon request from the Establishment or the rights holder, bearing any resulting consequences.

20.1. Notices Page: The Establishment maintains a dedicated page listing the OSS components used, their versions, license links, required notice texts, and any source code offers (if any). This page is updated periodically.

20.2. License Precedence: In case of conflict between these Terms and an OSS license for any open-source component, the OSS license prevails solely for that component, without extending to the rest of the Service or the Establishment's software.

20.3. No Limitation of OSS Rights: Nothing herein is construed as limiting the rights granted to you under OSS licenses or granting you rights beyond them.

20.4. Redistribution and Compliance: If you redistribute any client/application/SDK that includes OSS components, you are bound by all relevant license requirements, including attribution, attaching license texts and notices, and making source code available when the license requires.

20.5. Source Availability When Required: If any distributed client applications include components requiring source code availability (e.g., GPL/LGPL), we provide the source code or equivalent offers according to the license for a period of no less than three years from the last distribution, via the notices page or upon request to [email protected].

20.6. Disclaimer and Liability of OSS Owners: OSS components are provided "AS IS" and "AS AVAILABLE." Their authors or contributors provide no warranties and assume no liability towards you; to the extent permitted by law, the Establishment is exempt from any obligations arising directly from those components beyond what their licenses dictate.

20.7. Preservation of Notices: It is prohibited to remove or obscure copyright notices, license texts, or required attribution notices within binaries/interfaces/documentation where the license requires.

20.8. Component Changes: The Company may add/replace/remove OSS components for technical/security/legal reasons, updating the notices page; this is not considered a substantive change to the Service and does not create any right to a refund.

20.9. Definition of "Distribution" and Cloud Use: "Distribution" means making copies of the client/SDK available outside the Establishment's environment. Running OSS components on the Service's backend infrastructure is not itself "distribution" unless the license expressly states otherwise.

20.10. No Copyleft Obligations on the Establishment's Software: Using any SDK/binding interfaces in a way that creates a Copyleft obligation on the Establishment's non-open-source software or forces disclosure of its source code is prohibited. The effect of any open-source license is limited to the covered components only.

20.11. No Trademark License: OSS licenses do not grant any rights to the Establishment's trademarks, logos, or trade names except through an independent written license.

20.12. Cross-Reference: These provisions are read with the Sub-processors/Data Flows page and related privacy appendices. The Arabic text prevails in case of conflict.

21.1. Ownership: "Qader" retains all rights to trademarks, trade names, logos, designs, user interfaces, software, databases, and any original content or training materials we produce. Your use of the Service does not imply any transfer or implied license of any intellectual property right not expressly granted herein.

21.2. Limited License: The User/School is granted a personal, non-exclusive, non-transferable, non-sublicensable, geographically and temporally limited license for the duration of the subscription to use the Service within its ordinary limits. Copying, modifying, translating, disassembling, or creating derivative works from any part of the Service or its contents is prohibited except with prior written consent.

21.3. Use of Trademarks: Using, reproducing, or publishing "Qader" trademarks, logos, or trade names, or implying sponsorship/endorsement, is prohibited without prior written license and according to approved trademark guidelines. This Agreement does not grant any intellectual property rights in the trademarks.

21.4. Preservation of Notices: Removing, obscuring, or modifying copyright notices, proprietary notices, or attributions wherever they appear within interfaces/documentation/binaries is prohibited.

21.5. No Copyleft Imposition: Linking to "Qader" services or using its interfaces/SDK does not subject "Qader" non-open-source software to copyleft license obligations. The effect of any open-source license is limited to the open component itself.

21.6. Public Publication and Citations: Screenshots/reviews/presentations that include "Qader" interfaces are published at the publisher's own risk, with a commitment to attribution and non-distortion, and without implying sponsorship. We may request removal upon violation.

21.7. Protection of Educational Content: "Qader's" original educational content and materials are considered protected works; re-uploading, selling, or sharing them outside the Service or with unauthorized parties is prohibited.

21.8. Rights Reporting Form (Takedown): "Qader" provides a dedicated channel for receiving infringement notices. The notice must include:

21.9. The notifier's identity and reliable contact information.

21.10. Explicit authorization/agency if the notifier does not directly represent the owner.

21.11. An accurate description of the work subject to the notice and its links or location within the Service.

21.12. Identification of the infringing material and its links on our platform with sufficient precision to locate it.

21.13. A legal written undertaking that the information is accurate and in good faith, and that the objected use is unauthorized.

21.14. An acknowledgment of bearing legal responsibility for any vexatious or misleading notice.

21.15. Processing Deadlines: We acknowledge receipt within (2) Business Days and conduct an initial review within (5) Business Days, extendable reasonably for complex requests. If the notice is prima facie valid, we may temporarily remove/restrict the content and notify the publisher via a "Counter-Notice" channel within (5) Business Days.

21.16. Counter-Notice: If the publisher provides a reasoned objection with supporting documents, we may restore the content within a reasonable period unless additional evidence or enforceable orders are presented.

21.17. Repeat Infringer: We apply a "Repeat Infringer" policy, including account suspension/termination or blocking upload features.

21.18. Vexatious Notices: A vexatious notice entails — to the extent permitted by law — the notifier bearing actual damages, processing costs, and reasonable legal fees. It may also lead to blocking their reporting channels.

21.19. Urgent Remedies: To the extent permitted by law, "Qader" has the right to seek urgent injunctive relief and prevent damages in case of actual or imminent infringement of its intellectual property rights, without prejudice to any other remedies.

21.20. Confidentiality: Each party agrees to maintain the confidentiality of non-public information exchanged between them and to use it solely for the execution of this Agreement, exercising reasonable care to protect it and granting access on a "need-to-know" basis. "Confidential Information" includes — without limitation — business plans, unannounced products, source code, technical and financial data.

21.21. Confidentiality Exceptions: The obligation does not apply to information that (1) becomes publicly available without breach, (2) was lawfully in the recipient's possession before disclosure, (3) was obtained by the recipient from a third party with the right to disclose, (4) was independently developed without using Confidential Information, or (5) must be disclosed by law/order of a competent authority — provided the other party is notified in advance where possible and disclosure is limited to the minimum.

21.22. Confidentiality Period and Survival: Confidentiality obligations remain in effect throughout the relationship and for (5) years thereafter — trade secrets remain confidential as long as they are trade secrets.

21.23. Records as Evidence: Internal system records (Logs/Monitoring/WAF) are considered reasonable technical evidence of access/usage/upload facts unless their manifest error is proven by an independent report.

21.24. No Waiver and Cumulation: Any tolerance or delay in exercising a right does not constitute a waiver thereof. Cumulation of remedies is warranted unless otherwise stated.

21.25. "Qader" retains all intellectual property rights in the Platform, its components, trade dress, interfaces, code, methodologies, databases, and the compilation, selection, arrangement, and display of content, as well as all trademarks, names, designs, and accompanying materials, including content licensed from third parties; they are protected by applicable laws.

21.26. No license or right is granted under this document by implication, estoppel, suspension, or otherwise. All rights not expressly granted herein are reserved for "Qader" or its licensors.

21.27. Reproducing, distributing, publishing, making available, modifying, adapting, translating, or creating derivative works from any part of the Platform, its content, compilations, or databases, or disassembling, disabling, or circumventing any technical protection measures, or removing/modifying proprietary notices, for any purpose outside the scope of the license granted in writing is prohibited.

21.28. Use of "Qader's" or its licensors' trademarks, names, and logos is subject to prior written consent and according to trademark guidelines, without implying endorsement or partnership. Any license for future use may be revoked with reasonable written notice.

21.29. User and Community Content: The User grants "Qader" a worldwide, non-exclusive, royalty-free, sublicensable license (to the extent necessary for its service processors only) for the purpose of operating the Service, hosting, displaying it within the Platform, backing up, caching, technical conversion, formatting, automated translation, testing, and internal development, and internal non-public marketing of the Platform; without prejudice to moral rights and without transfer of ownership. Privacy obligations remain in effect. The User may terminate the license by deleting the content, while what is legally or technically required remains within backups during retention periods.

21.30. User feedback, suggestions, ideas, and product improvement correspondence are licensed to "Qader" under a worldwide, non-exclusive, royalty-free, perpetual license to use, incorporate, and improve the Service without compensation, without prejudice to privacy rights.

21.31. Text or data mining, or training external AI models on any part of the Platform's content, interfaces, databases, documentation, or outputs, or indexing them for commercial purposes, without express written consent from "Qader," is prohibited.

21.32. Intellectual Property Reporting Mechanism: Notices are processed through a dedicated form including the notifier's identity, authorization, description of the work and its links, and an undertaking of the notice's accuracy. Upon receiving a valid notice, "Qader" may temporarily suspend the content subject to the notice and notify the User to remove the violation or submit a valid objection within a reasonable period. Content is restored upon a valid objection unless the notifier provides proof of legal action within the specified period. Vexatious notices are penalized according to the Content Policy.

21.33. "Qader" bears no liability for User content as a hosting provider and reserves the right to remove or suspend without compensation when content violates the law, Community Policies, or the rights of others, without prejudice to any other rights or remedies conferred by law.

22.1. Definition of "Feedback/Suggestions": Any ideas, comments, bug reports, evaluations, survey responses, support messages, or posts within Platform channels relating to the Service or its improvement, including usage examples and feature requests.

22.2. Non-Confidential by Default: Feedback sent without a separate confidentiality agreement or express "Confidential" marking is considered non-confidential by nature. "Qader" is not obligated to maintain it as Confidential Information. This does not change "Qader's" confidentiality obligations towards any other information marked/covered by a confidentiality agreement.

22.3. Scope of License Granted: The feedback provider grants "Qader" a worldwide, perpetual, non-exclusive, irrevocable — to the extent permitted by law — royalty-free, transferable, and sublicensable (to its subsidiaries, contractors, and data processors) license to use, copy, modify, create derivative works from, internally publish, and incorporate the feedback into services, documentation, technical roadmaps, and training materials.

22.4. Permitted Uses: The license includes testing and calibration, usage analysis, statistical aggregation, improving AI models, roadmap planning, without an obligation to respond to feedback, implement it, or return any materials.

22.5. Personal Data within Feedback: If feedback contains personal data, it is processed according to the Privacy Policy and/or applicable DPA. "Qader" may anonymize or aggregate data before using it for improvement purposes.

22.6. No Financial Entitlement or Attribution: Providing feedback does not entail financial compensation, attribution/authorship rights, an obligation to mention the name, or granting credits. No partnership or ownership right in subsequent developments arises.

22.7. Moral Rights: The feedback provider waives — to the extent permitted by law — any moral rights necessary to enable "Qader" to use, modify, and incorporate the feedback.

22.8. Feedback Provider's Representations: The provider warrants they have all rights and authority to provide the feedback and grant this license, and that the feedback does not infringe the intellectual property or confidentiality rights of any third party and does not contain sensitive data of others without proper authorization.

22.9. Feedback Provided via an Educational Institution: The educational institution confirms it has obtained necessary consents from its staff/students to provide feedback and grant the license herein to the extent permitted by law. Withdrawal of consent — if requested — is handled according to the Privacy Policy and does not retroactively affect copies/uses that were legitimately made before withdrawal.

22.10. Minor Feedback: Used to improve the Service after anonymization or with Guardian/Institution consent as applicable.

22.11. Ownership of Developments: All improvements, features, or materials resulting from feedback remain the sole property of "Qader" without restriction or right of recourse.

22.12. Precedence and Survival: The Privacy Policy and/or DPA prevail in case of conflict regarding personal data. This license remains in effect after subscription termination or account closure.

23.1. Definition and Scope: "Community/Student Content" includes everything Users publish or upload via the Platform (text, images, video, audio, files, links, comments, replies, internal messages, usernames, and profile pictures), including any educational materials shared by teachers within the Platform's boundaries.

23.2. Original Ownership: The User/Student retains ownership of their rights in the content they provide.

23.3. Limited License to the Platform (Operation/Display/Internal Marketing Only): The User grants "Qader" a worldwide, non-exclusive, royalty-free, sublicensable (to the extent necessary for sub-processors) license, limited to: operating the Service and making content available and displayed within the Platform, technical copying, caching, and backup, operational analytics, and internal marketing (e.g., screenshots within user guides or internal non-public presentations). This license does not include any external marketing or public publication outside the Platform except with separate explicit consent.

23.4. No Prejudice to Moral Rights: "Qader" does not diminish the author's moral right to attribution and integrity, though purely technical modifications necessary for suitability/encoding/storage without substantial distortion are permitted.

23.5. Legal Responsibility on the User: The User (and the School for institutional publication) is solely responsible for the legality of content and its permissions, warrants it owns or possesses the necessary permissions (including image/audio/logo rights and media rights) and that it is free from infringement of the rights of others, confidentiality, or export restrictions.

23.6. Nature of Hosting and No Prior Review: The Platform is a host that does not conduct prior review of content. "Qader" reserves the right to remove/restrict/suspend quickly, without compensation, any content or account that violates Community Policy, law, or orders of competent authorities. The Establishment applies a "Repeat Infringer" policy for intellectual property rights.

23.7. Notice and "Vexatious Notice" Policy: An intellectual property notice mechanism is provided including: notifier identity, capacity/authorization, description of the work, link/evidence, and an undertaking of accuracy. The reported party is notified with a counter-notice path within a reasonable period. Filing a vexatious or bad-faith notice exposes the filer to actions including account closure and claims for actual damages and reasonable processing costs.

23.8. Automated Moderation Tools: Reasonable automated/human content detection (filtering words/detecting violations) may be used to improve safety; automated detection may make errors and is not a guarantee.

23.9. Prohibited Content Categories: Illegal materials, minor exploitation, privacy or intellectual property violations, sensitive data of others without authorization, hate speech, incitement and violence, malware, deceptive links, and any content that circumvents Platform controls or harms its integrity.

23.10. Minor Privacy and School Governance: For minor accounts, Guardian/Institution consents according to announced policies are observed. The educational institution must obtain and manage the legal basis. The Guardian/Institution may request removal of inappropriate child content according to Community Policy.

23.11. Duration, Termination, and Deletion: The license remains in effect as long as the content is available on the Platform. Upon deletion or account closure, future use ceases, while temporary technical copies may remain in backups/caches within announced retention periods. Content previously shared with other Users may remain accessible if it was copied or re-published within the Platform before deletion.

23.12. Remedial Paths: Disputes regarding content are handled by removing/disabling access, requesting additional information, or temporarily blocking the account. Removal does not create any obligation for compensation.

23.13. Precedence and Data Protection: In case of conflict regarding personal data, the Privacy Policy and/or Data Processing Addendum (DPA) prevail. Processing of any personal data within content is subject to data minimization and specific purpose principles.

23.14. We may, without an obligation for prior review, remove/block any content, disable access to it, or modify it, and retain a copy for evidentiary and compliance purposes, all according to our reasonable discretion and without prejudice to data subjects' rights.

24.1. Definition and Scope: "AI-Generated Content" means all texts/explanations/hints/solutions/summaries/images or any outputs automatically produced by the Platform based on User inputs or usage data within "Qader."

24.2. Ownership and Protectability: To the extent permitted by law, the User acquires the transferable rights to their specific outputs. However, some outputs may not be protectable under copyright law and may intersect with general knowledge or materials owned by others; "Qader" makes no assurances regarding their protectability or freedom from third-party rights.

24.3. User License (Educational/Internal Use): The User is granted a non-exclusive, worldwide, royalty-free, perpetual license to use the outputs for educational and personal/internal purposes, including saving and sharing them within their account or within their school or classroom environment according to subscription limits.

24.4. General Commercial Use and Re-Publication Outside the Ecosystem: Any public publication or commercial exploitation of outputs outside the Platform requires prior rights verification (image/audio/text rights of third parties, trademarks/test policies) and may require separate consent or license from rights holders or from "Qader" when the outputs include elements governed by restrictions. The User alone bears responsibility for this verification.

24.5. Verification and Accuracy Obligations: Outputs are advisory and may be erroneous, biased, or incomplete. Appropriate human review must be conducted before academic, administrative, or legal reliance. Outputs are not professional advice.

24.6. Schools and Institutional Use: The school and educational bodies may reuse outputs within their institutional scope for purely educational purposes and share them with their students and staff within licensed seat limits, without making them publicly available or reselling them, and without removing any accompanying systematic notices.

24.7. Limited License to "Qader": The User grants "Qader" a non-exclusive, royalty-free license to technically copy/store/process and display outputs to the extent necessary to provide the Service, ensure security, support, backup, and quality improvement within the product. "Qader" does not use minor inputs/outputs to train foundational models except with separate explicit consent according to the Privacy Policy and/or DPA.

24.8. Improvement and Learning from Data: "Qader" may use aggregated or anonymized data for statistical analysis and service improvement without identifying any individual. Selling data is prohibited. The User/School may enable/disable any explicit option for contributing training data where available.

24.9. Usage Restrictions: Using outputs to build a competing model, create a training dataset outside what licenses permit, stripping any source tags/security marks/digital information, or implying endorsement or partnership without prior written consent is prohibited.

24.10. Attribution and Transparency: When publishing publicly outside the Platform, it is recommended to state that the content is "AI-Assisted Generated," with the User bearing responsibility for the accuracy of what is published. Some contexts (e.g., research/competitions) may require specific disclosure requirements that the User must comply with.

24.11. Portability and Deletion: The User may export outputs in standard formats (e.g., JSON/CSV/PDF) within technical feasibility limits. Upon deletion of outputs, future use ceases, while temporary technical copies may remain in backups within announced retention periods.

24.12. Conflict Resolution with Privacy/Inputs: In case of conflict regarding personal data within outputs, the Privacy Policy and/or DPA prevail. User inputs (Prompts/files) remain subject to their own ownership and licensing arrangements under those policies.

24.13. Disclaimer and Liability: "Qader" does not guarantee outputs are error-free or free of third-party rights and is not liable for any use that violates laws or the rights of others. The general liability limitation in these Terms applies, "to the extent permitted by law."

25.1. Definition and Scope: The "Smart Educational Profile" is a structured compilation of the student's progress, activity, assessments, indicators, AI recommendations, and relevant educational records within the Platform. This profile does not include public community content or support correspondence except to the extent necessary to provide the Service.

25.2. Ownership and Legal Status: The Student (or their Guardian) remains the owner of their personal data, grades, and self-created content. For school accounts, the School is considered the "data controller" and the Establishment a "processor" according to the DPA; for non-school accounts, the Establishment is a "controller" to the extent necessary to provide the Service and comply with the law. "Qader" does not claim ownership of the student's academic records.

25.3. Limited License to "Qader": The Student/School grants "Qader" a non-exclusive, royalty-free license to technically copy/store/process/display the "Profile" to provide the Service, ensure security, support, backup, and quality improvement within the product. "Qader" is prohibited from selling data, and minor inputs/outputs are not used to train foundational models except with separate explicit revocable consent.

25.4. Access and Permissions: Permissions are set according to the principle of least privilege (RBAC) and school identity: the Student and their Guardian, assigned Teachers, and School Administration according to role. Sensitive view accesses are logged in an internal audit log.

25.5. Portability/Export: The Student/School has the right to export the "Profile" in standard formats (CSV/JSON/PDF) within reasonable technical limits. Upon verified request, export is completed within a reasonable period not exceeding 30 days. A reasonable fee may apply for frequent/large export requests.

25.6. Rectification and Objection: Requests to correct inaccurate data or object to pedagogically unnecessary processing may be submitted. Modifications are implemented within a reasonable period, retaining an audit trail of changes and their source (Teacher/Platform/User/AI Model).

25.7. Retention and Deletion: Retention and deletion periods in Appendix (2) apply. Upon subscription termination or consent withdrawal, the "Profile" is deleted or masked within the announced periods; backups are protected and masked/deleted according to the backup cycle (30–90 days).

25.8. Transfer Between Schools: Upon student transfer, transferring the "Profile" to the new educational institution is possible based on a verified request from the current school or Guardian, or delivered directly to the student/Guardian if technical integration with the new institution is unavailable.

25.9. Sharing with Third Parties: "Profile" elements are only shared with accredited processors stated on the Sub-processors page or integrations explicitly chosen by the School, with minimum necessary data and for educational purposes only, according to the DPA and these Terms. Direct marketing use is prohibited without explicit consent.

25.10. Sovereignty and Cross-Border Transfer: The default is storage and processing of minor data within the Kingdom. Any cross-border transfer is conducted according to the announced legal/contractual provisions, with prior notice and a reasonable right to object for schools, as in the sovereignty and data transfer clauses.

25.11. Confidentiality and Security: "Profiles" are secured by encryption in transit and at rest, role-based access controls, periodic permission reviews, and independent security tests.

25.12. Not Equivalent to Official Record: The "Profile" is a supportive educational tool and is not a certificate or official transcript unless certified otherwise by the school.

25.13. Continuity of Access upon Contract Termination: Access to the interface may be suspended upon non-payment/expiry, with a reasonable time window provided to export the "Profile" in available formats before final closure, according to retention policies.

25.14. Managing Guardian Consents: For non-school minor accounts, the Guardian can withdraw/restrict consent from settings. This affects only the relevant individual's access without creating a right to monetary refund; the seat may be replaced according to the school license.

25.15. Effect in Case of Conflict: In case of conflict between this clause and the Privacy Policy/DPA, the more specific privacy and data protection provisions prevail.

26.1. Definition and Scope: "AI Outputs" are everything the Platform automatically generates (text/audio/image/video/code/analytics/recommendations/practice questions/summaries), including what depends on User inputs and data within the Platform or integrated third-party models.

26.2. Usage License to User (Educational/Internal): The Student/User, and for school accounts their authorized users, are granted a non-exclusive, non-transferable, non-sublicensable license to use the outputs for educational and personal/internal purposes only within the subscription duration and seat count. Reselling outputs, publishing them as a standalone service, or using them to build a competing model is prohibited.

26.3. External Commercial Use and Liability Disclaimer: "Qader" does not grant any explicit commercial license for outputs. Any availability/distribution/commercial investment outside the educational/internal scope is at the User's sole responsibility after conducting a legal suitability check (copyright/trademarks/images/performances/trade secrets) and obtaining necessary licenses from rights holders if any.

26.4. No Warranty of Originality or Freedom from Third-Party Rights: Outputs are provided "AS IS" without any warranty of originality, protectability, or non-infringement. Outputs may resemble existing content, include elements subject to third-party rights, or be inherently unprotected; "Qader" assumes no obligation to guarantee non-infringement, to the extent permitted by law.

26.5. Responsibility for Inputs and Permissions: The User warrants they own or have a valid license for everything they input (texts/images/audio/data) and that these inputs do not infringe the rights of others or the law. The User alone bears the consequences of any use of outputs based on their violating inputs.

26.6. Verification Before Publication: Before any external publication or use of outputs (especially commercial/media), the User must conduct legal and content reviews (reviewing rights of persons in images, logos, works, and any contractual obligations with the school/curriculum owners).

26.7. Accuracy, Bias, and Suitability: Outputs are advisory and may contain errors, biases, or recommendations unsuitable for the User's context; human evaluation is required before reliance. Outputs are not used as "absolute truth" in high-risk decisions without independent verification.

26.8. Transparency of Academic Use: Academic integrity policies must be followed. When submitting outputs outside the Platform for educational/research purposes, the User must state the role of AI when required by the educational institution's policies, without implying official endorsement from "Qader."

26.9. Prohibition of Creating Competing Training Sets: Systematically collecting outputs to build competing models or derivative services, or using them to train external models except with a written license from "Qader," is prohibited.

26.10. Tagging/Identification Data: "Qader" reserves the right to include tags/identification data/source marks (watermarks) in outputs where legally feasible; removing or obscuring them is prohibited.

26.11. Handling Intellectual Property Claims: Upon a valid claim of infringement related to outputs published via the Platform, "Qader" may remove/disable access, modify, replace, or request clarifications/licenses, without an obligation for financial compensation; general liability limits and remedies in these Terms apply.

26.12. Ownership of Outputs Between Parties: "Qader" does not claim ownership of User outputs merely for generating them; "Qader's" right is limited to an operational license necessary for hosting, displaying within the Service, support, and internal improvement according to the Privacy Policy and DPA, without selling data.

26.13. Minor Data Exceptions: Minor inputs/outputs are not used to train foundational models except with separate explicit revocable consent, and processing of outputs remains within the educational purpose and according to a legal basis.

26.14. Third-Party Models and Services: Some outputs may depend on third-party model/service providers; use of outputs is also subject to those providers' terms to the extent applicable, without any guarantee from them or "Qader."

26.15. License Termination and Revocation: The license granted for outputs terminates or is revoked upon violation of these Terms or Policies (including Community Policy and Exam Integrity) or upon subscription expiry without authorized export, without prejudice to the rights of "Qader" or others.

26.16. No Effect on Disclaimer/Limitation Clauses: The general disclaimers and liability limits in these Terms apply to outputs without exception, and any related remedy is governed by those limits.

27.1. Confirmation that the policy applies to all AI systems on the Platform (educational adaptation, recommendation, conversation, academic monitoring, statistics).

27.2. An explicit commitment to actual compliance with the PDPL and its Executive Regulations, NDMO standards, AI ethics principles issued by SDAIA, adopting a management framework akin to ISO/IEC 42001, an alignment map with NIST AI-RMF, and drawing inspiration from the EU AI Act risk classification without claiming its local enforceability.

27.3. Philosophy of "Proactive Compliance" and alignment with SDAIA/NDMO/PDPL and ISO/IEC 42001 and NIST AI-RMF and drawing inspiration from the EU AI Act "without local enforceability." (Voluntary alignment with EU AI Act/NIST/ISO to adopt best practices, without claiming enforceability outside the national framework.) EU AI Act status: Always confirm it is voluntary alignment that does not create local legal obligations; mention the European timeline as a practice reference, not as an obligation.

28.1. Precise Operational Terms: AI System, Foundational/GPAI Model, Fine-Tuning, Training/Test/Evaluation Data, Synthetically Generated Data, Children's Data, Smart Educational Profile, Explainable Interpretation, Human Oversight, Harmful Output Incident. "High-Impact Educational Automated Decision," "Model/System Log," "Synthetic Data" with generation method and boundaries, and "Zero-Retention" for LLM providers, and "Verifiable Time of Knowledge."

29.1. AI Governance Council (escalation of risks, approvals, and mitigation plans).

29.2. Safe-Stop Emergency Stop Powers, with an emergency stop time not exceeding specified minutes in high-risk scenarios.

29.3. RACI definition between: AI Officer, Data Protection Officer (DPO), Cybersecurity, Academic Affairs, and Product.

29.4. Pre-, During, and Post-Launch Approval Paths according to ISO/IEC 42001.

29.5. "The internal audit/compliance function operates with organizational independence and reports quarterly directly to the AI Governance Council and senior management."

30.1. Pre-classification of Platform uses: (a) High Risk: assessment/testing and automated adaptation affecting the academic path; (b) Medium: content recommendation; (c) Limited: general chat/hints.

30.2. For each category: documentation obligations and pre-launch tests, drawing inspiration from the requirements of high-risk systems in the EU approach (technical documentation, post-market management, traceability) without local enforceability.

30.3. "The Platform prohibits: biometric recognition/inference for academic assessment purposes, emotional inference for grading, generating/using leaked or unlicensed materials, or any use that restricts the student's right or discriminates against them."

31.1. DPIA.

31.2. AI Impact Assessment (AIA) and high-risk privacy impact assessment under PDPL before any deployment. "Re-assessment of impact is mandatory upon: changing a core component/model, material change in data sources, emergence of medium/high risks, or new market/policy entry."

31.3. System/Model Cards.

31.3.1. All development/test environments are prohibited from using actual PII, and the production of Synthetic Data in the Model Card must be documented.

31.4. Gate-Criteria Conditions (accuracy, hallucination rate, stability, fairness, robustness), which are: "No system is deployed unless it achieves on internal validation data: accuracy ≥ 92%, hallucination ≤ 3%, fairness gap ≤ 5 points, stability ≥ 97%; Safe-Stop ≤ 5 minutes. Results are documented in the system card and approved." These are not contractual conditions that can be used against us in liability, but an attempt at commitment.

31.4.1. Institutional Measurement Framework: Performance, fairness, and robustness metrics are measured exclusively according to Appendix (Z): Institutional Measurement Framework for Educational AI Models, including the definition of each metric, sampling methodology, statistical neutrality, confidence intervals, and drift policy and retraining/stopping criteria.

31.5. Student Experimentation Policy (A/B):

31.5.1. When is it allowed? Low-impact interface improvements, hint phrasing, content ordering; prohibited during exams or in high-impact decisions.

31.5.2. Minors: requires explicit Guardian consent; default opt-out is easy; experiments that increase academic load/psychological pressure are not applied.

31.5.3. Ethical and Legal Basis: defining a legitimate purpose, data minimization, non-discrimination, and not using Dark Patterns.

31.5.4. Methodology: pre-registering a hypothesis, calculating a sufficient sample size, early stopping rules upon clear harm, segmental fairness analysis, and documenting results in an Evidence Pack and updating the AIA.

31.5.5. Transparency and Withdrawal: simple banner/notice, immediate right to withdraw without negative impact on the core service.

32.1. Legal bases for processing according to PDPL/NDMO (purpose, minimization, sensitivity, minor categories and their data, quality, record controls).

32.1.1. Reference to NDMO Data Governance Standards,

32.1.2. And linking model security to NCA-ECC (Version 2024) as a minimum for security requirements.

32.2. Records of Processing Activities (ROPA) and responsibility assignment.

32.2.1. "We maintain a Record of Processing Activities including: purposes, categories, locations, cross-border transfers, retention periods, technical and organizational controls, and control owners."

32.3. Residency and Sovereignty within the Kingdom, and controlling cross-border transfers (measures + bases).

32.3.1. "Data transfer outside the Kingdom is prohibited except according to the PDPL Executive Regulations (legitimate bases/safeguards/exceptions), with a transfer impact assessment and a documentary record for each operation."

32.3.2. Using live personal data in development/testing is prohibited; alternative/synthetic data is generated and documented in the system card.

32.4. Explicit policy for reusing student data in training: by default, no mixing/no use for external training except with clear consent and opt-out/opt-in options.

32.4.1. Students will produce sensitive data (grades, behaviors, interactions), and we will collect very sensitive data about each student (level, mistakes, weaknesses, and even their interaction method with the system). What is the method of collecting and processing it so that we do not violate the privacy protection principle?

32.4.2. What about the liability aspect if it is leaked? How does the user ensure that no misuse of it occurs? Meaning they are not exposed to risks (data leaks, selling to advertising companies, or using it for non-educational purposes).

32.4.3. Our policy on not "selling individuals' data," and separate consent for any secondary use.

32.5. "Technical deletion limits and memorization risks" with No-mix/Opt-in/Opt-out/Differential Privacy options, and a retraining plan and data indexing. The law sometimes requires deleting user data; but the problem is that models might "store" personal details (memorization) and it's difficult to delete them easily. So what is the plan to ensure there is no conflict between any legal requirement and the technical necessities we have? And how do we ensure clarity of this for individuals to guarantee their rights if they fear the use of their data for training? Do we implement a (no-mix policy), or differential privacy, and how do we maintain training copies capable of re-training and indexing original data, and what is the clear policy we have for technical deletion limits? "Given the generative nature of models and the possibility of retaining patterns from data (memorization), we adopt: a default No-mix policy for student data, Opt-in/Opt-out options, Differential Privacy techniques where possible, with source data indexing and a retraining plan that enables responding to deletion requests 'to the extent technically possible' with transparent disclosure of technical limits." "We commit to responding to rights requests within 30 days, extendable by an additional 30 days in specific cases, documenting the reason for the extension." "By default No-Mix for student data with external training; technically and operationally feasible Opt-in/Opt-out options; and adopting Differential Privacy where necessary; and handling deletion requests 'to the extent technically possible' through selective retraining and source indexing."

32.5.1. Our policy is clear:

32.5.1.1. Default No-mix for effective educational content,

32.5.1.2. Opt-in/Opt-out paths,

32.5.1.3. Using Differential Privacy where appropriate,

32.5.1.4. And a retraining/refinement plan with source indexing to ensure response to deletion requests "to the extent technically possible."

32.5.2. Channels and SLA for Data Subject Rights: "Responding to rights requests within ≤ 30 days (extendable by a justified 30 days), with identity verification and documenting the reason for any extension."

32.5.3. "Upon a material change in an external provider's terms or an increase in risk, an impact assessment is completed within X days; with high risk, a separation/isolation plan is activated within a short period with an alternative path."

32.6. Data Sovereignty and Hosting Location, Separation of Paths (what is sent / what remains local): What is sent to an external provider (if any) and what remains local.

32.6.1. If hacked, what happens to student data? What are the legal issues? And where is the data stored originally? On national or international servers? Our methodology in operating the site to ensure we do not provide any external models (outside Saudi Arabia) with student data, and how do we ensure data sovereignty protection?

32.6.2. If an external model we benefit from (e.g., ChatGPT servers that we dedicate to our database) has its terms of use changed, or its data leaked, what about liability for the leak? And what data is actually allowed to be given to external servers and what is given to local servers?

32.6.2.1. Change in external provider's terms: a clause mandating an impact review within X days of any material change in the provider's terms/practices (e.g., managed LLM interfaces), with an immediate data separation/isolation plan when risk increases.

32.6.2.2. "Impact assessment is completed within ≤ 10 Business Days of a material change; with high severity, a separation/isolation plan is activated within ≤ 15 days with an alternative path and no service interruption."

32.7. "Any LLM provider is committed to No-Training / Zero-Retention on the Platform's inputs and outputs, and to contractually agreed processing limits."

32.7.1. Explicit contractual No-Training/Zero-Retention clauses, a review period of ≤10 Business Days upon terms change, and a separation/isolation plan ≤15 days with an alternative path; link component security to NCA-ECC 2-2024.

33.1. Tags distinguishing interaction with AI.

33.2. Informing about reliance scopes, accuracy limits.

33.3. The right to request a simplified explanation of the recommendation/path reasoning. What exactly is the student's Right to Explanation and to what level? Meaning when does the student get the "right to request an explanation" for AI decisions taken by the AI? And how do we explain to the student why the platform suggested a specific question or study path in a simplified manner? So they know why we direct them? And what do we explain to them and what not? Arise (for high-impact decisions only), and what is disclosed (pedagogical summary + simplified technical explanation without revealing secrets/security vulnerabilities). Link it to model cards and NIST/ISO.

33.3.1. There are two levels of explanation:

33.3.1.1. A pedagogical summary justifying the recommendation (input characteristics/learning objective),

33.3.1.2. A simplified technical explanation upon request (factors/weights/data limits) without revealing IP secrets. (Link to Model Cards/NIST AI-RMF). "A simplified technical explanation is provided without disclosing intellectual property secrets or details that could enable circumvention or harm security."

33.4. Tagging AI-generated content and/or watermarking where possible.

34.1. Educational Fairness Indicators (no preference for those with more/richer data).

34.1.1. KPIs (performance differences between segments, impact of data abundance, topic recommendation bias), alert and escalation limits.

34.1.2. "When any KPI exceeds the alert limit, a remediation plan is initiated within ≤ 15 days, including: root cause, data/model adjustment, and re-measurement before deployment."

34.1.3. "Compensatory techniques are applied (weight limits/calibration/secure data augmentation) to ensure those with more data do not have an advantage, with periodic impact measurement."

34.2. Periodic Fairness Tests according to ISO/IEC 23894 and NIST AI-RMF as a risk reference.

34.3. Systematic Remediation Mechanism upon bias detection.

34.3.1. What is our transparent methodology to ensure the system does not discriminate against a specific group of students? And what can be offered to the student to further guarantee their right that there is no bias against them? So they feel more comfortable?

34.3.2. The AI algorithm might give different recommendations based on unclear or incomplete data (e.g., tending towards one group of students more than others, or suggesting harder questions for a specific group).

34.3.3. Is the following question a problem: How do we ensure that the AI does not favor students with more or clearer data, at the expense of others? And what is our methodology to address it?

35.1. AI-Specific Threat Modeling (Prompt Injection/Model Theft/Data Leakage).

35.2. Logical Isolation and Sensitive Context Limiting, Filtering, Logging, and Access Controls.

35.2.1. AI systems could be hacked or manipulated; how are we currently addressing these risks?

35.2.2. AI Model Penetration/Red-Teaming Tests: "Executing periodic Red-Team campaigns against Prompt Injection/Model Theft/Training Data Leakage and linking results to a time-bound remediation plan according to ECC." "Red-Team is executed at least semi-annually, and with any major release, linked to a time-bound remediation matrix and ECC standards; reports are kept in the Evidence Pack."

35.3. Integration with the Institutional Security Program. (Mention its link to the general security policies in Section "W" of the document.)

35.4. "Updated recovery/continuity plans (RTO/RPO) for AI components, and an annual test of the scenario of model failure and managed LLM provider." "RTO ≤ 4 hours, RPO ≤ 1 hour for critical smart learning components; annual comprehensive test with a report to the council."

36.1. "Safe Exam Mode" Restrictions: disabling/restricting model capabilities during the test, detecting violating attempts, tracking, and documenting cheating evidence.

36.2. Respecting "Qiyas" Rights, preventing leaks, and building an authentic skills-based question bank. (Linked to the "Exam Integrity" Appendix.)

36.2.1. Resources online mostly consist of protected exam questions and content shared without a license (leaks). What is our idea for respecting intellectual property rights and the reputation of the national education system?

36.2.2. Authentic Question Bank

36.2.3. How do we ensure our integration with tests actually helps improve them, rather than just being marketing talk? And how do we ensure our integration with the curricula taught (e.g., high school curricula for the achievement test)?

36.3. How we use science for this:

36.3.1. How do we build the AI model?

36.3.2. How do we build the database?

36.3.3. What are the 70 important criteria?

36.3.3.1. 20 during the test

36.3.3.2. 50 derived from them.

37.1. Human-in-the-Loop for high-impact uses, with

37.2. The Student/Teacher's right to object and request manual review (objection channels with specified timelines).

37.3. Grievance Policy: The Student/Guardian/Teacher has the right to submit a grievance against high-impact outputs or decisions. Grievances are received via the official channel and documented in a dedicated log.

37.4. Deadlines and Notices: Receipt acknowledgment ≤ 2 Business Days; initial reasoned decision ≤ 5 Business Days; with the possibility of temporarily suspending the impact for high-risk decisions until resolved.

37.5. Escalation Path: (a) Service/Product Team → (b) DPO/AI Officer → (c) Internal Independent Review Committee or referral to the supervisory authority when necessary. The complainant is provided with a reasoned decision letter and relevant measurement data. Files are retained for at least 5 years.

37.5.1. Maximum time to respond to a student/teacher objection (e.g., 5 Business Days). "Maximum response time for objection ≤ 5 Business Days, with an escalation channel to DPO/Governance Council upon dissatisfaction, and providing a reasoned decision to the user." "Maximum response time ≤ 5 Business Days, with escalation to DPO/Governance Council, and providing a reasoned decision to the user."

37.5.2. Should there be a fallback to humans, or in clearer terms: a mediator (even optional) between the AI and the student? For example, a teacher, guardian, or educational supervisor who can see everything the student does, and intervene if the platform gives a strange recommendation? And what do we do if it's difficult to provide to ensure there is no blind reliance on AI? And when can we actually rely on it and when not?

37.5.3. When does human intervention and oversight become necessary because the suggestion is very sensitive?

38.1. There will be a student community, with posts, comments, and private messages. What ensures that a student's private posts remain private and no one outside their privacy circle sees them?

38.2. Anti-Bullying: What ensures that a student on our platform will not face something inappropriate or wrong? Or that they are bullied, for example?

38.3. What ensures that they will not face a psychological problem due to the study plan suggested by the AI that pressures the student (making them feel they are always behind)? This would open a door for ethical/legal responsibility. So what is our methodology here to ensure the humanity of education, not just the glamour of using technology?

38.4. Well-being.

38.5. Over time, the student will build a "smart educational profile." The question: Who owns this profile? The student or the platform? And can the student transfer it to other platforms? Or do we have rights on our platform? Meaning what are their digital rights as a student, not just in terms of their experience? And is there a specific license, duration, scope of use, what exactly is it? And is there an agreement for transferring rights as needed? "The student owns their 'Smart Educational Profile'; the Platform grants a limited operational license necessary to provide the Service; the student may export and transfer it."

38.5.1. Right to Transfer and Export: The student has the right to obtain a copy of their Smart Educational Profile within ≤ 15 Business Days in a standard format (IMS Caliper/xAPI JSON, with a CSV alternative) via a documented API interface or direct download after identity verification.

38.5.2. Interoperability: The Platform commits to supporting a declared field schema and public documentation for consumption; one free copy per quarter, with a reasonable cap for frequent requests.

38.5.3. Respecting Rights of Others: Data or content affecting the rights of others or trade secrets are excluded; this is mentioned in the delivery report.

38.5.4. Post-Transfer: Deletion of the profile after transfer is not required except upon explicit request according to the deletion policy; export logs are retained for compliance purposes.

38.6. The conversation with the AI might be directed by the student to touch upon issues outside the curriculum. How will we ensure that the system does not deviate from the cultural, religious context, and public decency?

39.1. Age controls and Guardian consent, parent and teacher monitoring dashboards, and abuse reporting paths. (Alignment with relevant local child protection laws.)

39.1.1. "The Platform commits to the provisions of the Child Protection Law and its Executive Regulations, including reporting channels and escalation procedures."

39.1.2. How do we handle minor data? And how do we ensure the Guardian knows everything the child does and is monitoring? And that minors cannot register or agree to data without the parents knowing? To ensure their security and rights?

40.1. Due Diligence Check (DPIA/Security/Data Sovereignty), Data Processing Agreements (DPA).

40.2. Data Sovereignty and CCRF: Clarify what is sent externally and what remains local, linking to CST/CCRF for external or hybrid hosting.

40.3. Sub-processors Log, and preventing use of our data for provider training except with consent.

40.4. Terms Change Obligations.

40.4.1. "Upon a material change in an external provider's terms or an increase in risk, an impact assessment is completed within X days; with high risk, a separation/isolation plan is activated within a short period with an alternative path."

40.4.2. "Impact assessment is completed within ≤ 10 Business Days of a material change; with high severity, a separation/isolation plan is activated within ≤ 15 days with an alternative path and no service interruption."

41.1. Data Source Tracking, Intellectual Property.

41.2. OSS Licenses.

41.3. And documenting safeguards against infringements.

41.3.1. The simplifications in explanation, detail in hints, and solution method generated by AI: who owns their rights, and what exactly are our rights as "Qader"?

41.3.2. In an AI chat... the content written or explained by the AI to the student: who does its rights belong to? The platform? Or the student? And does the student have the right to share it?

42.1. Nature of Recommendations: Advisory, not guaranteeing results + reliance limits. If the AI model we built gives incorrect recommendations, suggestions, or educational paths, or a biased decision based on region or proficiency level, or focused on less important topics, and this affects the student's future, what about responsibility? Is it lost or how? Platform recommendations and AI outputs are advisory supportive tools for the educational process and do not create a contractual commitment to achieving a specific academic result; high-impact educational decisions remain subject to human oversight when necessary.

42.2. Content Outside the Curriculum and Local Compliance (Linguistic/Religious/Social Controls). In the AI chat, the student might ask questions outside the scope of study, something personal, religious, or social. What are the controls here? Is the platform responsible for AI responses if they are incorrect or inappropriate? How do we ensure that responses do not contain content that violates laws, local values, and public decency?

42.3. Marketing Code: Prohibiting unproven grade promises and any unverifiable claims. Our policy to avoid any potential "misleading" of students (especially in terms of grade promises), from a marketing perspective, and from the perspective of incentives on the site.

42.3.1. Prohibiting phrases like "we guarantee 95%". "No marketing claim is published without a measurement methodology paper and statistical evidence available for audit; phrases like (we guarantee 95%) are expressly prohibited." "No marketing claim is published unless accompanied by a measurement methodology paper and verifiable results; phrases like (we guarantee %) are expressly prohibited."

42.3.2. Allowing only verifiable claims with a published measurement methodology,

42.3.3. Legal review before publication, and documenting evidence for any claim.

42.4. Are recommendations a "supportive tool" or a contractual obligation?

42.5. What is our marketing policy? And if the platform markets itself... what promises can it give (meaning some platforms say "we guarantee you 95% in aptitude tests" without scientific basis, or accelerate your studying 10 times, which is often very difficult even using the latest technologies on the most famous global websites, so it falls under misleading advertisements), how do we avoid this?

43.1. Performance and Risk Indicators (MLOps + Responsible AI Ops).

43.2. Monitoring Drift/Deterioration, Incident Rate. "Conversation models are subject to objective filters that prohibit content violating laws, values, and public decency, and provide reporting and urgent removal paths for inappropriate outputs."

43.3. Processing Speed, and Remediation Plan.

44.1. Stress, Fairness, and Robustness Tests; third-party reviews or internal audits according to ISO/IEC 42001, and raising results to the Governance Council.

44.2. System/Model Log: A central registry including versions, data, modifications, test results, governance decisions, open risks, and who approved them (for spot audits).

45.1. An auditable technical file including data maps, model cards, governance decisions, test results, and a matrix aligning with laws and standards (PDPL/NDMO/SDAIA/ISO/NIST/EU-AI-Act).

45.2. We provide an Evidence Pack in an indexed format: ROPA, flow maps, fairness/robustness test results, Red-Team reports, Governance Council decisions, DPA contracts, and model version log. The Evidence Pack includes an annotated log of governance decisions showing alternatives, residual risks, approval owners, and effective dates."

46.1. Incident Classification (Privacy/Safety/Academic Integrity/Misuse), Timelines, and Data Breach Notification according to PDPL (72 hours where applicable), and a Communication Plan with users and authorities.

46.1.1. What is the breach notification mechanism? Meaning legally we must notify within 72 hours. So what is the plan to ensure we know about the matter before this period?

46.1.2. "We commit to notifying the competent authority within a period not exceeding 72 hours from the time of knowledge of the incident, when it is likely to cause harm to personal data or its owners, or conflict with their rights or interests, and to notify affected individuals without undue delay. Reports are submitted via the official SDAIA service and require registration on the NDMO national governance platform."

46.1.3. Incident Severity Matrix and Start of the 72-hour Counter: "The 72-hour counter starts from the verifiable time of knowledge of a significant breach; severity (low/medium/high/critical) is determined and linked to internal and external notification decisions." "Verifiable time of knowledge means: the first internal timestamp confirming the incident by the security/compliance team after an initial triage."

46.2. "Notification simulation and incident management exercises are executed at least quarterly, with lessons learned documented and an improvement plan."

47.1. Commitment to obtaining any current or future relevant licenses (cloud/telecom/education).

47.2. A "Regulatory Foresight" plan to align with updates to the national framework. (Refers to the effectiveness of the PDPL Executive Regulations since September 14, 2024, as an example of phased movement).

47.3. Our endeavor to make our product testable under a regulatory umbrella, and the plan regarding the AI Ethics Self-Assessment to obtain accreditation from the Saudi Authority SDAIA.

47.4. Our plan for integration with the Ministry of Education, specifically the National eLearning Center NeLC: https://nelc.gov.sa/en/node/3140

47.4.1. "We commit to fulfilling NeLC standards and methodologies necessary for licensing/accreditation, and adhering to the FutureX portal where applicable."

47.5. Linking cloud requirements to CST/CCRF for external hosting,

47.6. And the SDAIA accreditation plan and alignment with NeLC as an operational annex (roadmap/requirements/contact points).

47.7. Mini-National Jurisdiction Scheme:

47.7.1. SDAIA/PDPL: Data protection, AI ethics, and breach notifications.

47.7.2. NDMO: National data governance, classification, and residency policies.

47.7.3. NCA (ECC): Cybersecurity and minimum technical controls.

47.7.4. CST/CCRF: Cloud and communications requirements when hosted with providers.

47.7.5. Ministry of Education/NeLC: Licensing and accreditation for e-learning and integration with FutureX.

47.7.6. Reference Ladder in Case of Conflict: lex specialis, then the most recently implemented; in case of doubt, refer to the competent authority with deployment suspended until resolution.

48.1. When do we update the policy? At least annual review, or upon: material change in models/data, issuance of new local legislation, major updates to the EU AI Act or international standards. Amendment logs and decision records are retained.

48.1.1. What is our methodology to design our platform to ensure rapid alignment with future changes, whether in terms of tests and their evolution, or in terms of compliance with laws we expect to be legislated due to their general necessity, and their importance in achieving the Vision's goals? Meaning we don't wait for legislation to come; rather, we design as if the legislation we see as an ethical necessity, even if not yet legislated and mandatory, is already present.

48.1.2. How do we try to mitigate regulatory chaos? And ensure fairness in the application of technology?

48.1.3. What is our view on social impacts?

49.1. Appendix (A): Regulatory Alignment Matrix PDPL/NDMO/SDAIA ↔ ISO/IEC 42001 ↔ ISO/IEC 23894 ↔ NIST AI-RMF ↔ EU AI Act (Summary of obligations, evidence, control owner).

49.2. Appendix (B): AI Impact Assessment (AIA) Template with readiness questions, risk classification, and mitigation matrix.

49.3. Appendix (C): AI System/Model Launch Checklist (Acceptance, Security, Fairness, Transparency, Logs).

49.4. Appendix (D): Policy on Reusing Student Data in Training (default non-use, Opt-in/Opt-out mechanisms, export/deletion).

49.5. Appendix (E): Model/System Card in a standardized format.

49.6. Appendix (F): "Safe Exam Mode" Protocol and link to the Exam Integrity Appendix.

49.7. Appendix (Z): Academic Performance Standards and Minimum AI Model Criteria (Definition of Metrics, Acceptance Thresholds, Measurement Methodology, Test Data Examples).

49.7.1. Standard Definitions: Accuracy, Hallucination Rate, Fairness Gap (Parity/EOpp/EOdds), Robustness, Stability (Test–retest), Response Time, Curriculum Coverage, Justification Quality.

49.7.2. Test Set: Closed and class-wise representative of stages and subjects; leak-free; updated periodically by ≤10%/quarter with a frozen version for comparison; documenting item source and IP controls.

49.7.3. Statistical Neutrality: Strict Train/Val/Test split; calculating 95% CI (Wilson/Clopper–Pearson as appropriate); reporting Effect Sizes and correcting for multiple testing; preventing P-hacking through a pre-registered measurement protocol.

49.7.4. Drift Policy: Monitoring Data/Concept Drift via PSI/KL and time windows; operational thresholds triggering recalibration/retraining/safe stop; documenting decisions in the system log.

49.7.5. Version Acceptance: No model is deployed unless it meets the approved thresholds in this appendix on out-of-training data; publishing a (non-technical) measurement summary for users with confidence limits.

49.7.6. Governance: Measurement ownership by an independent team under the Governance Council; annual third-party review of the measurement framework; archiving all measurement reports, scripts, and reference samples within the Evidence Pack.

49.8. Grievance Template and Handling Procedures (two pages): Includes: identity/relationship fields, description of the contested decision, its impact, supporting evidence, requested action, option to suspend impact; timeline table; acceptance/rejection criteria; reasoned decision templates; escalation path and contact methods.

49.9. Educational A/B Testing Code: Permitted/prohibited matrix, operational examples, hypothesis registration templates, minor consent requirements, and psychological protection rules.

49.10. I preferred to add an Advertising and Marketing Communication Policy (to avoid misleading + examples of prohibited/restricted claims + internal approval controls).

49.11. SDAIA & NeLC Accreditation/Integration Plan (roadmap, requirements, supporting documents, contact points).

50.1. Data Categories Covered: Includes account and identification data (name, contact details, class/category), educational data (grades, progress, assignments, "Smart Educational Profile"), User Content (text/images/video/audio uploaded or created within the Platform), usage and telemetry data (application performance, errors, session times), technical identifiers (IP, device/browser ID, timestamp), and support and communication logs.

50.2. Sensitive Minor Data: Exam results, educational behavior, voices, images, videos, and conversations are treated as sensitive and are subject to strict access controls and encryption in transit and at rest, to the extent permitted by law.

50.3. Processing Purposes: Operating the Platform and providing features, educational personalization and path recommendations, measurement and indirect statistical analysis, security and fraud/abuse prevention, regulatory compliance, and quality improvement/internal testing using aggregated or anonymized data.

50.4. Data Minimization Principle: Only data necessary for the specified purpose is collected. It is not reused for a new purpose without clear notification and an appropriate legal basis (refer to the Legal Bases clause).

50.5. Sensitivity Limits: Inferring precise attributes about minors (such as health attributes or beliefs) from general educational interactions is prohibited. No sensitive classifications are carried out outside the legitimate educational/security purpose.

50.6. Camera/Microphone (Optional and with Explicit Consent): Camera/microphone access is not activated except after in-product consent showing the processing location (local/cloud) and its purpose, with an option to deactivate at any time without affecting features not dependent on them.

50.7. No Biometric Matching: No facial matching, voiceprint, or biometric feature extraction is performed from media. Media is used for communication/education only and with explicit revocable consent.

50.8. Local vs. Cloud Processing: Where possible, processing is performed locally on the user's device. When cloud processing is necessary, we notify in advance within the product and send only the minimum necessary to providers announced on the Sub-processors/Data Flows page, with the stipulated safeguards.

50.9. Technical Identifiers and Logs: IP/device ID/timestamp are used for security, abuse prevention, and documenting consents (Clickwrap) and login logs.

50.10. Supervision and Support Samples: Limited samples of sessions/logs may be taken for abuse prevention or technical support purposes, by authorized personnel under confidentiality and audit controls. These samples are not used for marketing.

50.11. No Direct Marketing to Minors: Direct marketing to minors is prohibited except with revocable Guardian consent, without prejudice to essential service notices.

50.12. Processing for Research and Improvement Purposes: When we use data for research and model improvement, it is in aggregated/anonymized form or with appropriate permission, with a prohibition on any re-identification.

50.13. Data Sharing with Third Parties: Sensitive minor data is shared only with announced sub-processors, to the extent necessary to provide the Service, and under binding data protection agreements. Refer to the DPA Appendix and Sub-processors/Data Flows page.

50.14. Cross-Border Transfer and Data Sovereignty: The default is storage within the Kingdom. Any external transfer — if necessary — is carried out according to the announced frameworks and contractual safeguards/consents, with reasonable prior notice. Refer to the Data Transfer and Data Sovereignty clause.

50.15. Cookies/SDKs: Non-essential cookies or SDKs are not activated before consent via the cookie preference dashboard, with the possibility of withdrawal at any time.

50.16. Retention and Deletion: Retention and deletion periods in the Retention and Deletion Appendix apply, with masking/deletion of backups according to the specified cycle and documented execution.

50.17. Data Subject Rights and Consent Management: Channels for access/rectification/objection/deletion/portability are available within a period of 30 days, extendable once with notice of the reason, after appropriate identity verification. Consents can be withdrawn from settings without affecting essential service notices.

50.18. Compliance and Reference Frameworks: Processing is managed according to the Personal Data Protection Law (PDPL) and internal security and privacy frameworks. This clause is updated periodically to align with regulatory requirements, to the extent permitted by law.

51.1. Approved Bases: Processing is based on one of the available legal bases under the Personal Data Protection Law and its Executive Regulations, which are — depending on the context — explicit consent, execution of an agreement with the User/Guardian/School, a legal obligation, or a balanced legitimate interest (for security, improvement, and fraud prevention purposes), to the extent permitted by law.

51.2. "Purpose ← Basis" Matrix: Each processing purpose has a specific and documented legal basis (Service operation = contract execution; security and abuse prevention = legitimate interest/legal obligation; aggregated analytics and improvement = balanced legitimate interest; optional marketing and non-essential cookies = consent; mandatory compliance and retention = legal obligation).

51.3. Primacy of Minor's Interest and Safety: In any reasonable conflict between bases, the minor's safety and best interest take precedence. "Legitimate interest" is not relied upon to process sensitive minor data except in cases of security and fraud prevention under strict controls, or where the law explicitly permits.

51.4. Explicit and Separate Consent: Explicit, revocable consents are obtained for optional features (e.g., camera/microphone, non-essential cookies, marketing communications). Records are kept (timestamp/IP address/device ID), and consent is re-requested upon any material change in purpose or processing party.

51.5. Withdrawal of Consent Without Retroactive Effect: Consent can be withdrawn at any time from account settings/unsubscribe links. Withdrawal affects future processing for the consented purpose only, without prejudice to essential service notices or legally mandated processing.

51.6. Reliance on "Contract Execution": Data necessary to provide the Service and fulfill our contractual obligations (e.g., account creation, basic educational personalization, support) is processed on the basis of "contract execution." Beyond necessity, we move to consent or conduct a "legitimate interest" test.

51.7. Legitimate Interest (Balance Test): When relying on it, we conduct a documented balance test considering user expectations, minor risks, and mitigation measures (data minimization, aggregation/anonymization, access controls). Legitimate interest is not used for direct marketing to minors.

51.8. School's Obligation as a B2B Legal Basis: The educational institution confirms it has provided the legal basis for processing its students' data, provided necessary disclosures, and managed rights requests. It bears — according to the DPA — responsibility for the correctness of the legal basis and communicating it to the relevant users, and indemnifying the Establishment for failure to do so.

51.9. Purpose Change (Compatibility Test): We do not change the processing purpose without testing compatibility with the original purpose. If the change is not compatible, we request new consent or state the new legal basis before the change takes effect.

51.10. Sensitive Minor Data: Processed with minimum necessary data, under an appropriate and enhanced legal basis (explicit consent or a clear legal/security obligation). Reliance on legitimate interest for this category is not permitted except in cases of security and abuse prevention and to the narrowest extent possible.

51.11. Documentation and Governance: We maintain Records of Processing Activities (ROPAs), Impact Assessments (DPIAs) for high-risk processing, and Legitimate Interest Assessment (LIA) logs where used. These are updated periodically or upon material change.

51.12. Transparency of Notices: We issue simplified privacy notices and layered details within the product defining the purpose, basis, retention, sharing, and rights. Any addition of a processor/international transfer is subject to the announced notification mechanisms.

51.13. No Conditioning of Consent for Non-Essential: We do not make access to the core service conditional on consenting to non-essential processing. Reasonable alternatives are provided when refusing non-essential cookies/features where possible.

51.14. Legal Evidence: Upon receiving a request from a competent authority or a regulatory obligation, processing is on the basis of "legal obligation," to the minimum extent necessary, and after documenting and legally reviewing the request.

52.1. No Sale, Rental, or Barter: We do not sell, rent, or exchange User data — including minor data — for monetary or non-monetary consideration, nor do we allow any use for independent third-party marketing purposes, to the extent permitted by law.

52.2. Scope of Core Use: Data is used for the educational purpose, Platform operation, security, and compliance only. Any secondary use beyond this (such as internal research not necessary for operation, or testing new features outside the scope) requires separate, explicit, and revocable consent.

52.3. Optional Marketing Communications: We do not send marketing messages (email/notifications/SMS) except with explicit revocable consent at any time via an "unsubscribe" link or account settings. Withdrawal of consent does not affect essential service notices (e.g., security, billing, and support notices).

52.4. Marketing Related to Minors: Direct marketing to minors is prohibited except with revocable Guardian consent. We do not use sensitive minor data for any marketing purposes under any circumstances.

52.5. No Creation of Advertising Profiles by Third Parties: We do not share identifiers or attributes that enable third parties to build advertising profiles about students/users, nor do we engage in cross-service behavioral advertising, nor activate non-essential marketing tracking tools without prior consent via the cookie preference dashboard.

52.6. Aggregated or Anonymized Data: We reserve the right to use aggregated or statistically anonymized data to improve the Service and for reporting purposes, provided that this processing does not lead to the practical identification of a specific individual, with contractual and technical controls against re-identification.

52.7. Preference Management and Execution Speed: A "Preference Dashboard" is available to manage consents, marketing topics, and channels. Withdrawal requests are implemented within a reasonable period not exceeding (2) Business Days, without affecting access to core features.

52.8. Restriction of Third-Party Processors: Our sub-processors are not permitted to use data for their own purposes. Processing contracts restrict data use to the disclosed purpose only, with a prohibition on resale/sharing for independent marketing purposes.

52.9. Proof of Consent and Purpose Change: We document each consent (timestamp/IP address/device ID) and re-request it upon any material change in purpose or processing party. We do not change the purpose to a marketing/secondary one without clear new consent.

52.10. No Conditioning or Bundling: We do not condition access to the core service on consent to marketing or non-essential secondary uses; reasonable alternatives are provided when refusing non-essential cookies.

52.11. Compliance Exceptions: Data sharing may occur to the minimum extent necessary to comply with a legitimate written legal request or to protect safety/security, according to the Official Requests Policy.

53.1. Scope of Consents and Types: Consents are granted in a granular manner by purpose, including, by way of example and not limitation: core service operation, camera/microphone, optional cloud processing, non-essential cookies, marketing communications, limited sharing with optional processors, and cross-border data transfer. No non-essential use is initiated without explicit consent.

53.2. Consent Granting Mechanisms: Consents are obtained within the product via explicit documented acceptance (Clickwrap/Toggle) with a timestamp, IP address, and device ID. For school accounts, consent transferred from the educational institution according to its documented policies is relied upon, with us retaining an audit log. For the non-school path, verification can be via OTP to the Guardian's number or a valid guardianship document.

53.3. Who Has the Right to Consent: The Guardian has the right to grant/withdraw consent for the minor's account. In school environments, consents are managed via the authorized educational institution representative according to the DPA; we commit to applying their instructions to their students' accounts within legal limits.

53.4. Withdrawal or Restriction Channels: Consent can be withdrawn or restricted at any time via account settings within the product, via "unsubscribe" links in emails, or by contacting the privacy channel/DPO. For school accounts, requests are submitted via the approved school channel or school administrator.

53.5. Effect of Withdrawal on Service: Withdrawal applies to the future and does not affect the lawfulness of past processing. Some features dependent on those consents may stop or deteriorate (e.g., interactive video, non-essential analytical tracking, deep personalization, or cross-border transfer). Withdrawal does not create any right to a refund or fee reduction. The school may replace the seat with another User within the same license if necessary.

53.6. What Continues Without Marketing Consent: Essential service notices (security, outages, billing, terms changes), minimum necessary processing for operation, contract execution, security and regulatory compliance, and legitimate requests from competent authorities; to the extent permitted by law.

53.7. Time and Execution: Preference changes (e.g., disabling camera/microphone/non-essential cookies) are implemented immediately or within a reasonable period not exceeding (2) Business Days. Data rights requests (access/rectification/erasure/portability/objection) are handled within the announced timelines in the relevant rights clauses.

53.8. Proof and Auditing: We document all consents, withdrawals, and modifications with a timestamp/IP address/device ID in an immutable audit log. Excerpts may be made available to schools or competent authorities upon request and according to controls.

53.9. Objection to "Legitimate Interest": When processing is based on legitimate interest (e.g., improvement or security), the data subject has the right to object based on their particular situation. We evaluate the objection and provide reasonable alternatives or stop non-essential processing when the individual's right prevails.

53.10. Prohibition of Direct Marketing to Minors: Direct marketing to minors is prohibited except with revocable Guardian consent; withdrawal does not affect essential service notices. We do not use sensitive minor data for marketing purposes under any circumstances.

53.11. Deletion and Retention Limits: Withdrawal of consent does not mandate deletion of records necessary for security, compliance, billing, or defense of claims; retention and deletion periods in the Retention Matrix apply.

53.12. Cross-Border Transfer upon Consent Withdrawal: If transfer consent is withdrawn, we stop external sending and attempt to provide a local alternative with commercially reasonable efforts. If unavailable, a particular feature may be affected without an obligation for refund or compensation, with the option to export data in a standard format.

53.13. Individual Applicability: Withdrawal or restriction of consent by the Guardian affects only the relevant individual's access/features and does not create a right for the school to a refund or reduction for the license as a whole.

53.14. Educational Institution Obligations: The school provides the Establishment — upon request — with a copy of its Guardian consent collection policy and mechanism, and remains responsible for managing those consents and responding to rights requests within its scope as a data controller (where this status applies).

54.1. Scope of Application: These provisions apply to all "Qader" User data within the Kingdom, with minor data and their sensitive data (results, behavior, voices, images, videos, conversations) receiving the highest levels of protection and restrictions.

54.2. Primacy of National Residency: The default is storage and processing of production data — including backups and logs — within the borders of the Kingdom of Saudi Arabia on approved local infrastructure, to the extent permitted by law.

54.3. Isolation from External Systems: Student data — especially sensitive minor data — is isolated from any external systems or general model providers not required for core operation. Any external integration is activated only when necessary and to a minimum extent, after strict controls and notices/consents where required.

54.4. No Training Mixing: Student data is not used to train general third-party models, nor is it mixed with external training sets. Any reuse beyond operation is prohibited unless explicit and conditional consents are obtained.

54.5. Local Alternatives by Default: When a feature requires specialized cloud processing, the local alternative within the Kingdom is chosen first. If unavailable, the feature is deactivated by default for minor accounts or not activated except with explicit consent according to the relevant cross-border transfer clauses.

54.6. Environment and Data Separation: Production environments are completely separated from development/testing. Using real production data for testing is prohibited; synthetic generation/masking is used instead.

54.7. Access Controls: The principle of least privilege, periodic permission reviews, and complete tracking of access in an immutable audit log are applied. A documented excerpt is provided to schools or competent authorities upon request and according to controls.

54.8. Encryption and Protection: Data is encrypted in transit and at rest using robust controls compliant with industry best practices, with centralized key management and segmented access for sensitive data.

54.9. Hosting and Infrastructure: No infrastructure processor or hosting provider is used except those announced on the updated "Sub-processors & Data Flows" page/Appendix. Binding contractual obligations for data protection and sovereignty are applied.

54.10. Backup and Business Continuity within the Kingdom: Backups and disaster recovery (DR) readiness are maintained within the national hosting scope, without entailing transfer across borders.

54.11. Distribution Networks and Supporting Parties: CDN/Logs/Monitoring are configured so that sensitive student data is not stored outside the Kingdom. Anything outside — if any — is limited to non-identifying technical data and according to controls.

54.12. Consistency with Transfer Clauses: Any deviation from national residency — if necessary — is exclusively subject to the "Cross-Border Data Transfer" clauses, their notices, and related objection rights, with the operational effect stated there.

54.13. No Derogation from Legal Rights: This clause does not prejudice any mandatory rights conferred by Saudi law, and is interpreted in favor of minor protection and data sovereignty.

55.1. Principle and Definition: The principle is the storage and processing of all "Qader" User data within the Kingdom of Saudi Arabia. "Cross-border transfer" means any remote availability, processing, or access to data from outside the Kingdom — remote access is treated as a "transfer" for the purposes of this clause.

55.2. Conditions for Exceptional Permission: No transfer outside the Kingdom occurs except when operationally necessary and to a minimum extent, and where equivalent protection and/or binding contractual safeguards according to the Personal Data Protection Law (PDPL) and its regulations are available, or an explicit legal exception, or explicit informed consent — to the extent permitted by law.

55.3. Live Disclosure Page: An updated "Sub-processors & Data Flows" sub-page publishes: countries/regions, affected data categories, transfer purpose, identity of the external processor, and the legal means of transfer (explicit exception, binding clauses/agreements, or explicit consent).

55.4. Prior Notice and Right to Object (B2B): Schools are notified in advance before any addition/material change in transfer flows, with a period of no less than (15) days, with a reasonable and reasoned right to object related to compliance or security. Failure to object within the period constitutes deemed consent.

55.5. Sensitive Minor Data: The default is a prohibition on transferring sensitive minor data (results, behavior, voices, images, videos, conversations, precise identifiers) outside the Kingdom. Exceptions are only through one of the legal transfer means announced on the "Sub-processors & Data Flows" page, and with prior notice of no less than (15) days to schools and a reasonable right to object.

55.6. Local Alternative or Feature Suspension: If a local alternative cannot be provided with commercially reasonable efforts, the school may suspend the affected feature or terminate only the affected part without penalty or any additional compensation; options to export relevant data in CSV/JSON format within (30) days are available.

55.7. No Monetary Refund: Any suspension/termination according to the previous paragraph does not create a right to a monetary refund for what has already been paid for; other provisions regarding fees and contractual remedies apply as in the general Terms and SLA Appendix.

55.8. Minimization and Masking: When transfer is necessary, it is limited to the minimum necessary data, with appropriate techniques (masking/hashing/strong encryption in transit and at rest, robust key management). Permanent storage outside the Kingdom for sensitive minor data is prohibited where transient processing suffices.

55.9. Restrictions on Onward Transfer: Any external processor is prohibited from conducting "onward transfer" to another country or sub-processor except with the same level of safeguards, after inclusion on the "Sub-processors & Data Flows" page, and prior notice and objection where applicable.

55.10. Consistency of Individual Notices: Where required by law, the data subject is notified of the transfer, its purpose, legal means, and related rights — without prejudice to notifications to schools as controller/processor (as applicable) under the DPA.

55.11. Remote Support Access: Cross-border technical support — if necessary — is managed via secure channels and time/scope-limited authorizations, with each access logged in an immutable audit log.

55.12. No Derogation from Sovereignty: This clause is interpreted in favor of data sovereignty within the Kingdom and does not prejudice any regulatory or supervisory requirements or mandatory rights conferred by Saudi law. Transfer flows remain subject to any subsequent regulatory updates.

56.1. Definition and Scope: A "Sub-processor" is any third party that "Qader" authorizes to process data on its behalf/on behalf of the school as applicable. Their use is limited to what is necessary to operate the affected features and according to written instructions and pre-defined specific purposes.

56.2. Public Live Disclosure: An updated "Sub-processors & Data Flows" list is published on a live page including: processor name, service category (hosting, communications, support, AI models, error analysis…), countries/regions, affected data categories, purpose, and legal transfer means where applicable.

56.3. Notice and Right to Object (B2B): Schools are notified before adding/changing a sub-processor materially, with a period of no less than (15) days, and may object on objective grounds related to compliance or security. Failure to object within the period constitutes deemed consent.

56.4. Objection Path and Solutions: Upon a legitimate objection, "Qader" has the right to propose an alternative or mitigation within (30) days. If unsuccessful, the sole remedy for the school is to suspend/stop the affected feature and be relieved of its future fees, with the ability to export relevant data; no right to a monetary refund for previous periods arises.

56.5. Urgent Cases: In urgent security/compliance circumstances or unavoidable service continuity, an alternative processor may be engaged immediately to prevent disruption, with notice to the school as soon as possible, while the right to object and solutions above remain.

56.6. Binding Contractual Obligations: "Qader" imposes "flow-down" contractual obligations on each sub-processor including confidentiality, equivalent security protection, deletion/return upon purpose expiry, prohibition of onward transfer without equivalent safeguards and prior notice, and cooperation in data subject rights and incident notifications within specified deadlines.

56.7. Minimization and Specific Purpose: Data exchange is limited to the minimum necessary to achieve the specific purpose of the feature, with masking/hashing/encryption in transit and at rest, and a prohibition on combining or secondary use outside contractual instructions.

56.8. Permitted Processor Categories and Data Types: (a) Hosting and Infrastructure Operation (account/telemetry/error log data), (b) Communications (sending email/OTP messages/service notifications), (c) Technical Support and Error Management (ticket data/masked technical logs), (d) AI Model Providers for specific features (texts/prompts/educational content, without direct identifiers where possible), (e) Performance Analytics/Error Monitoring (anonymized/aggregated data).

56.9. Special Restrictions for Model Providers: Enabling external model training on minor data or school content without prior explicit and informed consent is prohibited. Inputs are sent, where possible, after removing direct/precise identifiers or masking, and with disabling any "long-term storage/continuous learning" if technically feasible.

56.10. Data Sovereignty and Cross-Border Transfer: Any sharing involving access from outside the Kingdom is managed according to the "Cross-Border Data Transfer" clause. No "onward transfer" to another country or sub-processor occurs except with equivalent safeguards, prior inclusion on the disclosure page, and notice with the same deadlines.

56.11. Auditing and Transparency: Instead of on-site visits, recent third-party compliance reports/certificates (e.g., SOC/ISO) or reasonable security questionnaire responses are provided and made available to schools upon request under confidentiality, updated annually or upon material change.

56.12. Deletion and Retention: The processor must delete/mask upon purpose expiry or end of relationship, and delete backups within the (30–90) day backup cycle, with documented execution in an audit log.

56.13. Official Requests: The processor must not disclose except under written, specific legal requests, to the minimum extent necessary, with notification to "Qader" and the school where legally permitted, and cooperation in legitimate objections.

56.14. No Change to Fee Terms: Any change in processors does not itself create a right to termination or monetary refund; only suspension/future fee relief for the affected feature applies, as above.

56.15. School's Responsibility as Controller (as applicable): The school must provide the legal basis for processing its students' data, manage their rights requests, and bear the consequences of failure towards data subjects and competent authorities.

57.1. Scope of Application: "Qader" and all its features and policies commit to the applicable provisions in the Kingdom of Saudi Arabia, including the Personal Data Protection Law (PDPL) and its Executive Regulations and "SDAIA" guidelines, the Child Protection System and related sectoral, educational, and cybersecurity instructions; these Terms are interpreted to achieve consistency with those frameworks without derogating from any mandatory rights.

57.2. Primacy of National Law: Saudi law prevails over any foreign frameworks; international standards (such as GDPR principles and ISO/IEC 27001) are used as professional references without prior acknowledgment of the legal applicability of those frameworks except where expressly stated.

57.3. Role Identification: The status of "Qader" and the school (Controller/Processor/Joint Controller) is determined according to the feature and data processed, as per the Data Processing Agreement (DPA) and related privacy appendices, with each party committing to its legal and security duties.

57.4. Core PDPL Principles: Processing on a declared legal basis, for a specific and legitimate purpose, with minimum necessary data, with reasonable accuracy, with appropriate security measures, and within specified retention periods, enabling data subject rights and verifiable transparency.

57.5. Minor Data: Minor data is treated as "sensitive" by default; no minor accounts are created except with documented Guardian consent through approved channels; any direct marketing practices to them without revocable consent are prohibited; automated decisions with material academic impact without a mandatory human review path within a reasonable period are prohibited.

57.6. Records and Documentation: "Qader" maintains Records of Processing Activities (ROPA), conducts Data Protection Impact Assessments (DPIA) especially for minor processing and AI-based features, and updates them periodically or upon material change.

57.7. Internal Governance: Written privacy and security policies, least-privilege access controls, periodic staff training, and penetration tests/independent reviews where appropriate, with a clear escalation and accountability plan.

57.8. Incident Notification: Notifying competent authorities and data subjects of breach incidents within a reasonable legal timeframe (e.g., within 72 hours of the documented internal confirmation time), providing incident details, remedial measures, and progress updates until closure.

57.9. Government and Judicial Requests: Data is disclosed only under written, specific, and legally valid requests, to the minimum extent necessary, with internal legal documentation, notification to the client/data subject where permitted, and objection when there is a legitimate basis.

57.10. Cross-Border Transfer and Data Sovereignty: The default is storing minor data within the Kingdom. Any external access or transfer is subject to the Cross-Border Data Transfer clause and its safeguards (explicit exception/contractual safeguards/explicit consent), with prior disclosure and a reasonable right to object for schools and clear processing options.

57.11. Sub-Processors: No sub-processor is engaged except with equivalent contractual safeguards, inclusion on the live disclosure page, prior notice to schools with a right to objective objection and proportionate solutions without a retroactive monetary refund.

57.12. Data Subject Rights: Announced and effective channels for access, rectification, deletion, objection, and portability requests, with reasonable response deadlines after identity verification, and technical limits on deletion within backups managed according to retention appendices.

57.13. Auditing and Compliance: Recent third-party compliance reports/certificates are provided instead of on-site visits as a principle; annual reviews are conducted or upon material change, and cooperation with competent authorities in any regulatory inspection.

57.14. No Derogation from Mandatory Rights: These Terms do not impose any restriction that diminishes mandatory rights conferred by Saudi law for consumers/minors or the reporting, prevention, and notification duties related to child protection.

57.15. Sanctions and Continuous Compliance: "Qader" reserves the right to amend its policies and procedures to reflect any regulatory changes, with reasonable notice, and immediate compliance with any corrective orders or compliance measures issued by competent authorities.

58.1. Condition of Legal Validity and Verification: We do not disclose any data except under a written, signed, and stamped request from a competent authority with legal jurisdiction within the Kingdom, stating the legal basis (court order/warrant/letter from a competent authority) and precisely defining the scope of the request. We verify the authority's validity and jurisdiction through official channels before processing, and document the request reference, date, and sender identity.

58.2. Spatial Jurisdiction and Foreign Requests: Requests from authorities outside the Kingdom are not executed except through Mutual Legal Assistance (MLA) channels or orders enforceable within the Kingdom according to the law. No cross-border transfer occurs except according to the applicable Data Transfer and Data Sovereignty clauses.

58.3. Principle of Minimum and Proportionality: The disclosure scope is limited to the minimum necessary to achieve the legal purpose, restricting the period, fields, and included individuals/accounts. We request narrowing or challenge general/excessive/vague requests, and reject unjustified bulk collection requests.

58.4. Notification and Transparency: We notify the data subject/school before disclosure where legally permitted and does not jeopardize the investigation or safety, and in the absence of secrecy orders. When the prohibition ceases, we send subsequent reasonable notice. We may publish aggregated transparency reports where appropriate and permitted.

58.5. Legal Hold: Upon receipt of a valid preservation order, we preserve a scoped set of relevant data for a reasonable period specified by law (e.g., 90 days, renewable with a written order), without unjustified expansion, and with an audit log.

58.6. Transmission Security and Chain of Custody: Data is delivered via secure, encrypted channels, with a Chain of Custody proof and recording of the recipient's identity, delivery time, and content of the delivered package.

58.7. Emergencies and Averting Serious Harm: In urgent cases of immediate and serious risk to a person's life or a minor's safety, disclosure may — according to the PDPL — be made to the minimum extent necessary based on a documented request stating the necessity and the requesting authority, with documentation of the basis and subsequent notification where permitted.

58.8. Role of School/Controller: When the school is a data controller under the DPA, we coordinate with it and determine responsibility for the response, providing the minimum necessary information for compliance, without prejudice to the safety of proceedings or secrecy orders.

58.9. Challenging Defective Requests: We challenge or request amendment/narrowing of requests that are legally invalid, outside jurisdiction, or disproportionate, and refrain from disclosing until corrected. Compliance does not constitute a waiver of any right or claim.

58.10. Cost Recovery: We reserve the right to charge the requesting authority reasonable costs for extraction and technical/legal processing where permitted by law.

58.11. Technical Capability Limits: We do not provide data or encryption keys/secrets, or access to logs/systems we do not control or own, nor do we develop custom tools for investigative purposes outside commercially available or legally agreed means.

58.12. Record Keeping and Auditing: We maintain an internal auditable log for each incoming request, including the legal basis, scope of shared data, processing dates, and identity of those involved in the response.

58.13. Official Communication Channels: Requests from competent authorities are directed to the dedicated email [email protected] or [email protected] according to the approved form, including case number, data scope, timeframe, legal basis, and contact details.

58.14. No Derogation from Child Protection Obligations: The foregoing does not prejudice the statutory reporting duties upon suspicion of child abuse or exposure to imminent danger according to relevant laws and instructions.

58.15. Precedence of Related Policies: Any disclosure is also subject to the Cross-Border Data Transfer, Data Sovereignty, Data Processing Agreement (DPA), and Security and Retention/Deletion Appendices, and is read with them as a single unit.

59.1. Definition and Scope: This clause includes all identifiers and similar technologies (cookies, LocalStorage, Web Beacons, Pixels, in-app SDKs, advertising device identifiers) whether first-party or from approved third parties.

59.2. Legal Basis and Category Division: Essential/security cookies are used on the basis of necessity to provide the Service and execute the contract or for compliance, while analytics/performance/personalization/marketing are not activated without explicit, revocable consent, to the extent permitted by law.

59.3. "Privacy by Default" Principle: We do not drop any files or activate any non-essential SDKs before obtaining explicit consent via the "Cookie Preference Dashboard." The default value for non-essential is "off." Consents are recorded with a timestamp and device/session ID.

59.4. Manageable Preference Dashboard: We provide a clear and updated Preference Dashboard that allows granular control by category and enables withdrawal or modification at any time without affecting essential cookies for service operation.

59.5. Respecting Browser Signals: "Do Not Track" signals and privacy interfaces on supported platforms are respected to the extent technically feasible; upon receipt, we treat them as a refusal of non-essential cookies where possible.

59.6. Minors and Sensitivity: We do not activate marketing/behavioral tracking for minors. For the non-school path, non-essential cookies for a minor account are not activated except with revocable Guardian consent.

59.7. Minimization and Data Reduction: We limit identifiers to the minimum necessary for the announced purpose, with anonymization/masking techniques where possible (e.g., IP truncation, hashing identifiers) and with a "no mixing" standard between test and production environments.

59.8. Security of Identifiers: Sensitive cookies (authentication/sessions) are configured with Secure, HttpOnly, and SameSite attributes, periodic rotation, and limited validity periods. We do not store sensitive educational data in cookies.

59.9. Third Party and Transparency: We do not load non-essential third-party SDKs or Tags before consent. We maintain a live page detailing parties/categories, processing purposes, and links to their policies. Schools are notified in advance before adding a relevant third party for tracking according to Sub-processor controls.

59.10. Analytical Uses: We use aggregated/anonymized analytics where possible for performance and security improvement, without merging with identifying data outside the permitted framework or for marketing purposes without consent.

59.11. Withdrawal and Erasure: Withdrawal of consent results in stopping future loading and deleting/invalidating non-essential identifiers to the extent technically feasible, respecting system/browser settings and explaining manual deletion steps.

59.12. Devices and Applications: In mobile applications, we adhere to distribution platform restrictions (e.g., advertising tracking settings) and do not access advertising device identifiers for marketing purposes without explicit consent that can be disabled from system settings.

59.13. Geographic Limits and Data Transfer: No sending to parties outside the Kingdom for cookies/SDKs purposes occurs except according to the Data Transfer and Sovereignty clauses (Sub-processors/Data Flows page), with announced legal bases and prior notice when necessary.

59.14. Retention Period and Review: Retention periods for each category are specified in the "Cookie Policy" (Appendix 8) and reviewed periodically. Consent is re-requested upon a material change in purposes/parties/categories or after a reasonable period.

59.15. No Sale of Data: We do not sell User data. Any secondary use (e.g., direct marketing to adults) requires separate, revocable consent and does not affect essential service notices.

59.16. Compatibility and Documentation: We document consent/withdrawal logs and make them available for regulatory audit. This clause is read with the Privacy, Security, and Data Transfer appendices as an integrated unit.

60.1. Approach and References: We adopt a "Defense in Depth" approach, aligned — as much as possible — with the national frameworks of the National Cybersecurity Authority (NCA) and industry best practices (such as ISO/IEC 27001-like controls), with periodic risk assessment and a continuous improvement plan.

60.2. Data Minimization and Masking: We apply the principle of minimum necessary data, masking/hashing techniques on sensitive data (results, behavior, voices, images, videos, conversations), separating production/testing environments and preventing "mixing" between them.

60.3. Encryption: Data is encrypted in transit (TLS 1.2+ or equivalent) and at rest (AES-256 or equivalent) with centralized key management, periodic key rotation, and strict access policies to key management tools.

60.4. Access Control: Role-based access and minimum necessary privileges, time-limited for sensitive tasks, with multi-factor authentication for administrative and support accounts, and immediate deactivation of access upon change of status.

60.5. Logging and Monitoring: Centralized log collection with tamper-evident protection (WORM where possible), synchronized timing, real-time alerts via a monitoring/SIEM system, and retention periods according to Appendix 2.

60.6. Backup and Continuity: Encrypted backups according to schedules in Appendix 2, with periodic restoration tests, announced RPO/RTO objectives, and geographic/logical isolation of copies.

60.7. Vulnerability and Update Management: Periodic vulnerability scanning and CVE tracking, urgent handling based on severity (critical within a reasonable short period, high priority within a specified timeframe), and systematic, managed security patching.

60.8. Independent Penetration Testing: Annual penetration testing by an independent party within an agreed scope, with specific remediation plans and closure tracking; high-level compliance summaries are available to qualified clients under confidentiality.

60.9. Responsible Disclosure Policy: Testing is permitted only within the published scope (domain/environment lists), through one announced channel (e.g., security@... or a security form). Prohibited: Denial of Service (DoS/DDoS), extracting/displaying real data, social engineering, or billing manipulation.

60.10. Safe Harbor: We will not take action against a security researcher who adheres to the scope and rules and reports confidentially, provided they immediately stop testing upon observing real data and cooperate in mitigation.

60.11. No Financial Entitlement: Reporting or discovering a vulnerability does not create any right to a reward, compensation, or public acknowledgment unless expressly stated on an announced program page; "media attacks" or public disclosure before remediation or written permission are prohibited.

60.12. Incident Management: Upon confirmation of a security incident, we activate the response plan and apply the notification clause within 72 hours according to the relevant policy, with a documented investigation, corrective/mitigation actions, and follow-up until closure.

60.13. Third-Party and Supply Chain Security: We impose contractual security obligations on sub-processors and monitor their compliance according to the Sub-processor and Sub-processors/Data Flows page controls, with prior notice of changes.

60.14. Authority of Records: Internal monitoring records, firewalls/rate limiters (WAF/Rate-Limiter) are considered a preponderant technical evidence for proving circumvention attempts or misuse, unless their manifest error is proven by independent technical evidence.

60.15. User Obligations: Users must not share login credentials, enable system and browser updates, immediately report any suspected breach, and are not permitted to disable or bypass security controls.

60.16. Precedence and Referencing: In security and retention matters, Appendix 2 and the Security Policy (if any) prevail over this clause in case of conflict, to the extent permitted by law.

61.1. General Principle: We adhere to "reasonable and risk-appropriate" security controls according to industry best practices and in light of the national frameworks of the National Cybersecurity Authority (NCA), without commitment to naming a specific standard unless it is actually applied and announced. Mention of a standard (e.g., ISO/IEC 27001 or ECC/CCC mappings) does not constitute an acknowledgment of certification or accreditation unless expressly stated.

61.2. Scope and Core Controls: Our commitment covers all service layers, with restricted access controls according to the "least privilege" principle, quarterly permission reviews, multi-factor authentication for admin accounts, encryption in transit and at rest, separation of production/test environments, monitored change management, application of a secure development methodology (dependency scanning/SAST/DAST), and vulnerability handling according to specified severity levels.

61.3. Roadmap and Reference Mapping: We maintain a security roadmap and an internal alignment matrix with ISO/IEC 27001-like controls and a map consistent with NCA frameworks (ECC/CCC) "as much as possible," with an annual independent third-party assessment once the technical and organizational scope for the assessment is complete.

61.4. Penetration Testing and Review Independence: We conduct annual penetration tests by an independent party within an agreed scope, with time-bound remediation plans and closure evidence. Qualified clients can receive a high-level compliance summary/AOC under reasonable confidentiality.

61.5. Notice of Material Changes: Upon any material change in the security control framework or the retirement of an officer with a material impact on security, we provide "reasonable" advance notice to affected clients, specifying alternatives/mitigations, and provide a recent third-party compliance report — upon request — under confidentiality.

61.6. No Absolute Guarantee: Security controls mitigate risks but do not eliminate them, and do not constitute an absolute guarantee or insurance against all incidents, to the extent permitted by law.

61.7. Limits of Obligations and Conflict: In security and retention matters, Appendix (2) and the Security Policy (if any) prevail over this clause in case of conflict. Any additional security obligations stipulated in the Data Processing Agreement (DPA) or signed purchase orders remain effective within their limits.

61.8. Flexibility of Update: We reserve the right to update security policies and controls to keep pace with threats and regulatory requirements, without a materially adverse effect on service security; if impossible, we apply alternative mitigation measures and notify affected clients within a reasonable timeframe.

62.1. Governing Framework: Retention periods and categories are applied as detailed in Appendix (2). Detailed security and retention matters are governed by that appendix and the Security Policy (if any). In case of conflict, Appendix (2) prevails.

62.2. Expiry of Purpose or Period: Personal data is deleted or masked upon expiry of the purpose or the approved period, unless the law requires longer retention or a Legal Hold is issued.

62.3. Subscription/Trial Expiry: Upon expiry of the subscription or trial, data is deleted or masked within the periods in Appendix (2), retaining only what is legally required for accounting and compliance logs. Schools are given a reasonable window to export data before closure according to the transfer mechanism below.

62.4. Portability: Portability/export of the "Smart Educational Profile" and other portable data is provided in standard formats (CSV/JSON/PDF) within reasonable technical limits, after identity and authority verification.

62.5. Backups: When a production record is deleted/masked, backups are masked/deleted within (30–90) days according to the backup cycle. Individual elements are not extracted from them except for disaster recovery/security purposes. Execution is logged in an audit log; schools can request an excerpt.

62.6. Definition of "Deletion" and "Masking": "Deletion" means removing data so that it cannot be reasonably retrieved. "Masking" means removing or altering identifiers so that the data is no longer attributable to a specific individual except with additional separate and protected information.

62.7. Deletion Limits within Models (memorization): Statistical models may retain indirect learning traces. We will exclude deleted/withdrawn data from any future training cycles and apply "unlearning" or retraining techniques "to the extent technically reasonable." We do not guarantee surgical removal from previously trained snapshots; where removal is impossible, we refrain from using copies affected by the data in student-impacting decisions and replace them in a subsequent training cycle within a reasonable period.

62.8. No-Mix Option (Training Isolation): For student data — especially minors — the default is not to mix identifying data in general model training without explicit consent. Isolation is available so that any improvement/tuning is limited to the tenant's scope or only aggregated/anonymized data. Isolation may affect the quality of some features, and this is stated within the product.

62.9. Differential Privacy Option: When activated from the school administration dashboard, training contributions are processed with a noise addition that limits the ability to infer identity. This mitigates risks without eliminating them and may affect accuracy. Settings and limits are documented in the AI policy.

62.10. Model Input Scope: Sensitive media (minor voices/images/videos/conversations) are not used to train general models except with explicit consent and within a declared scope, with the ability to deactivate (Opt-Out) for schools.

62.11. Effect of Consent Withdrawal: Upon consent withdrawal or deletion request, we stop any future use of the data in training and apply exclusion and unlearning measures "to the extent technically reasonable," without complete retroactive effect on previously deployed models unless expressly stated otherwise.

62.12. Execution Logs and Evidence: We maintain an immutable log of deletion/masking/exclusion orders. An executive summary is available to schools under confidentiality to demonstrate compliance.

62.13. Sub-processor Obligations: We require sub-processors to respect equivalent retention and deletion schedules and to implement masking/deletion in backups within (30–90) days "within commercially reasonable efforts," with proof of execution upon request.

62.14. Regulatory Exceptions: Deletion does not apply to data required to be retained by law (e.g., accounting or security logs) except upon the expiry of their legal periods, and is masked where possible during those periods.

63.1. Scope of Rights and Beneficiaries: Data subjects — including students, Guardians acting on behalf of minors, and representatives of educational institutions — enjoy the rights of access, rectification, deletion, objection, restriction of processing, portability, consent withdrawal, and complaint, according to the Personal Data Protection Law (PDPL) and related laws, and to the extent permitted by law.

63.2. Request Submission Channels: Requests are submitted via the Privacy Center within the account, the dedicated email ([email protected]), or the approved school channel. Requests through non-documented channels or those not allowing sufficient identity verification are rejected.

63.3. Response Deadlines for Data Subject Rights Requests: We respond to access/rectification/objection/portability/deletion requests within 30 calendar days from the date of receiving a request with complete identity and information, with the possibility of extension for an additional period of up to 30 days when necessary (complexity of request/volume of requests), provided we notify you of the extension and its reasons. We may request appropriate proof of identity (and for minors: proof of Guardian/educational institution status). We reserve the right to refuse requests that are manifestly unfounded, excessive, or affect the rights of others, or to charge a reasonable fee to cover administrative costs in cases permitted by law.

63.4. Identity and Eligibility Verification: We verify before processing via OTP to the registered number, a valid ID document, or a trusted school channel. For minor requests, proof of guardianship (Guardian/educational institution) or linkage to school identity is required as above.

63.5. Scope of Response and What is Not Covered by the Right: Access includes the User's personal data and relevant activity logs. It does not include disclosure of trade secrets, security logs whose disclosure could pose risks, data concerning others, or materials subject to legal privilege. We provide summaries when direct disclosure is not possible without affecting the rights of others or security.

63.6. Response Deadline and Extension: Requests are processed within a reasonable period not exceeding (30) days from identity verification, with the possibility of one extension of a similar period for complex requests, with notice stating the reasons for extension before the expiry of the first period.

63.7. Delivery Formats and Protection: When made available/transferred, data is delivered in standard formats (CSV/JSON/PDF) via a secure channel after verification. We may request additional information to define the scope and prevent over-disclosure.

63.8. Deletion Limits and Backups: Upon acceptance of a deletion request, data is deleted or masked on production systems, and deletion/masking is completed in backups within (30–90) days according to the backup cycle in Appendix (2). Individual elements cannot be extracted from backups except for disaster recovery purposes.

63.9. Legal Restrictions and Legitimate Interests: We may retain data necessary for legal compliance (accounting/tax/security), or to defend legal claims, or to protect the rights and safety of minors. Upon partial refusal, we state the legal basis.

63.10. Excessive or Vexatious Requests and Fees: The response is provided free of charge. We reserve the right to refuse requests that are manifestly excessive, vexatious, or unreasonable, or to charge a reasonable fee to cover costs, according to the PDPL.

63.11. Roles of Schools and the Establishment: For features where the school acts as a data controller and we as a processor, the school handles the substantive response and provides the legal basis, and we provide technical assistance within the DPA. For community/individual features where we act as an independent or joint controller, we handle the response directly.

63.12. Minor Rights and Guardian: The Guardian has the right to exercise rights on behalf of the minor upon proof of guardianship. In case of conflict between the minor's request and the Guardian's, school policies/laws prevail, prioritizing the minor's interest and safety.

63.13. Portability of the "Smart Educational Profile": The User/School may request a portable copy of the "Smart Educational Profile" within reasonable technical limits, including grades/progress indicators/learning preferences, but not including our algorithms or trade secrets.

63.14. Objection to Marketing and Automated Decisions: Consent to marketing communications can be withdrawn at any time without affecting essential service notices. There is a right to object to processing for direct marketing purposes. For decisions with academic impact on minors, a binding objection and human review path is available within (7–10) Business Days as previously stated.

63.15. Documentation and Escalation: We issue an automatic receipt of acknowledgment and maintain an audit log for each request and its actions. In case of dissatisfaction, escalation to the Data Protection Officer (DPO) and then — where applicable — to the competent authority is available. Please also refer to Clause (73) regarding export before termination.

64.1. Scope of Covered Requests: This mechanism applies to requests for access, rectification, deletion, objection, restriction of processing, portability, and consent withdrawal, according to the Personal Data Protection Law (PDPL) and to the extent permitted by law.

64.2. Submission Channels and Receipt Confirmation: Requests are received via the Privacy Center within the account, the dedicated email ([email protected]), or the approved school channel. A receipt acknowledgment with a reference number is sent within a reasonable time, with a request for any necessary information to identify the student/data subject and the scope of the request.

64.3. Identity Verification Before Processing: The request is not processed until appropriate identity verification is completed via one of the following: (a) One-time password (OTP) to a contact method registered with us, (b) A valid ID document or its legal equivalent, (c) Verification through the trusted school channel and school identity linkage, (d) In the case of an agent/lawyer: submitting a valid authorization/agency. For minor requests, proof of guardianship or school confirmation is required.

64.4. Start of the Legal Deadline Calculation: The response period begins from the date of completing identity verification. The response is completed within a reasonable period not exceeding (30) days, with the possibility of one extension of a similar period for complex requests, notifying the requester of the reasons for extension before the expiry of the first period.

64.5. Response Format and Secure Data Delivery: Upon responding, data or outputs are provided in secure standard formats (CSV/JSON/PDF) via a protected delivery channel and after additional verification when necessary. Parts may be withheld/masked to protect the rights of others or system security.

64.6. Limits of Response and Protection of Rights of Others: The right does not include disclosure of trade secrets, algorithms, or security logs whose disclosure could pose risks, nor data concerning others without a legal basis. When full disclosure is not possible, we provide a suitable summary or a statement explaining the reason for the restriction.

64.7. Reasons for Refusal or Restriction: The request may be refused or restricted when identity proof is insufficient, if it is vexatious/excessively frequent/unreasonable, conflicts with a legal/judicial obligation, or materially affects the rights and safety of minors or others. In all cases, the reasons and options for objection are explained.

64.8. Fees: The response is provided free of charge. A reasonable fee covering costs may be imposed for requests that are manifestly excessive or vexatious, after prior notice of the amount and basis.

64.9. Roles of Schools and the Establishment: When the school acts as a data controller and we as a processor, the school handles the legal basis and substantive assessment of the right, and we provide technical and timely support according to the DPA. For features/accounts where we are an independent or joint controller, we handle the response directly.

64.10. Documentation and Audit Log: Verification logs, decisions, correspondence, and deadlines are kept in an immutable audit log. An excerpt is available to the educational institution/competent authority upon request and to the extent necessary.

64.11. Escalation and Competent Authority: In case of dissatisfaction, the requester has the right to escalate to the Data Protection Officer (DPO) and then — where applicable — to the competent authority according to the PDPL.

65.1. Definition and Scope of Application: "Personal Data Breach" means any unauthorized access, loss, unlawful disclosure, modification, or unauthorized availability of personal data — especially minor and sensitive data — and includes incidents occurring at our sub-processors within the scope of our Service.

65.2. Starting Point of the Deadline (Verification Timestamp): The (72) hour period begins from the documented internal confirmation time of the incident by the incident response team — not from the first suspicion — with a record including the timeline, initial impact, and containment actions.

65.3. Notification Deadline and Limits: An initial notification is sent to the competent authority and data subjects (where required or appropriate) within (72) hours of the confirmation time, with phased updates "within a reasonable period" until closure.

65.4. Notification Channels: The dedicated security email ([email protected]), notification within the dashboard, and SMS/emergency channel for the designated School Principal; [email protected] is used for inquiries and regulatory responses.

65.5. Content of Initial Notification: Brief description of the nature of the incident, affected data categories, approximate scope of impact, immediate measures taken (containment/isolation/key rotation/mandatory password reset/MFA enablement), recommendations for the parties, contact details (DPO), and the incident reference number.

65.6. Phased Updates and Final Report: Updates are sent when significant new facts are available or the impact assessment changes; a final report is provided within (10–15) Business Days of closure, summarizing the root cause, corrective measures, and lessons learned.

65.7. Severity Classification and Criteria for Notifying Individuals: Individuals are notified directly if there is a "high risk" to their rights and freedoms (e.g., sensitive data, minors, or clear potential for misuse). Public notice or delaying/restricting details of the notice may be used if a law enforcement authority requests it to preserve the integrity of the investigation.

65.8. Roles of Schools and the Establishment (Controller/Processor): When acting as a "processor" for the school, we notify the school immediately and enable it to fulfill official notification obligations as a "controller." We do not communicate with data subjects on its behalf without written authorization. When acting as a sole/joint "controller," we handle notifications directly according to the PDPL.

65.9. Documentation and Audit Log: All incident decisions, classifications, notifications, and deadlines are kept in an immutable audit log with a timeline and Chain of Custody. An excerpt is available to the educational institution/competent authority upon request and under confidentiality.

65.10. Remedy Limits and Non-Acknowledgment: Notifications and updates are provided for compliance and do not constitute an acknowledgment of liability or a commitment to compensation. The remedy — regarding schools — is limited to timely notification, mitigation and correction, and Service Credits according to the SLA where applicable; no right to a monetary refund arises.

65.11. School/User Obligations: Notify us immediately of any potential incident within their integrated systems, enable us with the information necessary for investigation, implement recommended mitigation measures, and refrain from publishing technical details about the incident without prior written coordination.

65.12. Coordination with Competent Authorities: We comply with the requirements of the competent authority in the Kingdom including any formal notifications/forms/deadlines; any restrictions on disclosure are respected, with subsequent notification when the reason for the restriction ceases.

65.13. Language Consistency and Communication Channels: Notifications are issued in Arabic; an English version may be provided for convenience without affecting the Arabic version's authority. Clients must update the security contact person's data to ensure notice delivery.

66.1. Approved Reporting Channels: A "Report" button within each content/message/file, a dedicated web form in the school dashboard, [email protected] for general cases, and an emergency channel for the School Principal for urgent risks (impersonation/threats/minor exploitation).

66.2. Scope of Covered Conduct: Includes — by way of example and not limitation — abuse, bullying, harassment, hate speech, discrimination, threats of violence, sharing personal data without permission, blackmail, incitement to self-harm, academic cheating and sharing exam solutions, illegal content or content violating local values, and minor exploitation or any suspected material related to child sexual exploitation (zero tolerance and immediate reporting to competent authorities).

66.3. Receipt and Initial Classification: Each report is given a reference number and evaluated within a reasonable period (initial response within two Business Days, and within 12 hours for high-risk cases), without constituting an SLA commitment. The reporter is given an acknowledgment of receipt.

66.4. Temporary Preventative Measures: The reported content may be immediately hidden, interaction/private messaging between parties disabled, the suspected account restricted, and features that could be exploited (e.g., groups/chat/media upload) temporarily disabled, pending verification.

66.5. Balanced Investigation and Reasonable Belief: The review is conducted according to Community Policies and applicable law, considering context (sarcasm/quotation/awareness) and patterns of "repeat offenders," based on a standard of "reasonable belief" using available evidence.

66.6. Evidence Preservation and Privacy: Secure copies of the reported content and its metadata (to the minimum necessary extent) are kept throughout the investigation and legal obligations, with access restricted according to the least privilege principle.

66.6.1. Evidence Availability Policy for Authorities: An "Evidence Pack" index (internal links to policies/records/tests/matrices) facilitates government review.

66.7. Removal Decisions and Sanctions: Removing violating content without compensation, formal warning, feature restriction, temporary suspension, termination, blocking devices/addresses, canceling points/benefits gained through manipulation, and notifying the Guardian/School when a minor is involved; direct termination may be applied for serious violations (minor exploitation/incitement to violence/hacking).

66.8. No Retaliation and Protection of Whistleblower: Any retaliation against the reporter or witnesses is prohibited and constitutes a separate violation subject to penalty.

66.9. Abusive or Vexatious Reports: Intentional vexatious reporters are penalized according to the Community Policy (restriction/suspension/termination), with the Establishment reserving the right to claim actual damages for misuse of channels.

66.10. Roles of Schools and Their Delegation: In school-managed environments, School Principals and designated supervisors may take immediate actions within their classes/groups; the Establishment commits to providing adequate supervision tools and activity reports.

66.11. Minor Protection Protocol: When there are indicators of serious risk to a minor (exploitation/threat/imminent harm), the Company may take urgent actions including notifying the educational institution and/or Guardian and competent authorities according to the law, restricting notification if a law enforcement authority requests it to protect the investigation.

66.12. Scope of Supervision of Private Messages: Private communications are not proactively monitored; access is limited to what has been reported or detected by automated security systems for critical risks (e.g., indicators of minor exploitation), and to the minimum extent necessary for processing.

66.13. Notice and Right to Object: The violating User is sent a brief summary of the reason for the action within the limits of whistleblower protection and party privacy; an objection may be submitted via [email protected] within 3 Business Days of the notice, and a decision is made within a reasonable period.

66.14. Authority of Records: Automated system records (WAF/Firewall/Rate-Limiter/Logs) and moderation databases are considered strong, technically rebuttable evidence and are used to prove patterns and facts.

66.15. Aggregated Transparency: The Establishment publishes an annual aggregated statistical summary (without identity) of reports and actions, when appropriate, to support trust and compliance.

66.16. Limits of Commitment and Non-Acknowledgment: Removal/restriction decisions are taken to protect the community and ensure compliance and do not constitute an acknowledgment of liability or grounds for compensation, without prejudice to any mandatory rights conferred by law.

66.17. Notification Channel and Notice Period: Upon internal confirmation of a significant security incident, the Establishment sends an initial notice within 72 hours via: (a) dedicated security email [email protected], (b) the dashboard for the educational institution, and (c) SMS to the School Principal when available. This is followed by phased updates until closure including the nature of the incident, impact, and corrective actions.

66.18. Request Channels and Export Formats and Deadlines: Access/portability/deletion requests are submitted via the Privacy Portal or email [email protected] after identity verification (OTP/school channel/valid document). Requests are fulfilled within a reasonable period not exceeding 30 days, extendable once for a similar period for complex requests with notification of the reason for extension. "Smart Educational Profile" data is provided in CSV/JSON and/or PDF formats according to technical capabilities.

67.1. Definition and Scope: "Incident" means any event affecting the confidentiality, integrity, or availability of data/service, or involving potential misconduct towards minors/their safety, or a security breach, or a widespread operational failure.

67.2. Reference for Starting Deadlines (Verification Timestamp): All periods are counted from the documented internal confirmation time of the incident after a reasonable initial triage, not from the time of the unconfirmed initial report.

67.3. Severity Levels (Standard Classification):

67.4. Critical: Confirmed breach of sensitive personal data or minor data, or potential exploitation/indicators of minor abuse, or service outage likely to exceed (72) hours, or an active ongoing breach.

67.5. High: Unauthorized access/disclosure of non-sensitive personal data for a significant number, or service outage/degradation between (8–72) hours, or a high-severity vulnerability without evidence of widespread exploitation.

67.6. Medium: Geographically/functionally limited impact, or a small number of records, with rapid containment and no indicators of high harm to individuals.

67.7. Low: Minor operational incident, false alarm, or risk closed before any significant impact.

67.8. Notification Frameworks and Deadlines:

67.9. General Rule: Initial notification within a period not exceeding (72) hours from the Verification Timestamp to the competent authority and relevant parties "where required by law," with phased updates until closure (consistent with the Incident Notification Clause).

67.10. High-Sensitivity/Minor Cases: When there is a high risk to minors or to rights and freedoms, the deadline is reduced "where required by law" and a preliminary notice may be sent within (24) hours followed by later details.

67.11. Notification Sequence and Priority Order:

67.12. Regulatory Competent Authorities (Data Protection/Cybersecurity) "when legally required."

67.13. The Educational Institution (as data controller where DPA applies) or the affected contracting partner.

67.14. Data subjects/Guardians when there is a high risk to them, considering any postponement request from law enforcement to preserve the investigation.

67.15. Minimum Notice Content: Nature of the incident, affected data categories and approximate volume, timeline, potential consequences, mitigation and remediation measures, recommended steps for affected parties, contact points (e.g., [email protected]), and the reference timestamp (Verification Timestamp).

67.16. Responsibility Roles (Controller/Processor):

67.17. When the Establishment acts as a "processor" for a school: The Establishment notifies the "controller" without undue delay and cooperates in providing necessary information for data subject/regulatory notification decisions.

67.18. When the Establishment acts as a "controller" (individual usage scenarios): The Establishment handles direct legal notifications according to this clause.

67.19. Handling of Sub-processors: Sub-processors must notify us immediately of affecting events and enable us to meet notification deadlines; the Establishment remains responsible for managing escalation and notifying clients/competent authorities according to the agreed precedence.

67.20. Notification Channels: The dedicated security email, the school dashboard (alert to School Principal), and SMS for urgent cases; notice is considered received upon sending/publishing according to the Notice Policy.

67.21. Evidence Preservation and Confidentiality: A secure copy of relevant materials (Logs/telemetry/excerpts) is kept to the minimum extent necessary for compliance and investigation, with access restricted according to the least privilege principle.

67.22. Investigation and Containment: Activating the incident response team, isolating the impact, revoking affected keys/tokens, rotating credentials, temporarily disabling high-risk features, and following up on corrections until closure.

67.23. Post-Incident Report (RCA): A root cause analysis and prevention measures report is completed within a reasonable period (typically within 10–15 Business Days for medium/high incidents) and made available to schools/competent authorities under confidentiality upon request.

67.24. Minimum Principle and Targeted Disclosure: The notice is limited to what is necessary for compliance and impact mitigation, without revealing details that could exacerbate security risks or hinder investigations.

67.25. Requests to Defer Public Notice: If a competent authority requests deferring notification to data subjects to protect an ongoing investigation, we comply according to the law and document the request and deferral period.

67.26. Non-Acknowledgment and Remedies: The notice, content removal, or any containment action does not constitute an acknowledgment of liability or grounds for compensation. Any remedies — where applicable — remain within the contract limits and the SLA (Service Credits only).

67.27. Aggregated Transparency: We may publish annual aggregated indicators (without identity) regarding incidents, types, and processing actions, supporting compliance and trust.

67.28. Consistency with Other Policies: This clause operates with the security clauses, (72) hour notification, and DPA/SLA appendices, and applicable NCA/PDPL frameworks "as applicable."

68.1. Primary Responsibility: The school and/or Guardian bear primary responsibility for supervising the minor. The Platform provides only supportive tools, without creating guardianship or actual oversight obligations beyond what the tools enable.

68.2. Reliance on School Identity: Linking to school identity is considered a trusted consent from the Guardian according to the educational institution's policies, with the Establishment retaining an audit log of consents and withdrawals (timestamp/IP address/device ID).

68.3. Verification and Linking of the Guardian: In non-school registration, a "Guardian" account is activated after appropriate verification (OTP to a number registered in the Guardian's name, or a valid guardianship document) and linked to the minor to enable oversight.

68.4. Scope of Guardian Permissions: Enabling viewing of progress indicators, high-level usage logs, privacy settings, activating/deactivating sensitive features (e.g., AI chats outside the curriculum, camera/microphone), and setting time limits and quiet hours for use.

68.5. Default Safety Controls: Age-appropriate content filters and "Minor Safety" mode are enabled by default. They can be tightened or relaxed from the Guardian/School dashboard within published limits.

68.6. Behavioral or Risk Notifications: Guardian/School notification is activated upon high-risk indicators (inappropriate access attempts, activity outside designated study hours, abuse report), according to approved disclosure policies and minimizing false positives.

68.7. Precedence of Policies and Conflicting Settings: In case of conflict between school and Guardian settings, school policies prevail within the official educational scope, and Guardian settings prevail in home/non-school use, with separate setting profiles for each context.

68.8. Limits of Access to Protect Third-Party Privacy: Guardian access does not extend to content of other parties (classmates/teachers) or identifying data not concerning their child, and the data minimization principle is applied.

68.9. Requests for Restriction or Suspension: The Guardian can suspend specific features or temporarily suspend the minor's account outside the school framework; within school accounts, the educational institution's policies apply, coordinated with it.

68.10. Reporting and Escalation Path: A dedicated channel is available for the Guardian to report abuse/bullying/inappropriate content, with clear timeline procedures for processing and escalation to the school/competent authorities "when legally required."

68.11. Withdrawal of Consent and Its Effect: The Guardian may withdraw or restrict their consent at any time from account settings; the effect is limited to the associated minor's access. Withdrawal does not entail a refund or reduction in the school's subscription fees; the school may replace the seat with another User within the same license.

68.12. No Guarantee of Comprehensive Oversight: Oversight tools are provided "AS IS" and within technical capability limits. The Establishment's responsibility does not extend to monitoring communications outside the Platform or devices/channels it does not control.

68.13. Best Interest of the Minor: Any processing or restriction is managed with the minor's best interest and safety as the primary concern, in accordance with relevant child protection and data protection laws, with human review enabled upon objection.

68.14. Record Keeping: Supervision events and material changes in settings are kept in timestamped audit logs for compliance and investigation upon legitimate request.

69.1. Authenticity of Content: Question banks and exercises are built on general, pedagogically announced skills and concepts, without directly or indirectly copying questions or protected exam banks of any entity, including "Qiyas."

69.2. Respecting Rights and Regulations: We reject and prevent the circulation of any protected, unpublished, or leaked test materials belonging to "Qiyas" or others. There is no implied accreditation/partnership with "Qiyas," and any use of its name or trademark is for descriptive reference only without implying endorsement.

69.3. Categorical Prohibition of Leaks: "We do not seek or accept leaks." Requesting, publishing, exchanging, or enabling access to materials likely to be leaked or protected by rights is prohibited. The Company may immediately remove any suspected material and suspend the account pending verification.

69.4. Permitted Forecasting Methodology: Any "prediction" of topics or skills uses general scientific methods (analysis of curricula/skills/historical announced weights) and does not rely on internal sources or confidential information. Accuracy is not guaranteed, nor is it understood as prior knowledge of actual questions.

69.5. Permitted Training Sources: Limited to (a) original content produced by the Establishment, (b) expressly licensed sources, (c) public data according to its licenses, (d) internally generated data. Inputting or training systems on protected or leaked test materials is prohibited.

69.6. User Acknowledgment: Content uploaders confirm their materials are original, legitimate, and non-leaked, and they have the right to license them for use within the Platform. They bear full responsibility for any infringement of third-party rights, indemnifying the Establishment for actual damages and reasonable legal fees.

69.7. Reporting and Removal Mechanism: A dedicated channel is available for reporting violating/leaked content. We issue an initial acknowledgment within a reasonable period, take immediate temporary action (hide/suspend) upon reasonable suspicion, then complete the review and notify parties of the result within a reasonable timeframe.

69.8. "Repeat Offender" Policy: Upon repeated violations or proven serious leaks/cheating, the Company may impose escalating restrictions up to permanent termination and blocking associated devices/addresses, without compensation.

69.9. Detection and Verification Tools: Similarity checks, algorithms for detecting leaked content features, and human reviews may be used, minimizing false positives and keeping audit logs.

69.10. Cooperation with Competent Authorities: We commit to responding to written, legally based requests from competent authorities within the limits of "minimum necessity," and notifying concerned parties where legally permitted.

69.11. Policy Integration: These controls are read with the Cheating Prohibition and Academic Commitment, Community Policy, and Intellectual Property Enforcement clauses, without prejudice to the procedures and sanctions stated there.

70.1. Definition and Distinction: "Prediction" means analyzing curricula, skill frameworks, and public weights/indicators to build an intelligent simulation of expected topics; it is completely different from "leaking," which means possessing or circulating actual or unpublished test materials.

70.2. Only Legitimate Sources: Predictions are derived from (a) original content produced by the Establishment, (b) expressly licensed sources, (c) publicly available data according to its licenses, (d) internally generated data. Inputting or using any protected, unpublished, or suspected leaked test material is prohibited.

70.3. Transparent Methodology: Models rely on analyzing skills/learning outcomes/announced weights, common error patterns, Bloom's levels and the like; internal auditable documentation shows general inputs and statistical logic in a way that does not reveal trade secrets or personal data.

70.4. No Claim of Certainty: Predictions are training and advisory tools and may be inaccurate; they do not represent prior knowledge of actual questions, nor are they understood as a guarantee of outcome or the appearance of a specific topic. To the extent permitted by law, they do not create a basis for refund or compensation.

70.5. Clear Tagging: Predicted materials are tagged explicitly (e.g., "Prediction/Simulation") and the confidence range or accuracy limits are stated in a manner understandable to the User.

70.6. Marketing Prohibitions: Any misleading claims such as "we guarantee the questions" or certain percentages are prohibited unless supported by an announced and verifiable methodology. The Company may remove any such claim and take enforcement actions.

70.7. Respecting Test Institution Rights: There is no implied accreditation or partnership with any entity (e.g., "Qiyas"), and any mention of their names is legitimate descriptive use without implying endorsement or access to their question banks.

70.8. Reporting and Removal Mechanism: Upon suspicion that a predictive material is based on a leak, the Company may immediately hide it and initiate a rapid investigation, then re-publish/permanently remove based on the outcome, with open reporting channels and appropriate enforcement effect.

70.9. Ethical Review and Fairness: Samples of predictive materials are reviewed periodically to mitigate biases, and human review is available upon reasoned objection from a school/Guardian within a reasonable timeframe.

70.10. Policy Integration: These controls are read with the Anti-Leak, Cheating Prohibition, Community Policy, and Result Disclaimer clauses, without prejudice to any stricter measures upon violation.

71.1. Compliance by Design and Default: Features and processes are built according to Privacy/Safety by Design & by Default principles, with a conservative default setting for minors and enhanced privacy settings.

71.2. Internal AI Governance: An AI Governance Committee is established, including technical leadership, legal, DPO, and security, responsible for policies, reviews, and internal approvals before launch.

71.3. Regulatory Monitoring and Gap Assessment: Quarterly "Horizon Scanning" is conducted for relevant Saudi legislation (PDPL, national security controls, educational body instructions), with a gap log and closure plan with specific timelines.

71.4. Standards Roadmap: We commit to reasonable controls aligned with NCA (ECC/CCC) and ISO 27001 frameworks, adopting an AI risk management framework (e.g., ISO/IEC 23894) and an AI system management framework (e.g., ISO/IEC 42001) where applicable and according to an announced roadmap.

71.5. Systematic Impact Assessments: No impactful AI feature is launched before completing a Data Protection Impact Assessment (DPIA) and Algorithmic/Ethical Impact Assessment (AIA), documenting them, and updating them periodically or upon material change.

71.6. Risk Classification and Safe Stop: Features are classified (low/medium/high/critical) with mandatory mitigation controls and a "Kill-Switch" for immediate rollback upon compliance/safety risks.

71.7. Human Involvement for Influential Decisions: Substantive academic decisions remain not exclusively automated, and a binding human review path is available within reasonable periods as stated in the objection and review clauses.

71.8. Transparency and "Right to Explanation" within Safe Limits: Understandable explanations of recommendation logic are provided within technical limits, trade secret protection, and third-party rights.

71.9. Safety and Appropriate Content: Content filters and age restrictions are applied, compatible with local values and laws, with special adjustment for sensitive off-curriculum content.

71.10. Data Flows and Sovereignty: Data flow maps are updated periodically, with geographic isolation controls and restrictions on cross-border sending activated according to sovereignty, transfer, and sub-processor notification clauses.

71.11. Due Diligence on Processors: No external processor/model is used without a compliance/security check, appropriate contractual annexes, clear sending limits, prior notice, and a reasonable right to object for schools.

71.12. Regulatory Engagement: We cooperate in good faith with competent authorities and regulatory/Sandbox programs upon request, providing third-party compliance reports instead of on-site visits unless with prior agreement and proportionate costs.

71.13. Change Management and Notification: Upon material changes affecting privacy/security/AI policies, we notify Users/Schools with appropriate notice (e.g., 15 days) and re-request express consent when necessary.

71.14. Measuring Fairness and Educational Impact: Bias indicators, recommendation accuracy, and impact on sensitive groups are monitored with continuous improvement plans, without claiming guaranteed results.

71.15. Review Cycles and Objection to Recommendations.

71.16. Records and Auditing: Governance decisions, tests, and technical tuning logs are retained. A compliance summary is available under confidentiality for schools/competent authorities upon regulatory request.

71.17. Training and Awareness: An annual mandatory program for relevant staff and vendors on PDPL, information security, AI ethics, and minor protection.

71.18. Limits of Regulatory Commitments: Nothing herein is interpreted as official accreditation unless announced; regulatory authorities have the final say. These commitments apply "to the extent permitted by law" and considering conflicts of law outside the Kingdom.

72.1. Client Categories: Transactions with schools/educational institutions are conducted in their professional/commercial capacity (B2B) and do not acquire consumer status; accordingly, withdrawal periods established for consumer protection do not apply. Individual Users (B2C) are subject — to the extent permitted by law — to mandatory rights conferred by law for consumers, including the right to cancel the purchase within seven (7) days from the purchase date, provided the service has not been activated, according to Article (13) of the Electronic Commerce System. In all cases, the digital service is considered consumed and non-refundable upon activation/first successful login, unless the law dictates otherwise.

73.1. Definition and Duration: A trial account is granted to an eligible educational institution for evaluation purposes only, for a period specified in the offer/invitation or dashboard. It may be terminated at any time for operational or security reasons with reasonable notice.

73.2. No Automatic Conversion: The trial does not automatically convert to a paid subscription without documented consent (express Clickwrap acceptance, approved purchase order/invoice, or written agreement). Acceptance is re-requested upon any material amendment.

73.3. Final Acceptance after Activation: Upon completing documented approval and then the first activation/successful login after the trial, this constitutes final acceptance of the paid service and a waiver — to the extent permitted by law — of any right to a monetary refund for post-activation fees.

73.4. Service Limits During Trial: Features are provided "AS IS and AS AVAILABLE" for testing purposes only, may be limited, unstable, or subject to change/cessation without compensation. No expectations are created for the continuity of trial (Beta) features within the paid subscription.

73.5. Support and SLA During Trial: Support is provided on a "Best Effort" basis without a commitment to specific response time or availability, and Service Credits (SLA) do not apply to trial accounts.

73.6. Data Policy During Trial: Student/User data is processed to the minimum extent necessary for the trial, according to the PDPL and related processing appendices. No facial matching/voiceprint or biometric feature extraction is performed during the trial.

73.7. Data Policy After Trial Expiry: Upon expiry without paid conversion, data is deleted or masked within the periods of Appendix (2), unless the law requires longer retention. The school — where technically reasonable — is given the ability to export the "Smart Educational Profile" in CSV/JSON format within an announced time window.

73.8. No Carryover of Trial Usage: Usage during the trial does not translate into financial credit or later discount, nor does it create a right to a refund.

73.9. Non-Consumer Status: The educational institution acknowledges it is contracting in its professional/commercial capacity for a non-consumer purpose. Any intentional misrepresentation of "consumer" status entails compensation for actual damages and collection costs, to the extent permitted by law.

73.10. Eligibility and Abuse Prevention: One trial per educational institution/legal entity unless otherwise agreed. Creating multiple/fraudulent accounts for the trial or reusing after expiry is prohibited. The Company may stop violating accounts and claim actual damages and reasonable enforcement costs.

73.11. Technical and Security Restrictions: Request/rate caps and deactivation or restriction of third-party integrations may be applied during the trial. Any circumvention of restrictions or unauthorized scraping/automation justifies immediate suspension or termination and seeking urgent injunctive relief when necessary.

73.12. Billing After Conversion: Fees start from the date of first paid activation/login or the effective date specified in the purchase order — whichever is earlier — and are final and non-refundable after activation, to the extent permitted by law. Set-off/suspension is not permitted except by a final court judgment or written consent.

73.13. No Liability for Results: Outputs/recommendations during the trial are advisory and not a commitment to achieving specific academic results, nor are they valid grounds for refund or compensation requests.

74.1. Definition and Scope: An annual subscription covers the agreed package/seat count in the Purchase Order or dashboard and includes fixes and security/functional improvements within the same package throughout the subscription period.

74.2. Non-Consumer Status (B2B): The educational institution acknowledges it is a legal/professional entity and does not acquire "consumer" status as previously stated. In the "Client Categories" clause.

74.3. Effective Start: The twelve-month period begins from the date of activation/first successful login/invoice date — whichever is earlier — unless expressly stated otherwise.

74.4. Inclusion of Updates Without Additional Fees: Free updates include bug fixes, security patches, and minor improvements/features within the contracted package. They do not include new modules/products/professional services or paid integrations unless agreed in writing. Beta features remain outside the scope of commitment and may be withdrawn or modified without compensation.

74.5. Billing and Seat Commitment: Fees are calculated based on the commitment to the number of seats/package regardless of actual consumption level and are paid in advance for the contractual period unless a different schedule is agreed in writing.

74.6. No Refund for Non-Use: Non-use or low utilization does not create any right to a refund or reduction during the current period, to the extent permitted by law.

74.7. Seat Increase During the Period: Seats may be increased at any time; fees are calculated pro-rata for the remainder of the period and become final and non-refundable after activation.

74.8. Seat Reduction: Any reduction in seats applies only upon renewal, with no retroactive effect on the current period.

74.9. Seat Transfer Within the License: Users may be replaced within the same license without changing the total seat count, in accordance with technical controls and the Privacy Policy.

74.10. Price Stability During the Period: The price remains fixed during the subscription period; any price adjustment applies only to the subsequent renewal with reasonable prior notice, without retroactive effect on the current period.

74.11. No Termination for Convenience: There is no right to terminate for convenience during the current period; cancellation, renewal, and service suspension provisions are in the relevant clauses (see Clause 57 onwards).

74.12. Relationship with SLA: Free updates do not create any additional obligations beyond the SLA. Any failure related to Service Levels has Service Credits according to the SLA as the exclusive remedy, without monetary refund, to the extent permitted by law.

74.13. No Set-off: Set-off/holding payments is not permitted except by a final court judgment or express written consent from the Establishment.

74.14. Regulatory Reservation: This clause does not prejudice any mandatory rights conferred by law that cannot be contractually violated.

75.1. Precedence and Scope: This clause prevails over any conflicting text in a Purchase Order/vendor portal/correspondence, and is only exempted by a specific, express appendix signed by both parties.

75.2. When Fees Become Final: To the extent permitted by law, all fees paid for the subscription/seats/additional services are final and non-refundable after (a) activation, or (b) first successful login, or (c) trial expiry — whichever is earlier.

75.3. No Refund for Any Reason During the Current Period: No refund arises for early termination, non-use, change of need, modifications within the limits of the contracted package, or partial failures/slowdowns/announced maintenance that do not reach the failure levels specified in the SLA.

75.4. Exclusive Remedy for Service Level Failures: For any failure related to Service Levels — including Material Defect — the sole and exclusive remedy is Service Credits according to the SLA, which are non-convertible to monetary amounts or for extending the period. They are used during the current subscription period and subject to the caps and deadlines in the appendix.

75.5. Individuals vs. Schools: Individual Users receive support on a "Best Effort" basis without an SLA or financial remedy. Schools are treated according to the SLA only for Service Credits.

75.6. No Termination Right Created for Refund of Past Consideration: No dispute or failure — outside what the SLA allows — creates a right to terminate for the purpose of refunding amounts for periods already served.

75.7. No Set-off or Suspension: The Client/School is not permitted to set off, withhold, or suspend payments except by a final enforceable court judgment or express written consent from the Establishment.

75.8. Service Suspension for Reasons Attributable to the Client: No refund/compensation arises from suspension or interruption resulting from violation of technical requirements, misuse, or third-party failures outside the Establishment's control.

75.9. Beta Features and Promotional Offers: Beta features and offers/discounts do not create a right to refund or compensation upon modification or withdrawal and are not considered part of the core subscription.

75.10. Legal Reservation: This clause does not prejudice any mandatory rights conferred by law that cannot be contractually violated. It is interpreted "to the extent permitted by law."

76.1. No Assignment by Client: The User/School may not assign this Agreement or any of its rights or obligations, nor transfer the account, license, or share it with others — wholly or partially, or by subleasing — without prior written consent from the Establishment. Any contrary action is void and null.

76.2. Prohibition of Account and Credential Sharing: Login credentials and subscriptions/seats are personal and non-transferable; sharing credentials or accounts, selling, or gifting access is a material breach justifying suspension/termination according to the relevant clause.

76.3. Permitted Assignment by the Company: The Company may assign, transfer, novate, or convey rights and obligations to a subsidiary/branch/universal or particular successor, or in the context of a merger/acquisition/internal restructuring or commercial financing, without client consent, upon reasonable notice via approved notification channels.

76.4. No Refund Rights Arising from Change: Assignment, change of control, or restructuring does not create any right to a monetary refund or compensation; the remedy remains limited to what the Terms provide (including Service Credits where applicable), to the extent permitted by law.

76.5. Right to Terminate for the Future Only: Where a legitimate reason exists under these Terms, the School's right — if expressly stated — is limited to future termination without any refund for previous periods.

76.6. First Login After Payment: If no successful login occurs within (7) days of payment, the Company — at its discretion — may grant a non-cash Service Credit for use during the same school year. The credit does not convert to monetary amounts nor extend the subscription period.

76.7. Liability Survival Until Novation Completed: Any assignment request does not relieve existing obligations and fees except by a written and signed novation from the Establishment confirming the transfer of obligations to the successor. Until completed, the original Client remains jointly liable for due fees.

76.8. No Set-off Due to Assignment: Assignment or change of control for the Client does not permit payment suspension, set-off, or withholding; the Establishment's entitlements remain due according to their deadlines.

76.9. Independence of Processor Arrangements: The Establishment's contracting with sub-processors or service providers is not an assignment of the contract with the Client and does not change the Establishment's responsibilities towards it, while remaining subject to relevant privacy clauses.

76.10. Agreement Binding on Successors: This Agreement is binding on the universal and particular successors of the parties, subject to the restrictions above, and to the extent permitted by law.

77.1. Automatic Renewal and Prior Notice: Subscriptions may renew automatically if the renewal option is activated, provided the Establishment sends prior notice before the renewal date, with a period of no less than (15) days via approved notification channels.

77.2. Easy Cancellation Channel: The School has the right to stop automatic renewal or cancel the subscription for the future only via a clear and direct cancellation channel within the account before the renewal date, without any additional action.

77.3. Effect of Cancellation: Cancellation applies to the future only; it does not create any full or partial refund for the current or previous period, to the extent permitted by law.

77.4. Finality of Fees and Non-Refundability: All fees paid for the subscription/seats/add-ons are final and non-refundable after first activation, first successful login, or trial expiry — whichever is earlier — regardless of the reason for termination or non-use. The remedy is limited to Service Credits according to the SLA where applicable, which are non-convertible to monetary amounts.

77.5. Future Fee Changes: The Company may adjust prices in the future, and the adjustment applies only to subsequent renewal periods. Continued use after notice of the increase constitutes implied consent. The School has the right to stop renewal before it takes effect.

77.6. Suspension for Non-Payment: Service is automatically suspended when payment is delayed (15) days from the due date. Reactivation is possible after payment. No extension or compensation is provided for the suspension period.

77.7. No Set-off or Withholding: The buyer is not permitted to set off, withhold, or suspend payments except by a final enforceable court judgment or express written consent from the Establishment.

77.8. Due Date and Invoice Authority: The invoice/agreement date is the due date, regardless of the completion of the buyer's internal procedures (approvals/PO/delegation/payment gateways). Delays in such procedures do not establish a right to deferment, refund, or suspension.

77.9. Failure of Internal Procedures Does Not Create a Right: The School's failure in its internal procedures, financial policies, or approvals does not establish a right to a refund, suspension, or set-off.

77.10. Narrow Definition of "Non-Provision of Service": "Non-provision of service from its foundation" is not considered when the inability is attributable to the School (misuse, failure to complete requirements, blocking permissions, third-party/network failures). It is limited to complete absence of availability for the entire first (30) days due to reasons attributable to the Company despite written notice and a remediation period of no less than (48) hours. The remedy is subsequent availability or Service Credits/future fee relief for the affected part only, without any monetary refund, unless the law expressly dictates otherwise.

77.11. No Successful Login After Payment: If no successful login occurs within (7) days of payment, the Company — at its discretion — may issue a non-cash Service Credit for use during the same school year. The credit does not convert to monetary amounts nor extend the subscription period.

77.12. No Accumulation of Credits and No Conversion: Any Service Credits issued under the SLA are non-convertible to cash or to later periods, do not accumulate across years, and lapse upon expiry of the current subscription period.

77.13. No Refund for School Subscriptions (B2B): The school acknowledges its professional/commercial nature in this contract, and accordingly, consumer withdrawal periods or refund rights do not apply, to the extent permitted by law.

78.1. Nature of the Digital Service: Platform subscriptions are provided as a digital service "AS IS" and "AS AVAILABLE," without a guarantee of a specific academic outcome, to the extent permitted by law.

78.2. No Guarantee of Academic Results: Failure to achieve a specific grade, improvement, or any related academic impact is not grounds for fee refund or compensation.

78.3. Misuse and Failure to Follow Guidance: There is no right to refund for failure to adhere to learning plans/recommendations/scheduling, disabling necessary permissions/features, using unsupported devices/browsers, entering misleading data, or any form of misuse.

78.4. Non-Returnability After Activation/Use: Due to the nature of the service, the subscription is considered consumed and non-returnable upon (a) account activation, (b) granting access to content, or (c) using any paid feature — including the period between payment date and first successful login — unless the law dictates otherwise.

78.5. Cancellation at Client's Initiative: Any cancellation initiated by the User/School applies to the future only and does not create a refund for the remaining period, compensation, or credit transfer to later periods, unless otherwise agreed in writing.

78.6. Transient Failures and Announced Maintenance: Partial failures, slowdowns, announced maintenance, or short outages that do not reach the failure levels specified in the SLA do not create a right to refund or compensation.

78.7. Regulatory Exception (Material Defect/Non-Provision of Service): This does not prejudice any mandatory rights conferred by law. Material Defect is defined in the second clause, after written notice and granting a remediation period (no less than 48 hours). "Non-provision of service from its foundation" is limited to complete absence of availability for the entire first (30) days due to reasons attributable to the Company despite notice and remediation period.

78.8. Exclusivity of Remedy (Schools/SLA): For any failure related to Service Levels — including Material Defect — the sole and exclusive remedy is non-cash Service Credits according to the SLA (requested within 30 days of the end of the affected month; credit cap 25% of the affected month's fees and an aggregate cap of 10% of the annual contractual fees; no accumulation across years, no conversion to cash, no extension of subscription period).

78.9. Individual Users (Outside School Contract): Support is provided on a "Best Effort" basis without a commitment to response time or financial credits; delays or transient failures do not create any refund/compensation rights.

78.10. Beta Features and Discounted Offers: Any Beta features or free/discounted offers are not part of the core subscription and do not create an expectation of continuity. They may be modified or withdrawn without any right to refund or compensation.

78.11. No Set-off or Suspension: All fees after activation/first successful login/trial expiry — whichever is earlier — are final, non-refundable, non-setoffable, and non-transferable to later periods. Payment suspension or set-off is not permitted except by a final enforceable court judgment or written consent from the Establishment.

78.12. Suspension/Termination for Client Breach: Any suspension or termination resulting from the User/School's breach of the Terms or technical requirements does not entail a refund; fees remain due in full for the contracted period.

78.13. Specifying Causes Outside the Establishment's Control: "Non-provision of service" is not considered when the inability is attributable to the School/User, or telecommunications/third-party service providers outside the Establishment's control, or force majeure; the maximum remedy is subsequent availability or Service Credits according to the SLA.

78.14. Authority of Technical Records: Monitoring records, status dashboard, and system limiters (Rate-Limiter/WAF/Firewall) are considered strong technical evidence of availability and outages. A counter technical evidence is not acceptable unless provided by an independent accredited entity using a pre-agreed measurement methodology.

78.15. Unfounded Payment Disputes (Chargeback): Initiating a bank dispute without a legal basis is a material breach; the Company may suspend service and/or terminate it and claim dispute processing fees and collection costs. Upon dispute closure, the Client must reimburse any amounts or discounts granted, and full fees remain due. The Client authorizes the Establishment to share necessary documents to defend the dispute with the payment processor.

78.16. No Derogation from Mandatory Rights: These provisions operate "to the extent permitted by law" and are not interpreted to derogate from any mandatory rights conferred by law that cannot be contractually violated.

79.1. Scope of Processing and Entities: Payments may be managed via a payment processor/collector/acquirer bank or an authorized third-party distributor. The Company may replace or add them at any time with reasonable notice, to the extent permitted by law.

79.2. No Card Data Storage with Us: Card data is processed via a PCI-DSS compliant processor using tokenization. The Establishment does not retain full card numbers and activates verification mechanisms (3D Secure/SCA) where available.

79.3. Third-Party Fees Non-Refundable: The buyer bears any fees, collection commissions, transfer fees, bank/intermediary bank charges, or currency exchange differences imposed by the payment processor, banks, or related entities. They are deemed non-refundable even in the case of exceptional partial refund approval.

79.4. Billing Currency and Exchange Settlement: The default billing currency is Saudi Riyal (SAR) unless otherwise stated. If paid in another currency, settlement is at the exchange rate determined by the payment processor/bank at the time of the transaction. Exchange differences and fees are borne by the buyer. The amount is considered paid when the net proceeds are credited to the Establishment's account.

79.5. Taxes and Tax Compliance: Prices do not include taxes unless expressly stated otherwise. Value Added Tax and applicable duties/taxes under ZATCA regulations are added. Where tax withholding applies, the Client must provide a valid official certificate or "gross-up" the amounts so the Establishment receives the net agreed amount.

79.6. Proof of Payment and Settlement: Electronic invoices and receipts are valid and binding. Payment is considered achieved upon confirmation of collection by the payment processor/bank. Any payment failure, cancellation, or bounce keeps the amounts due and entitles the Establishment to suspension/termination rights according to Clause (55).

79.7. Exceptional Refund and Limits: No cash refunds are made except where explicitly required by law. Any exceptional processing (if any) is net after deducting non-refundable third-party fees and may be in the form of a non-cash Service Credit, non-transferable, non-setoffable, and not extending the subscription period.

79.8. Unfounded Bank Disputes (Chargeback): Initiating a bank dispute/chargeback without a legal basis is a material breach; the Company may suspend service and/or terminate it and deduct/claim dispute processing fees and reasonable collection costs. Upon dispute closure, the Client must reimburse any amounts or discounts granted, and full fees remain due. The Client also authorizes the Establishment to share necessary documents to respond to the payment processor.

79.9. Payments via Distributors/Partners: If payment is made via an authorized distributor/collection partner, payment is considered complete when the net proceeds are credited to the Establishment's account. The distributor's offers or credits do not bind the Establishment unless evidenced and approved in writing.

79.10. Matching Bank Transfers: For wire/transfer payments, the Client must include the invoice number and announced account details. The Establishment's responsibility for activating the service depends on matching the payment. Service may be suspended if matching is impossible or net proceeds are reduced due to intermediary bank fees.

79.11. No Set-off or Suspension: The buyer is not permitted to set off, withhold, or suspend payments except with prior written consent from the Establishment or a final enforceable court judgment, without prejudice to Clause (55).

79.12. AML/Sanctions Compliance: Any transaction may be suspended or refused to comply with Anti-Money Laundering and Counter-Terrorism Financing, sanctions, and export requirements. Additional information/KYC checks may be requested before or after collection, without liability on the Establishment for resulting delays.

79.13. Collection Errors and Settlements: In case of a collection difference/incorrect posting, the remedy is limited to settling the difference in the next invoice or issuing an electronic credit/debit note according to applicable e-invoicing systems, without a commitment to additional compensation.

79.14. Liability Limits for Collection Parties: The Establishment is not responsible for failures/delays/breaches of payment processors, banks, or networks. Use of those services remains subject to their independent terms, to the extent permitted by law.

80.1. Issuance of Electronic Invoices: The Establishment issues electronic tax invoices compliant with applicable e-invoicing requirements (FATOORAH), sent via the registered email and available in the account dashboard. The electronic invoice and accompanying notices are binding records for proving entitlement.

80.2. Nature of Contract for Schools (B2B): The educational institution acknowledges it is a professional/commercial entity and does not acquire "consumer" status as previously stated. In the "Client Categories" clause.

80.3. Individual Invoices (B2C): These provisions apply to individual Users, confirming that non-refundability after activation does not prejudice any mandatory rights conferred by law for consumers within the Kingdom.

80.4. Value Added Tax and Government Fees: All prices exclude Value Added Tax or any applicable fees/taxes unless expressly stated otherwise. Tax and statutory fees are added to the invoice according to ZATCA regulations and are due within the payment deadline.

80.5. Tax Withholding (If Any): When payments are subject to tax withholding/deduction, the Client must provide a valid official certificate or perform a "Gross-up" so that the Establishment receives the net agreed amount.

80.6. Billing Currency and Settlement: The default billing currency is Saudi Riyal unless otherwise stated. If paid in another currency, settlement is at the payment processor/bank exchange rate at the time of the transaction. The Client bears exchange differences and fees.

80.7. Third-Party Fees and Exchange Differences (Non-Refundable): The User bears any third-party fees (payment processor/banks/intermediary banks) or exchange differences. Any refund — if available by law or exception — deducts non-refundable collection fees incurred by the Establishment. Collection fees/commissions/exchange differences are non-refundable in all cases and are deducted from any legally permissible credit processing.

80.8. Due Dates and Reminders: Invoices are due on the specified dates. Automated reminders may be sent before/after the due date. Delay in payment (15) days allows service suspension without extension of the period, according to the Suspension Clause in these Terms.

80.9. Cancellation and Its Effect on Billing: Cancellation is done via a channel within the account and applies to the future only. It does not cancel or reduce what is already due or a current period. Cancellation does not create a refund for the remaining period except where explicitly required by law.

80.10. Upgrades/Downgrades and Pro-Rata Calculation: Upgrades during the period are charged on a pro-rata basis on the next invoice or according to a special notice. Downgrades in seats/packages apply only upon renewal.

80.11. Coupons and Discounts: Any coupons/codes/promotional offers apply only to future invoices, are non-convertible to cash, and may be withdrawn or modified according to the program policy without retroactive effect.

80.12. Tax Notices and Correction: In case of a material error in the invoice, the remedy is limited to issuing an electronic credit/debit note according to applicable e-invoicing systems and correcting the impact in the next cycle, without a commitment to additional compensation.

80.13. Proof of Payment and Settlement: Payment is considered achieved upon confirmation of collection by the payment processor/bank and matching the payment. For bank transfers, the Client must mention the invoice number and specified account details. Activation is suspended if matching is impossible.

80.14. Effect of Suspension/Termination for Non-Payment: Suspension or termination arising from non-payment does not entail a refund, and fees remain due in full for the contracted period. The Establishment retains the right to collect according to legal procedures.

80.15. Exceptional Refund and Form: The principle is no cash refund after activation/use. Where the law requires a refund or the Establishment agrees to exceptional processing, it is in the form of a non-cash Service Credit or a net settlement after deducting non-refundable fees. It does not extend the subscription period or convert to cash, to the extent permitted by law.

80.16. Authority of Records and Proof of Sending: Invoices and notices sent via the registered email/dashboard are considered received upon sending/publishing. The Client is responsible for updating contact details.

81.1. Operational Cap and Definition: The Establishment maintains dynamic operational caps for Platform usage (e.g., concurrent user limits/request rates/daily quotas). These are adjusted to protect stability, security, and service quality. Caps may be modified based on operational needs and risk analysis.

81.2. Management Mechanisms Upon Reaching Capacity: Upon exceeding the prescribed capacity, the Company may activate any of the following measures individually or combined: a time-based waitlist, throttling/rate-limiting, deferring non-critical tasks, temporarily restricting non-essential features, or scheduling phased use.

81.3. Fair Service Priority: Resources are managed according to "technical/safety/compliance priority," considering the commitments to schools with active subscriptions and the SLA, minor protection needs, and educational emergencies. However, the Establishment does not guarantee a specific capacity for any particular client unless otherwise stated in writing.

81.4. Waitlist Policy: The Platform follows a first-come, first-served basis with technically or regulatory justified exceptions (e.g., security incidents, sensitive exam systems). The requester is notified of their approximate position in the queue where practical.

81.5. Fair Usage Limits: Standardized usage limits for each category (number of sessions/requests per minute/daily quota/storage) may be published and applied automatically. Exceeding limits may lead to temporary restriction without prior notice when necessary to protect stability.

81.6. Reaching Capacity is Not "Non-Provision of Service": Reaching the cap or phased restriction does not constitute "non-provision of service from its foundation" and does not create a right to a monetary refund. The remedy — if applicable — is limited to Service Credits according to the SLA for schools only, and to the extent permitted by law.

81.7. Transparency and Authority of Records: Material updates on capacity and its limits are announced via the status dashboard/notifications within the account. Internal monitoring records (status dashboard/rate limiter/WAF) are considered a technical reference evidence for consumption and outages, unless their manifest error is proven by an independent report.

81.8. Phased Expansion: Capacity is expanded in phases (Pilot → Gradual Rollout) after performance/security and compliance testing. The trial may be restricted to user segments/regions before generalization. Beta versions do not create an expectation of continuity or a specific performance level.

81.9. Peak Scheduling and Testing: Throttling/special scheduling may be applied during peak seasons (e.g., national test periods) to protect exam integrity and prevent abuse, including temporarily restricting some features.

81.10. Reasonable Notice Obligations: When a persistent material change is made to the caps affecting normal use, reasonable prior notice is provided within the Platform. Notice is not required for urgent changes related to security/stability.

81.11. No Obligation to Provide Additional Capacity: The Establishment is not obliged to provide dedicated/additional resources except under a separate written agreement (e.g., an institutional package/capacity-defined service contract). All other remedies remain limited to those in the Terms and SLA.

81.12. No Consequential Damages: Any delay in availability due to capacity limits or phased expansion does not hold the Establishment liable for indirect losses/profit loss/business interruption and is subject to general liability limits.

81.13. Overlap with Force Majeure and Third Parties: Restrictions arising from national telecommunications/cloud provider outages/regulatory orders are treated according to the Force Majeure clause and outside the scope of credits, unless otherwise specified in the SLA.

81.14. Institutional Coordination Channels: For large schools, "usage windows" or pre-agreed limits may be scheduled through the success manager, subject to capacity availability and within a separate contractual framework if necessary.

82.1. Optional Nature of the Program: Any loyalty packages/points/rewards/discounts are offered on an optional basis and at the Establishment's sole discretion. They may be modified, suspended, or wholly/partially cancelled at any time without any liability for compensation, to the extent permitted by law.

82.2. No Cash Value: Points, rewards, coupons, and any promotional credit are not money, do not represent a financial right, do not accrue interest, and cannot be exchanged for cash, set off, or converted to subscription balances, unless expressly and in a separate writing to the contrary.

82.3. Non-Transferability: Points cannot be sold, assigned, transferred, pledged, inherited, or combined between different accounts. The Company may cancel any points or benefits obtained or transferred in violation.

82.4. Acquisition and Calculation: Points/benefits acquisition mechanisms, equations, and time limits are specified in the program booklet within the Platform. The Company may modify, restrict, impose daily/monthly caps, or exclude transaction categories at any time with reasonable in-product notice.

82.5. Redemption and Availability: Redemption is limited to the "Reward Catalog" or announced benefits within the Platform, subject to availability, quantities, limits, caps, and technical requirements. The Establishment does not guarantee the availability of a specific reward at any time and may substitute it with a functionally equivalent alternative.

82.6. Expiry Date and Lapse: Expiry dates may be set for points/coupons/promotional balances; they automatically lapse upon expiry, account closure, membership termination, or program cancellation. No extension after expiry.

82.7. Prohibition of Abuse: Creating multiple accounts, or any artificial, automated, or manipulative behavior to increase points (including: fake referrals, automation/bots, circumvention of restrictions, fabricated purchase/cancellation cycles, or similar means) is prohibited.

82.8. Unauthorized Automation: Using scripts/interfaces/headers or tools for circumventing rate limits/CAPTCHA to earn or redeem points is prohibited. The Company may block devices/addresses and confiscate violating balances.

82.9. Measurement, Publication, and Authority of Records: In any technical dispute regarding earning, balance, or redemption, internal Platform records and monitoring systems (Rate-Limiter/WAF/Status Dashboards) are considered a technical reference evidence unless their manifest error is proven by an independent report.

82.10. Suspension and Confiscation Actions: Upon reasonable suspicion of misuse, the Company may temporarily suspend the account/program, freeze the balance, void or confiscate points, cancel rewards, close the account when necessary, and recover unjustified benefits. This is without prejudice to the Establishment's right to claim actual damages, enforcement costs, and reasonable legal fees.

82.11. Violation Notice and Objection: The Establishment notifies the User via approved channels upon the intention to make a final confiscation. The User is given a period of (3) calendar days to submit a reasoned objection with evidence via the support dashboard. The Establishment decides on the objection within a reasonable period; its decision is final to the extent permitted by law.

82.12. Taxes, Fees, and Shipping: The beneficiary bears any fees/taxes/customs/shipping/exchange differences arising from the redemption of physical or digital rewards, unless otherwise stated. The Company may make statutory disclosures about rewards to competent authorities or apply statutory deduction when necessary.

82.13. Error Correction: The Company has the right to correct any errors, incorrectly credited balances, or those resulting from technical glitches, vulnerabilities, or misuse, including reverse debiting of points or cancellation of redemption, even after the transaction is completed.

82.14. Third Parties: Any benefits provided by a third party are subject to its independent terms and responsibility. The Establishment makes no warranty regarding them and is not liable for failures/delays/alterations by that party.

82.15. No Set-off and No Compensation: Points or coupons cannot be used to settle due fees, set them off, or suspend subscription payments. The program does not modify the financial terms of the subscription nor create a right to any reduction or refund.

82.16. Eligibility and Capacity: Minor participation is subject to Guardian consent and the announced age limits; rewards inappropriate for the age group or violating laws are not disbursed.

82.17. Program Suspension or Modification: The Company may withdraw/modify/suspend the program wholly or partially with reasonable in-product notice. Upon termination, any unused points/coupons are removed without monetary compensation.

82.18. Independence from Service Credits: Points/rewards are different from "Service Credits" in the SLA; neither can be converted into the other, and each has its own system, terms, and caps.

82.19. Liability Limits: The program is provided "AS IS" and "AS AVAILABLE." Any claims are subject to the general liability limits in the Terms, without liability for indirect losses/profit loss/business interruption, to the extent permitted by law.

82.20. Announced Maintenance: Planned maintenance may be carried out with reasonable prior notice (usually ≥ 24 hours) via the status dashboard/in-platform. Announced maintenance periods are not counted as outage minutes for SLA purposes.

82.21. Emergency Maintenance: Emergency maintenance or measures may be carried out without prior notice when necessary for security/legal/technical reasons. Subsequent notice is published via the status dashboard within a reasonable period.

82.22. Priorities During Failures: Non-essential features may be temporarily restricted or disabled to enable overall stability, address abuse/attacks, or comply with a legal order. Service is gradually restored according to technical priority.

82.23. Technical Reference: Status dashboard data, monitoring systems, and internal tickets are considered a reference evidence for measuring availability, outages, and response times, unless their manifest error is proven by an independent technical report compliant with industry standards.

82.24. Exclusions from Measurement and Credits: The following are excluded from outage minutes: announced maintenance, force majeure, telecommunications provider outages, third-party services outside control, and misuse/non-compliance with published requirements. Credits (for B2B clients subject to the SLA) are calculated exclusively according to the SLA, with the caps and deadlines mentioned therein. They are the sole and exclusive remedy for any Service Level failure and cannot be converted to monetary amounts, to the extent permitted by law.

82.25. Individuals (B2C): Support is provided on a Best Effort basis without a commitment to availability level or financial remedy. No refund rights arise due to transient slowdowns/outages that do not reach specified failure levels. This does not prejudice any mandatory rights conferred by law for consumers.

82.26. Change/Suspension: Without prejudice to mandatory rights, the Service or part thereof may be modified, suspended, or discontinued for security, legal, technical, or compliance reasons, with reasonable notice where possible. This does not create any monetary refund; the maximum remedy applies according to (SLA/credits or future relief for the affected feature) and according to the relevant terms.

82.27. Capacity and Restrictions: Capacity controls or waitlists may be applied when capacity limits are reached (refer to Clause 61). These controls are not considered availability failures.

83.1. Nature of Service and Availability: The Platform is provided as a digital service relying on cloud infrastructure and multiple integration parties. It may be subject to outages or transient slowdowns for technical or regulatory reasons; to the extent permitted by law. The Establishment does not guarantee uninterrupted continuity or freedom from errors.

83.2. Planned Maintenance: Planned maintenance may be carried out to improve performance/security/compliance, with prior notice via the status dashboard/in-product within a reasonable period (aiming for at least 24 hours where possible). Announced planned maintenance periods are not counted as outage minutes for availability measurement or Service Credits.

83.3. Emergency Maintenance: Emergency maintenance may be carried out immediately to address serious security risks, compliance, or infrastructure failure, with brief notice as soon as possible. It is excluded from outage measurement when necessary to address an imminent risk or urgent legal order.

83.4. Exclusions from Outage Calculation: The following are not included in measurable outage: (a) Pre-announced maintenance, (b) Force majeure and national telecommunications outages/regulatory service blocks, (c) Failures of telecommunications providers and service providers outside the Establishment's control, (d) Misuse, unsupported devices/browsers, or blocking of required permissions, (e) Failures or changes of a third party chosen by the Client outside Platform recommendations.

83.5. Measurement and Authority of Records: Status dashboard data and internal monitoring records (automated metrics/logs/observation systems) are the exclusive reference for measuring availability and outages. A counter technical evidence is not acceptable unless provided by an independent accredited entity using a pre-agreed measurement methodology.

83.6. Escalation Path and Support: Communication begins via official support channels (ticket/support dashboard) → escalation to the Success/Account Manager for institutions → then legal notice when remediation is not possible within reasonable periods. Response times and Service Credits for institutions apply according to the SLA, while individual support is provided on a "Best Effort" basis without a commitment to a specific response time.

83.7. Sole Remedy for Availability Failures: For any failure related to Service Levels — including Material Defect — the sole and exclusive remedy is Service Credits according to the SLA for eligible schools, without termination or monetary refund, and to the extent permitted by law. Individuals are not entitled to any financial credits; their remedy is limited to "Best Effort" technical support.

83.8. No Refund for Transient Failures: Transient slowdowns, short outages, announced maintenance, or partial failures that do not reach the SLA failure levels do not create a right to refund or compensation. The maximum remedy — where SLA conditions apply — is non-cash Service Credits.

83.9. Technical Liability Limits: To the extent permitted by law, the Establishment is not liable for any indirect losses, loss of profit, or business interruption arising from maintenance/outage/slowdown; any compensation is subject to the general liability limits in the Terms.

83.10. Failure Notices and Communication: Progress updates are published via the status dashboard/in-product notifications and the approved email for institutional accounts. Notice is considered received upon publication or sending according to the Notice Policy.

83.11. Post-Incident Reports: For high-impact incidents for institutions, a brief summary of the root cause and prevention measures may be provided to affected parties within a reasonable period, subject to security and confidentiality requirements.

83.12. Operational Impact Improvement: The Establishment makes commercially reasonable efforts to schedule maintenance outside educational peak times and minimize impact, while retaining the right to perform what is technically necessary to protect the system and its integrity.

84.1. Scope of Application: These provisions apply to educational institutions subscribed to B2B plans subject to Appendix 7 — SLA. Individual Users are outside the scope of the SLA and are provided "Best Effort" support only, without any performance commitments or financial remedies.

84.2. Success Manager and Support Channels: The Establishment assigns a dedicated Success Manager and provides dedicated support channels (form/email/portal) and an emergency channel for critical incidents during official working hours within the Kingdom, excluding public holidays and announced maintenance windows.

84.3. Response Times (For Educational Institutions): Initial response within ≤ 2 Business Hours for incidents reported via approved channels, without a commitment to a specific resolution time. A clear escalation path follows: Technical Support → Success Manager → Emergency Channel/Legal Notice when necessary.

84.4. Definition and Calculation of Availability: Monthly Availability = (Total Minutes in Month − Measurable Outage Minutes) ÷ Total Minutes in Month × 100%. Status dashboard data and monitoring systems (logs) are the exclusive reference for measuring availability and outages.

84.5. Exclusions from Calculation: The following are not counted as outage minutes: (a) Maintenance announced ≥ 24 hours in advance, (b) Force Majeure, (c) National telecommunications provider outages, (d) Failures/shortcomings of third-party services outside the Establishment's control, (e) Misuse or non-compliance with published requirements or technical specifications.

84.6. Maintenance Window: An announced maintenance window (≥ 24 hours in advance) does not create any right to Service Credits or refund.

84.7. Technical Authority: The Establishment's automated records (status dashboard/monitoring systems/Rate-Limiter/Firewall/WAF) are considered a strong reference evidence for availability, outages, and response times. A counter technical evidence is not acceptable unless provided by an independent accredited entity using a pre-agreed measurement methodology, and only if manifest error is proven.

84.8. Status Log: Availability percentage and outage incidents are published monthly in a status log accessible to clients, archived for no less than (24) months.

84.9. Sole and Exclusive Remedy: For any failure related to Service Levels — including Material Defect — the sole and exclusive remedy is Service Credits according to Appendix 7 — SLA. They cannot be exchanged or converted to cash, do not create a right to termination or refund, are consumed during the current subscription period, and lapse upon expiry.

84.10. Credit Request and Caps: A credit request must be submitted within 30 days of the end of the affected month, with incident details. The credit cap is 25% of the affected month's fees, with an aggregate cap of 10% of the annual contractual fees. Credits do not accumulate across years and cannot be used to extend the subscription.

84.11. Eligibility: Credits are not granted if the incident is within the exclusions above or results from non-compliance with technical requirements/usage policy. The educational institution's account must be in good financial and procedural standing at the time of the claim.

84.12. Non-Eligibility/Transient Outages: Partial failures, transient slowdowns, and short outages that do not reach the specific SLA failure levels do not create a right to refund or credit.

84.13. Individual User Support (Outside SLA): Provided on a "Best Effort" basis without a commitment to availability level or financial remedy, with a target initial response within ≤ 2 Business Days depending on workload and incident priority; no compensation/refund rights arise due to delays or transient failures.

84.14. General Provisions: Credits are calculated only for the affected month, cannot be transferred to other fees or later periods, and are not offset or refunded. All of the above remains "to the extent permitted by law," without prejudice to any mandatory rights conferred by law that cannot be contractually violated.

85.1. General Scope: To the extent permitted by law, the Establishment is not liable for any special, indirect, consequential, or punitive damages, nor for loss of profit, business interruption, loss of reputation, or data loss beyond what is recoverable under the announced restoration policies.

85.2. Non-Excludable Exceptions: No limitation or exclusion applies to liability for death, personal injury, or intentional fraud/misrepresentation.

85.3. Aggregate Liability Cap: The total liability of the Establishment, for all claims regardless of legal basis and related to the Service subject to the claim, is limited to the total fees actually paid to the Company for that Service during the twelve (12) months immediately preceding the event giving rise to the claim, or the subscription period if shorter.

85.4. Cumulative and Non-Multiple: Multiple claims or theories (contractual/tort/statutory) do not increase the aforementioned financial cap; the cap is cumulative for each twelve-month period.

85.5. Exclusion of Due Fees: This cap does not limit the Client's obligation to pay fees and any amounts due under the Agreement.

85.6. No Retroactive Termination: To the extent permitted by law, the contractual remedies herein are exclusive; no claim for rescission/termination to recover consideration for periods already served is allowed.

85.7. Sole Remedy for Performance/SLA Failures: For any failure related to Service Levels — including Material Defect — the sole and exclusive remedy is Service Credits according to the SLA, without termination or monetary refund. They are consumed during the current subscription period and lapse upon expiry.

85.8. Security Incidents and Regulatory Notifications: The School's remedy is limited to timely notification, mitigation, and correction according to security policies and the SLA. No right to a monetary refund arises.

85.9. Client Contribution and Misuse: The Establishment is not liable for any losses resulting — wholly or partially — from violation of published technical requirements, misuse, use of unsupported environments/devices, or failures of telecommunications providers or third-party services outside the Establishment's control.

85.10. Duty to Mitigate: Each party must take reasonable measures to mitigate its damages and losses before claiming them.

85.11. Force Majeure: Liability is excluded during Force Majeure events as defined in the Force Majeure clause, and time periods are extended by the duration of the event.

85.12. Intellectual Property Indemnity: Any defense/indemnity obligations for intellectual property claims are within the general liability cap unless expressly stated otherwise.

85.13. Compliance with Mandatory Laws: The foregoing does not prejudice any mandatory rights conferred by law that cannot be contractually violated.

85.14. Anti-Bribery, Sanctions, and Export: Both parties comply with anti-bribery and anti-corruption laws, sanctions, and export compliance regulations, and refraining from dealing with entities or individuals on prohibited lists. Any breach is material and gives the non-breaching party the right to suspend/terminate for the future according to the Terms, without prejudice to its other rights.

85.15. Authority of Technical Records: The Establishment's automated records (status dashboard/monitoring/Rate-Limiter/Firewall/WAF) remain a rebuttable reference evidence for proving availability and outages. A counter technical evidence is not acceptable unless provided by an independent accredited entity using a pre-agreed measurement methodology, and only if manifest error is proven.

86.1. Exclusivity of Remedy for Service Level Failures: To the extent permitted by law, the sole and exclusive remedy for any failure related to Service Levels — including Material Defect — is non-cash Service Credits according to Appendix 7 (SLA) and within the current subscription period. They cannot be exchanged, converted to cash, or used to extend the period. This does not prejudice any mandatory rights conferred by law that cannot be contractually violated.

87.1. Definition of Event: "Force Majeure" means any event beyond control, unforeseeable, unavoidable, or whose effects cannot be prevented by reasonable efforts, resulting in the impossibility of performing obligations wholly or partially, temporarily or permanently. Includes — by way of example and not limitation — natural disasters, pandemics and health lockdowns, wars, riots, and terrorism, fires and explosions, large-scale power outages, national telecommunication or internet network outages, regulatory service or platform blocks, material failures of cloud or telecommunication service providers outside the Establishment's control, and sudden changes in laws, regulations, or binding government orders.

87.2. Exceptions: Failures arising from the invoking party's negligence or violation of published technical requirements, shortage of financial resources, or changes in ordinary business conditions are not Force Majeure.

87.3. Scope of Suspension: The obligations of the affected party are suspended — to the extent and for the duration affected — throughout the Force Majeure event. Time periods are extended by the same duration, without liability for compensation or delay penalties.

87.4. Effect on SLA and Credits: During Force Majeure events, Service Level Agreement (SLA) standards do not apply. Outages arising from them are not counted in availability measurement, and Service Credits, penalties, or any financial compensation are not applied.

87.5. Communications and Notice: The affected party must notify the other party within a reasonable period from the reasonable time of becoming aware of the event, providing progress updates on impact and mitigation measures. Notice is sent via the channels specified in the Notices Clause.

87.6. Duty to Mitigate and Continuity: The affected party makes commercially reasonable efforts to isolate the impact and gradually restore services, including using commercially available alternatives or bypass paths where possible. The Company may — when necessary — modify certain features, reduce loads, or activate a minimum operational mode to maintain core continuity.

87.7. Financial Obligations: Financial amounts due before the event remain payable. Subsequent fees are due according to the contract as long as the Service is substantially provided. If the provision of the affected part ceases entirely throughout the event, the Client is relieved of future fees for that part during the suspension period, without any refund for previous periods.

87.8. Prolonged Impracticability and Limited Termination Right: If Force Majeure continues for a period that renders performance of the affected obligation impracticable, either party may terminate only the affected part for the future upon written notice, with data export in a standard format within a reasonable period where applicable, and without any monetary refund for what has already been paid.

87.9. Competent Authority Orders: If an emergency regulatory order or national block results in the suspension of the Service or part thereof, this is considered Force Majeure. The remedy is limited to suspension, extension of time periods, mitigation, and correction where possible, without liability for compensation or refund.

87.10. No Prejudice: This clause does not prejudice any mandatory rights conferred by law that cannot be contractually violated.

88.1. Scope of Obligation: To the extent permitted by law, the User/Educational Institution agrees to indemnify and hold the Establishment harmless from any claims, losses, damages, or costs arising from (a) breach of these Terms or appendices, (b) misuse or non-compliance with technical requirements/Community Policy, (c) infringement of the intellectual property, privacy, or reputation rights of any third party due to content provided by the User or their behavior on the Platform.

88.2. Triggering Cases (Non-Exhaustive Examples): Include without limitation: use of bots, automation, rotating proxies, circumventing rate limits/CAPTCHA (Bots/Headless/Proxies/Rate-Bypass/Automation), automated scraping/extraction or public performance benchmarking without prior written consent, circumvention of Platform/exam systems or circulating leaks, publishing violating, abusive, or rights-infringing content, and security negligence (e.g., sharing login credentials or disabling 2FA when available).

88.3. Indemnification Elements: Includes actual losses, investigation and enforcement costs, reasonable legal fees, expert costs, court/arbitration fees, costs of incident response and regulatory notifications (if legally required), and any amounts paid by the Establishment to settle third-party claims approved under this clause.

88.4. Injunctive Relief and Urgent Equitable Measures: The Company has the right — in addition to any damages — to seek injunctive relief and urgent protective measures to stop the breach or prevent aggravation of harm, without needing to prove irreparable harm to an extent beyond what the law requires.

88.5. Claim Procedures and Cooperation: The Establishment notifies the responsible party of the claim within a reasonable period and undertakes (at its option) defense or settlement; the indemnifying party must cooperate in good faith, provide necessary information, and not accept any settlement that creates liabilities or acknowledgments against the Establishment without its written consent.

88.6. Technical Authority: The Establishment's automated records (Rate-Limiter/Firewall/WAF/monitoring systems) are considered strong evidence for technical facts related to exceeding limits, use of bots, request volumes, or sources, unless their manifest error is proven by an independent technical report compliant with industry standards.

88.7. Relationship with Liability Limits: This clause does not prejudice general liability limits. However, indemnification obligations arising from intentional fraud, deliberate misuse, material technical restrictions breaches, or serious intellectual property infringements are not subject to any liability limits to the extent permitted by law.

88.8. Recovery of Enforcement Costs: The Company has the right to recover actual enforcement costs and reasonable legal fees resulting from breaches of usage restrictions or security/community policies, including blocking addresses/devices or taking technical and legal measures to stop the breach.

88.9. No Prejudice to Other Remedies: The rights herein are in addition to any other rights or remedies provided for by law or contract and are not construed as limiting the remedy to financial compensation only.

89.1. Scope of Indemnity: The Establishment undertakes to defend and indemnify the educational institution — to the extent permitted by law — against any third-party claim within the Kingdom alleging that the "core Service software" infringes an intellectual property right (including patents, copyrights, trade secrets, and trademarks), subject to the general liability cap in the Liability Limits Clause.

89.2. Exclusions: The indemnity does not apply to claims arising from (a) misuse or operation contrary to documentation, (b) unauthorized modification or failure to apply updates/fixes provided by the Establishment to address the infringement, (c) combination/installation/linking with software, hardware, or integrations outside the Establishment's written recommendations, (d) content, data, materials, or applications provided by the Client or its parties, (e) third-party services/components outside the Establishment's control (including external AI model providers), (f) any breach by the educational institution of relevant open-source (OSS) licenses.

89.3. Exclusive Remedies: The following remedies represent the sole and exclusive solution for any covered infringement claim: (a) obtaining a license for continued use of the allegedly infringing part, or (b) replacing/modifying that part with a functionally equivalent and non-infringing component, or (c) if (a) and (b) are not possible within a reasonable period, a limited termination of the affected part/feature only with a waiver of future fees specific to it, without any refund for previous periods; enabling the export of relevant data in standard format (CSV/JSON) within 30 days.

89.4. Notice and Defense Procedures: The educational institution must notify the Establishment in writing within a reasonable period of becoming aware of the claim. The Company has sole control over the defense and settlement, with reasonable cooperation from the educational institution and provision of necessary information. The educational institution may not admit liability or settle regarding the claim without prior written consent from the Establishment. The educational institution will not withhold consent to a reasonable settlement that does not impose additional financial obligations on it and does not involve an admission of liability.

89.5. Mitigation Obligation: Upon notification of a valid claim, the educational institution agrees to temporarily cease using the affected part or apply any reasonable update/modification provided by the Establishment to avoid the claim. Any continued use otherwise limits the Establishment's indemnity obligation to the extent of additional harm caused.

89.6. Scope Limits: The indemnity is limited to infringements attributable to the "Core Software" owned/licensed by the Company and under its actual control. It does not cover the publication or use of generative outputs outside the license scope, unless the claim relates to the Establishment's own code/component.

89.7. Relationship with Liability Limits: This clause is read with the general liability limits and is subject to its cap, without prejudice to what cannot be legally limited. This clause is the sole and exclusive remedy for intellectual property infringement claims.

89.8. Spatial and Legal Framework: The indemnity applies to claims brought under the laws of the Kingdom of Saudi Arabia and before its competent authorities. For cross-border claims, the Establishment's commitment is limited to what local laws and liability limits permit.

89.9. Open Source Components (OSS): The Establishment commits to providing notices and licenses for included OSS on a dedicated page. Any remedy is as permitted by those licenses. Any claim caused by the educational institution's breach of OSS terms is not covered by the Establishment's indemnity.

89.10. Preventive Suspension: The Company — without liability — may temporarily suspend the affected feature/part upon a reasonable risk of a claim, pending applying a license/replacement/modification.

90.1. Indemnification and Defense Obligation: To the extent permitted by law, the User/Educational Institution agrees to defend, indemnify, and hold harmless the Establishment and its subsidiaries, branches, suppliers, contractors, agents, officers, and employees from any claims, suits, disputes, liabilities, damages, fines, penalties, losses, costs, or expenses (including reasonable legal and expert fees and enforcement costs) arising out of or relating to:

90.2. Any content that the User or anyone acting on their behalf or through their account inputs/uploads/publishes/makes available;

90.3. Any breach of these Terms, Policies, the DPA/related appendices, or any applicable law/regulation;

90.4. Any prohibited use or technical/security misuse of the Service, including (by way of example and not limitation) circumvention of controls, unauthorized reverse engineering, scraping/automation, bots/proxies bypassing rate limits, and unauthorized access attempts;

90.5. Any dealing or relationship established by the User with a third party or other Users inside/outside the Platform;

90.6. Any third-party intellectual property claims arising from materials/prompts/integrations/configurations provided by the User or educational institution;

90.7. For educational institutions (B2B): Any claims or regulatory penalties related to processing their students' data resulting from their failure to provide the legal basis, manage rights requests, or supervise minors, according to the DPA.

90.8. Notice and Defense Control: The Establishment is notified in writing of the claim within a reasonable period of becoming aware. The Company has the right to control the defense and settlement (or appoint its choice). The User/Educational Institution must fully cooperate and provide necessary information, witnesses, and records. Settlement, acknowledgment, or arrangement of any obligation in the Establishment's name is not permitted without prior written consent. Failure to notify does not waive the indemnity right except to the extent it materially prejudices the defense.

90.9. Fair Exception: This obligation does not extend to claims arising solely from the Establishment's intentional fraud or gross negligence.

90.10. Relationship with Liability Limits: The liability limitations and caps in (85) do not apply to the indemnification, defense, and release obligations established in this clause for the User/Educational Institution, to the extent permitted by law. The Establishment's indemnity obligation in (68) is subject to the general liability limits.

90.11. Survival: The obligations in this clause survive termination or suspension for any reason.

90.12. Supplementary Measures: This clause does not prejudice the Establishment's right to seek injunctive relief or any appropriate interlocutory/provisional measures, and its right to recover enforcement costs as provided in these Terms.

91.1. Provision "AS IS" and "AS AVAILABLE": The Service and AI model outputs are provided "AS IS" and "AS AVAILABLE" without any express or implied warranties — including warranties of fitness for a particular purpose, accuracy, or non-infringement — to the extent permitted by law. This does not prejudice any mandatory rights conferred by law for consumers in the Kingdom.

91.2. Advisory, Non-Binding Nature: All explanations/hints/solutions/recommendations generated by AI are educational, enriching, and advisory in nature. They are not academic/professional/legal/medical advice and do not constitute a contractual commitment to achieving a specific result, grade, or performance improvement.

91.3. Potential for Error and Bias: Outputs may involve omissions, inaccuracies, biases, or conflict with the latest curricula/sources. The User/Teacher/School must conduct independent verification before relying on them for decisions or external publication.

91.4. Human Review Required for Influential Decisions: No decisions with material academic impact on minors are made by automated means exclusively. A binding objection and human review path is available within (7–10) Business Days for academically impactful decisions, with a written summary provided to the Student/School including the outcome and reason.

91.5. Limits of Reliance in Assessments and Tests: Using outputs to cheat, deceive, or bypass integrity controls is prohibited. They must be reviewed and pedagogically judged before inclusion in assessment work or official documents.

91.6. Intellectual Property and Use of Outputs: The Establishment does not guarantee the protectability of outputs or freedom from third-party rights. The User must conduct suitability and rights checks before any commercial use or external publication, complying with all relevant laws.

91.7. Responsibility for Input Content: The User alone bears responsibility for the legality and accuracy of the content input into systems and the results of model directions. The Platform has the right to filter/reject/modify content or outputs that violate Community Policy or the law.

91.8. No Performance Promises: The Establishment makes no promises or representations regarding consistent accuracy, guaranteed improvement, or assured results. Any examples or performance indicators are illustrative and non-binding.

91.9. Support Path and Escalation: For feedback or objections on AI outputs, the "Support" path is followed first, then "Success Manager (for educational institutions)," then — when appropriate — "Legal Notice" according to announced deadlines and procedures. For individual Users, support is provided on a "Best Effort" basis without a commitment to a specific response time.

91.10. Linking Failure to SLA and Sole Remedy: An error resulting from AI outputs is not itself a Material Defect unless it leads to a Service Level failure according to the SLA. Any failure related to Service Levels — including Material Defect — has Service Credits as the sole and exclusive remedy for schools subject to the SLA, without termination or monetary refund, to the extent permitted by law.

91.11. Beta Features: Some AI capabilities may be experimental and unstable; they may be modified/discontinued without prior notice and without creating a right to compensation or refund. Error logs may be collected for support and improvement purposes according to the Privacy Policy.

91.12. Filtering Sensitive Off-Curriculum Content: Responses on religious/social topics outside the curriculum may be restricted or modified to comply with laws, local values, and Community Policy. Some outputs may be blocked or reduced.

91.13. No Liability for Indirect Damages: To the extent permitted by law, the Establishment is not liable for indirect, special, consequential damages, or loss of profit arising from reliance on outputs; without prejudice to what cannot be legally limited.

92.1. Scope and Urgent Exceptions: This path applies to every dispute arising out of or related to these Terms. Exceptions — for interlocutory/urgent orders — relate to the protection of intellectual property, confidential information, cybersecurity, prevention of scraping/circumvention/limit bypass, and collection of due amounts. The Company may resort directly to competent courts for preservative orders without prior notice, to the extent permitted by law.

92.2. Dispute Notice and Mandatory Amicable Settlement: The path begins with a written dispute notice sent via approved notification channels (according to the Notices Clause), including a summary of facts, claims, and essential documents. The parties negotiate in good faith for a period of no less than (15) Business Days from the receipt of the notice, with each party appointing a representative with decision-making authority.

92.3. Internal Gradual Escalation: Before any external recourse, an internal escalation path is completed in three stages: (1) "Support" channel, (2) "Success Manager" for educational institutions, (3) "Legal Notice." A solutions meeting is scheduled within a reasonable period, and a brief record of the attempt's outcome is prepared.

92.4. Mediation Before Litigation: If the dispute is not resolved during the amicable settlement and internal escalation stages specified above, the parties — before any judicial recourse — submit to expedited mediation according to the Saudi Center for Commercial Arbitration (SCCA Mediation Rules) or any equivalent local alternative agreed upon in writing by the parties. Mediation is conducted remotely as a default, in Arabic. The mediator is appointed within (7) Business Days of the mediation request. Mediation sessions are completed within (30) days from the date of the mediator's appointment unless the parties agree otherwise in writing.

92.5. Costs: Each party bears its own legal fees and expenses. Mediation fees and the mediator's fees are shared equally between the parties unless otherwise agreed.

92.6. Legal Effect: Mediation does not constitute an acknowledgment or waiver of any right. The content of its deliberations or offers is not admissible as evidence before the judiciary, applying the confidentiality of negotiations and mediation provided in these Terms.

92.7. Suspension of Periods: Any limitation/prescription period related to the claim is suspended — to the extent permitted by law — throughout the mediation period. Calculation resumes from the date the mediator declares the mediation concluded without agreement.

92.8. Urgent Exceptions: This procedure does not prejudice either party's right to seek interlocutory/preservative orders before competent courts to protect intellectual property, confidential information, cybersecurity, prevent scraping/limit bypass, or collect due amounts, as stated in the exceptions above.

92.9. Failure of Settlement: If mediation does not result in a signed written settlement within the mentioned periods, either party may resort to the competent courts in Dammam according to the Applicable Law and Jurisdiction Clause.

92.10. Clarifying Note: The mandatory mediation via SCCA stipulated above is the only approved path before litigation. No mediation outside SCCA is accepted except by a later separate written agreement between the parties.

92.11. Litigation and Jurisdiction: If the dispute is not resolved amicably (with or without mediation), disputes are brought before the competent courts in Dammam, Kingdom of Saudi Arabia. Saudi law applies. Arabic prevails in dispute proceedings and documents.

92.12. Continued Performance During Dispute: The parties must continue performing obligations in the non-disputed part. The educational institution/User must pay amounts not in dispute on time. Set-off or withholding of payments is not permitted except by a final judgment or written consent.

92.13. Exhaustion of Credit Path for SLA Claims: No claim related to Service Levels is accepted before exhausting the "Service Credit" claim path according to the SLA and within its deadlines. This is the sole and exclusive remedy for any SLA-type failure, without termination or monetary refund, to the extent permitted by law.

92.14. Time Limit for Filing Claims: Any claim arising from these Terms must be filed within (12) months from the date the cause of action arose, to the extent permitted by law, except for claims not subject to legal limitation (e.g., death/personal injury/intentional fraud).

92.15. No Class/Representative Actions: To the extent permitted by law, claims are brought in an individual capacity only. Class, representative, or qui tam actions are not permitted.

92.16. Confidentiality of Negotiations and Mediation: All correspondence, settlement offers, and discussions during amicable settlement/mediation are considered Confidential Information and cannot be used as evidence except to the extent required by law.

92.17. Authority of Technical Records: Automated system records (status dashboard/monitoring/rate limiters/WAF) remain strong evidence for availability, outages, and circumvention attempts, unless their manifest error is proven by an independent technical report compliant with industry standards.

92.18. No Waiver by Silence: Any delay or failure to exercise any right does not constitute a waiver or forfeiture, nor does it affect the party's right to exercise that right later within the legally prescribed periods.

93.1. Approved Notice Channels: The Establishment sends notices via any of the following channels: the email address registered in the account, in-platform notifications, the dashboard, and SMS/push notifications for verified phones in urgent cases (e.g., security incidents and critical billing). Notices include: operational updates, substantive changes to Terms/Policies, security alerts, billing and collection notices, and compliance notices.

93.2. Notice Effect and Time of Receipt (Deemed Receipt): A notice is considered received and effective upon (a) sending to the registered email address, or (b) publishing in the dashboard/within the Platform, whichever is earlier. In case of email bounce, the notice remains effective from the time of its publication in the dashboard, with the possibility of resending via an alternative channel (SMS/in-app) when appropriate.

93.3. Independence of Service Notices from Marketing: The User/School may withdraw consent to marketing communications at any time via an unsubscribe link or account settings, without affecting the delivery of essential service notices or legal/security notifications.

93.4. Responsibility for Updating Contact Data: The User/School must maintain the accuracy and currency of the email address and contact numbers stored in the account. Any failure to update does not stop the effect of notices sent to the latest data registered with us.

93.5. Official Sending Addresses: Notices are sent only from the Establishment's domain, including — for example —: [email protected], [email protected], [email protected], [email protected]. Notices from these addresses or from within the Platform are considered valid and binding unless otherwise announced within the Platform.

93.6. Notice Format and Minimum Content: The notice includes — as applicable — the account/school number, a unique reference/ticket number, a clear subject, date and time, a summary of the incident or change, the required action (if any) and associated deadlines, and links to relevant policies.

93.7. Security and Incident Notices: Urgent security reports are sent via [email protected] and the dashboard. They may be supplemented by an SMS to the designated contact (e.g., School Principal). An in-app acknowledgment may be requested for critical cases.

93.8. Governing Language: Notices are provided in Arabic as the governing text. A translation may be attached for convenience without affecting the effectiveness of the Arabic text.

93.9. Timing and Deadlines: Time periods are calculated according to the local time of the Kingdom of Saudi Arabia (UTC+03:00). "Business Days" — where mentioned — are measured from Sunday to Thursday, excluding announced public holidays. Unless otherwise specified, periods are measured in calendar days.

93.10. No Request for Credentials: The Establishment will not request passwords or sensitive verification codes via email/messages. Any message requesting them is not issued by the Establishment and should be reported via support/security channels.

93.11. Authority of Records: Sending system records (SMTP headers/email logs), Platform logs/status dashboard, are considered strong evidence of sending, receipt, and publication, unless their manifest error is proven by an independent technical report compliant with industry standards.

93.12. School Notices as an Entity: Correspondence sent to the registered administrative email of the school/School Principal/Contract Officer is considered notice to the school as an entity. The school may designate alternative specific channels within the account.

93.13. Mutual Legal Notices: Legal notices to the Company are sent to [email protected] with a copy to the dashboard. Where official contact data provides a physical address, it is accepted for paper notices, with a delivery stamp or courier confirmation being relied upon.

93.14. No Oral Notice: Telephone communications alone are insufficient to prove legal notice unless supplemented by written notice via one of the approved channels above.

93.15. Terms/Policy Amendments: Substantive amendments are notified via the approved channels, and express in-product acceptance may be required before continued use of Core Features, according to the Express Acceptance Clause. Continued use after the notice becomes effective constitutes acceptance of the amendments, to the extent permitted by law.

94.1. Scope of Approved Channels: "Communication Channels" means the registered email, in-platform and dashboard notifications, SMS, recorded phone calls, push notifications, and/or approved third-party messaging channels (e.g., WhatsApp) where available and compatible with the service provider's terms.

94.2. Service and Marketing Communications: You agree to receive communications necessary for providing the Service (activation, security, billing, outages, compliance). Marketing communications are sent only based on revocable consent according to (32–33), and their withdrawal does not affect essential service notices. Preferences can be managed from account settings/unsubscribe links.

94.3. Notice Deemed Received: Notice is considered received according to (71–72) upon sending to the registered email or publishing in the dashboard, whichever is earlier. You are responsible for updating contact details.

94.4. Forwarding Correspondence to the Intended Party: When using in-platform communication tools to contact an educational institution/teacher/partner, you authorize the Establishment to forward your message and necessary contact data to the intended party for reply and execution. You are solely responsible for the content of your correspondence and any subsequent interaction with that party. The Establishment does not guarantee that party's response or content and is not liable for dealings or obligations arising between you and them outside the Platform.

94.5. Recording and Monitoring for Legitimate Purposes: To the extent permitted by law and consistent with the PDPL, the Company may record/monitor support communications via approved channels for support, quality assurance, security, and compliance purposes, applying data minimization and access control principles. Records are managed according to Appendix 2 — Retention and Deletion, and are not used for marketing purposes except with separate consent.

94.6. Conduct Restrictions on Channels: Misuse of channels (sending spam/violating content/incitement/malicious links/identity fraud) is prohibited. The Company may restrict/suspend the account according to the disciplinary scale (16) and Community Policy Appendix (82).

94.7. No Guarantee of Delivery via Third Parties: The Establishment is not responsible for delay/interruption/failure in delivery attributable to telecommunications/email/internet providers or messaging channels outside the Establishment's control.

94.8. Liability Limits: Any claims related to communications are subject to the liability limits in (85). This does not affect your mandatory rights that cannot be contractually violated.

94.9. Survival: The provisions of this clause remain in effect after termination to the extent necessary to enforce records, auditing, and compliance.

95.1. Scope of Technical Authority: The Establishment's internal system records (monitoring, automation, status dashboard, infrastructure logs, Rate-Limiter, WAF, SMTP Headers) are considered a reliable reference for proving availability, outages, response times, request loads, and circumvention attempts. This paragraph is read with the Availability and SLA clauses without prejudice.

95.2. Standard of Rebuttal (Manifest Error): The records' findings are only rebutted by proving manifest error via an independent, specialized technical report using a measurement methodology compliant with industry standards (including measurement source, timing calibration, traffic samples, and proof of equivalent conditions). The evaluator must be independent of the parties and possess recognized professional qualifications.

95.3. Counter-Measurement Controls: Only measurements conducted from supported locations and environments, within published technical requirements, and using neutral measurement tools that do not cause disruptive load are considered. Measurements from Bots/Proxies/Headless or bypassing rate management are not accepted.

95.4. Timing Consistency and Time Reference: Timestamps are calculated according to the time zone of the Kingdom of Saudi Arabia (UTC+03:00) based on synchronized time sources (NTP). In case of conflict between a third-party timestamp and Platform records, Platform records prevail unless manifest error is proven according to the standard above.

95.5. Technical Clarification Requests: The school — upon reasonable dispute — may request a brief clarification including relevant log excerpts with masking of any personal/security data. This is provided within a reasonable period and under confidentiality.

95.6. Exclusions from Outage: Cases of pre-announced maintenance, force majeure, telecommunications provider outages, third-party service failures outside the Establishment's control, and misuse/non-compliance with published technical requirements are excluded from measured outage.

95.7. Notice Effect and Receipt Time: Notice is considered received upon publication in the dashboard or sending to the registered email, whichever is earlier. In case of email bounce, the notice remains effective from the time of publication in the dashboard.

95.8. Responsibility for Updating Contact Data: The Client must update the contact email and SMS number designated for notices within the account. Any failure to do so does not affect the effectiveness of notices sent to the latest data registered with the Establishment.

96.1. Reasons for Suspension/Termination: The Company may, without liability, restrict, suspend, or terminate access wholly or partially upon: (a) breach of Terms, Policies, or technical requirements, (b) reasonable suspicion of payment fraud/Chargeback, illegal activity/security risks, (c) non-payment after due date, (d) legal obligation, competent authority order, or compliance requirements. This includes blocking IP addresses/devices and disabling API integrations.

96.2. Non-Payment and Delay: Service is automatically suspended when payment is delayed (15) days from the due date. Reactivation is possible after payment. No extension or compensation is provided for the suspension period, and fees remain due in full. The Company has the right to continue collecting due amounts and take legal collection actions.

96.3. Notice and Cure Period: Notice is sent to the School/User according to the Notices Clause, with a cure period of no less than (5) Business Days before termination, unless urgent security/legal necessity dictates otherwise, or there is an imminent serious risk; in such cases, immediate suspension is possible, followed by notice.

96.4. Effect of Suspension/Termination on Fees: Any suspension or termination resulting from the User/School's breach or non-compliance with technical requirements does not entail a refund. Paid fees are final and non-refundable, and unpaid fees remain due in full for the contracted period, to the extent permitted by law.

96.5. No Refund for Previous Periods: Any termination — regardless of its cause — does not create a right to a monetary refund for periods already served. The effect is limited to relief from future fees for the unserved period (if any) according to these Terms.

96.6. Data Retrieval and Export: Upon suspension or termination not related to a competent authority order or an ongoing serious breach, the User/School — unless restricted by security or legal considerations — is given a reasonable period to export the "Smart Educational Profile" and its data in CSV/JSON/PDF format via export tools, provided dues are settled. Retention and deletion periods in Appendix 2 apply. Remaining data is masked/deleted according to the backup cycle (30–90 days).

96.7. Survival of Clauses After Termination: Clauses regarding Intellectual Property, Confidentiality, Information Security, Liability Limits, Indemnification, Disclaimers, Exclusivity of Remedy and SLA, Governing Law and Jurisdiction, Dispute Resolution Sequence, Notices, and Privacy and Retention Appendices survive suspension/termination.

96.8. Orders and Compliance: If a competent authority requires service suspension or processing restriction, it is implemented immediately without liability on the Establishment, and the Client is notified where permitted.

96.9. Marketing to Minors: Direct marketing to minors is prohibited except with revocable Guardian consent (according to the Consent clauses). Withdrawal of consent does not affect the effectiveness of essential service notices.

96.10. Objection Path: The School/User may submit a written objection to the suspension decision within (5) Business Days of the notice. The Establishment decides within a reasonable period. Suspension remains in effect pending the decision if there is a security risk or legal obligation.

96.11. Link to Disciplinary Scales: This clause does not prejudice the disciplinary measures scale (warning → temporary restriction → suspension → termination). The Company may proceed directly to the appropriate measure for serious violations or security risks.

96.12. Handling Bank Disputes: Initiating a bank dispute or chargeback without a legal basis is a material breach justifying suspension/termination and claiming dispute processing fees and collection costs, with full fees remaining due and authorization for the Establishment to share necessary documents to defend the dispute with the payment processor.

97.1. Scope of Right: The Establishment reserves the right to amend, update, or replace the Terms, Policies, Services, and Benefits wholly or partially, including adding new features or discontinuing existing features, to the extent permitted by law.

97.2. Effective Date and Notice Means: Each amendment is given a clear Effective Date and announced via approved notification channels (in-platform/dashboard/registered email). Notice is considered received upon publication or sending according to the Notices Clause. The "Last Updated" date appears on the Terms page.

97.3. Acceptance and Continuation: Non-substantive or clarificatory amendments become effective on the announced Effective Date. Continued use of the Service after that constitutes acceptance. For "Substantive Amendments" affecting fundamental rights or obligations, express acceptance (Clickwrap) is re-requested upon the next subsequent login, with a timestamp and IP address/device ID, as stated in the Acceptance Clause.

97.4. Limits of Amendment Within a Paid Subscription Period: The Establishment does not make a change that materially diminishes a paid core function within the current paid subscription period except for security/legal/compliance reasons or to avert serious risks to security or privacy, with reasonable prior notice. In such cases, the remedy is limited to: (a) waiver of future fees for the affected feature for the remaining period, or (b) non-cash Service Credits according to the SLA; no right to a monetary refund arises.

97.5. Beta Features/Discounted Offers: Beta features or free/discounted offers are outside the core subscription. They may be suspended, modified, or withdrawn at any time without any commitment to continuity or specific performance. Error logs may be collected for support and improvement purposes. Withdrawal/modification of Beta features does not create a monetary refund; the maximum remedy is future suspension or limited credits/waivers as above.

97.6. Price Changes: Price changes do not apply within a paid subscription period. They apply only to subsequent renewal after reasonable prior notice (no less than 15 days unless exceptional circumstances require), and continued use after the Effective Date constitutes acceptance of the new price.

97.7. Obligation to Cease Upon Non-Acceptance: If the User/School does not agree to an effective substantive amendment, they must stop using the Service before the Effective Date or immediately upon the first request for acceptance. Continued use constitutes acceptance. If an individual User (B2C) refuses a substantive amendment affecting their fundamental rights, they have the right to terminate for the future with a non-cash Service Credit equivalent to the pro-rata value of the remaining unused period, to be consumed during the subscription period and not converted to cash.

97.8. No Refund and Exclusivity of Remedy: All fees are final and non-refundable after activation/first successful login, to the extent permitted by law. For any failure related to Service Levels — including "Material Defect" — the sole and exclusive remedy is Service Credits according to the SLA/future waivers as applicable, non-exchangeable for cash and not used to extend the period.

97.9. Precedence of Terms and Purchase Orders: The provisions on non-refundability and exclusivity of remedy herein prevail over any conflicting text in Purchase Orders/vendor terms or similar documents unless a specific appendix expressly conflicting is signed.

97.10. Assignment and Corporate Restructuring: The Company may — without consent — assign this Agreement to a branch/subsidiary or in the context of a merger/acquisition/restructuring, with reasonable notice. No right to refund arises. The School's right — if available by law — is limited to future termination only.

97.11. Policy Consistency: Any amendment affecting privacy, data transfers, or sub-processors is managed according to the Data Transfer/Processor clauses (§34–§36) regarding notice and reasonable objection right, without prejudice to the exclusivity of remedy and non-refundability.

97.12. The Establishment reserves the right to update/correct/modify: Terms of Use, Privacy/Cookie Policy, support documentation, feature operation mechanisms, interface form and design, and communication channels, updating the Effective Date/Last Updated of the current contract, to the extent permitted by law.

97.13. Non-Substantive Amendments (editorial/clarificatory/improvement not diminishing a paid function or changing material obligations): May be implemented without prior notice. Continued use after the Effective Date constitutes acceptance.

97.14. Substantive Amendments (paid scope/rights/obligations/price/data transfer/legal basis for processing):

97.15. Reasonable prior notice is provided via the dashboard/email before effectiveness (e.g., ≥15 days, unless urgent security/legal necessity dictates otherwise).

97.16. Express acceptance (Clickwrap) is requested upon the next login, and the acceptance record is kept in an audit repository.

97.17. Privacy and Data Transfer: Any amendment affecting a legal basis for processing or adding a processing category/cross-border transfer is managed according to the DPA/Privacy Policy, with prior notice and a reasonable right to object for schools and consent/withdrawal options for individuals, without prejudice to mandatory rights.

97.18. Protection of Paid Benefits During the Period: No change that materially diminishes a paid core function is made during the subscription period except for security/legal reasons with reasonable notice. The remedy is limited to what is stated in the SLA (Service Credits), without monetary refund.

97.19. Prices: Any price adjustment applies only to subsequent renewal and does not affect the current paid period unless otherwise agreed in writing.

97.20. Non-Acceptance: If the educational institution does not agree to a substantive amendment after notice, it must stop using the service. The effect of termination is limited to the future. Data portability is available within (30) days in CSV/JSON formats according to the Retention Appendix, without any monetary refund for periods already served.

97.21. Precedence: In case of conflict, documents prevail in this order: (1) Purchase Order/School Agreement, (2) DPA, (3) SLA, (4) these Terms, (5) Privacy/Cookie Policies.

97.22. Notice Channels: Notice is considered received upon publication in the dashboard or sending to the registered email, whichever is earlier. The Client is responsible for updating contact data.

98.1. Reference Scope: Materials published on the Platform (text, descriptions, tables, in-product messages, pricing, promotional offers) may contain typographical/technical/calculation errors or omissions. The Establishment reserves the right to correct such errors, update, or supplement content at any time without prior notice, to the extent permitted by law and without any obligation for compensation, without prejudice to your mandatory rights.

98.2. Manifest Error: A clear and obvious error to a reasonable person (e.g., a price of "0/1 SAR" or an unreasonable discount from a system glitch, or a feature description contradicting contractual documentation). The Company has the right to correct/invalidate any request, offer, or content affected by the manifest error before or after acceptance, with the financial impact handled as follows:

98.3. B2B (Schools): Future relief/invoice adjustment or non-cash Service Credit where applicable according to the SLA, without any monetary refund for periods already served.

98.4. Individuals (B2C): If the correction has a substantial effect before consumption, cancellation for the future without penalties is possible, without prejudice to any mandatory rights conferred by law.

98.5. Document Precedence: In case of conflict between marketing material or website description and the Purchase Order/School Agreement/appendices (SLA/DPA/Privacy Policy), the contractual documents prevail.

98.6. No Guarantee of Content Reliance as Professional Reference: Educational/guidance materials remain advisory according to (28 and 69) and may be inaccurate or incomplete. Verification is required before any professional/commercial use.

98.7. Substantive Updates and Notice: If the correction materially diminishes a paid function or changes an existing contractual price/scope, reasonable notice is provided according to (71–72) before effectiveness, unless urgent security/legal necessities dictate otherwise.

98.8. Archived/Cached Copies: Archived/cached copies may persist for a period. The active Arabic version on the Terms, Appendices, and Update Log pages is the binding reference.

98.9. Reporting Channel and Review Period: Editorial error reports are sent to [email protected] or via a ticket from the dashboard. We review reports within 5 Business Days for non-security materials, with urgent handling for anything likely to materially mislead.

98.10. Liability Limits: Any claims related to errors/corrections are subject to liability limits and non-liability for indirect losses, to the extent permitted by law.

99.1. Scope of Right: The Establishment reserves — to the extent permitted by law — the right to modify or discontinue any service/feature (e.g., "Study with Me" or gift/point programs) wholly or partially, or add new features for a fee or free, without an obligation to compensate or create an expectation of continuity.

99.2. Distinction from Core Subscription: Optional features, promotional offers, and Beta features are outside the core subscription and do not create any performance or permanence expectations. They may be withdrawn or modified at any time without a monetary refund.

99.3. Beta Features and Logs: Beta features may be unstable or intermittent. Error/telemetry logs may be collected for support and improvement purposes according to the Data Protection (DPA) and Retention (Appendix 2) appendices and in compliance with PDPL. These features are clearly labeled within the product.

99.4. Notice of Material Change: Before any material change that diminishes a paid function during an existing subscription period, reasonable prior notice is provided (no less than 15 days where possible). Exemptions are made for urgent security/legal/compliance necessities.

99.5. Effect of Change Within a Subscription Period: When a material change is made for security/legal reasons, the remedy is limited to: (a) waiver of future fees for the affected feature for the remaining period, or (b) non-cash Service Credits according to the SLA; no right to a monetary refund arises.

99.6. Adding Paid Features: Adding paid features or converting a free feature to a paid one does not apply to ongoing paid periods. It applies only upon subsequent renewal after reasonable prior notice. Continued use constitutes acceptance of the new price/terms.

99.7. Data Management Upon Cessation: When a feature affecting User content/data is discontinued (if any), the Establishment allows exporting data in a standard format within a reasonable period, and retention and deletion periods in Appendix 2 apply.

99.8. No Refund and Exclusivity of Remedy: All paid fees are final and non-refundable after activation/first successful login. Any failure related to Service Levels has Service Credits/future waivers as the sole remedy as applicable, non-convertible to cash and not used to extend the period.

99.9. Order of Precedence: Precedence applies as follows: (1) Signed Purchase Order/School Agreement, (2) DPA for privacy matters, (3) SLA, (4) these Terms, (5) Privacy/Cookie Policy. Any terms in an unsigned Purchase Order, vendor portal, or pre-printed documents have no validity unless incorporated into a specific signed appendix expressly contradicting these Terms.

99.10. Non-Enforceability of Refund/Termination for Convenience Clauses: Any "cash refund" or "termination for convenience" clauses included by the Client in Purchase Orders/procurement systems do not apply except through an express signed appendix. No amount is paid for periods already served in any case.

100.1. Entire Agreement: These Terms, their appendices, and the signed Purchase Order/School Agreement constitute the complete and final agreement between the parties regarding the Service, superseding and replacing any prior oral or written offers, correspondence, or understandings on the same subject, without prejudice to any mandatory legal obligations.

100.2. No Reliance: No reliance is placed for the interpretation of the contract on any marketing offers or correspondence not expressly stated in this Agreement or its signed appendices.

100.3. Formal Amendment: No provision of these Terms is amended except by a written and express appendix signed by both parties, without prejudice to the Establishment's right to make published updates according to the "Right to Amend and Notice" clause and its notice and acceptance mechanisms.

100.4. Order of Precedence in Case of Conflict: Precedence applies in the following order: Signed Purchase Order/School Agreement; Data Processing Agreement (DPA) for privacy and processing matters; Service Level Agreement (SLA) for service levels and credits; these general Terms; Privacy Policy and Cookie Policy.

100.5. Privacy and Security: The Data Processing Agreement (DPA) prevails over any other text in all data protection and PDPL compliance matters (including data categories, legal bases, incidents, and retention). For cybersecurity, retention, and technical deletion, the Security Policy/Appendix (if any) and Retention Appendix (Appendix 2) prevail over the general Terms.

100.6. Interpretation Rule: These Terms are interpreted according to their fair meaning and commercial purposes, without applying the rule of interpretation against the drafter, and without prejudice to the "Arabic language is the governing text" clause.

100.7. Partial Invalidity: If any provision is found invalid or unenforceable, the remaining provisions remain valid and effective to the extent permitted by law, replacing the invalid provision with a text closest to its commercial intent.

100.8. Non-Enforceability of Unilateral Terms: Pre-printed terms in Purchase Orders, vendor portal terms, or general referrals do not apply unless incorporated into an express written and signed appendix explicitly contradicting these Terms and their order of precedence.

100.9. Refund/Termination for Convenience Clauses: Any text granting a cash refund or "termination for convenience" is not effective unless in an express signed appendix as above. However, no amount is paid for periods already served.

100.10. No Implied Waiver: Any delay or failure to exercise a right does not constitute a waiver thereof. Any waiver must be written, express, and signed.

101.1. Scope of Service within the Kingdom: The Service is provided to Users within the Kingdom of Saudi Arabia. The Company may apply technical geographic controls (e.g., geographic blocking/payment method verification/IP address restrictions) to ensure this scope.

101.2. Use from Outside the Kingdom: Any access or use from outside the Kingdom is considered subject to Saudi law and the exclusive jurisdiction of Saudi courts, without prejudice to any technical controls applied by the Establishment or local regulatory obligations in the countries of access.

101.3. Applicable Law: This Agreement and all disputes or claims arising out of or relating to it are governed by the laws in force in the Kingdom of Saudi Arabia, excluding conflict of law rules that might refer to another law.

101.4. Exclusive Jurisdiction: The competent courts in Dammam, Kingdom of Saudi Arabia, have exclusive jurisdiction for the Client to hear any dispute or claim arising from or relating to this Agreement. This determination prevails over any conflicting previous text. The parties waive any objection to forum non conveniens or any request to transfer the case to another court.

101.5. Regulatory Orders and Local Compliance: The Service is provided according to Saudi regulatory requirements and controls. Any official orders or directives in force within the Kingdom take precedence. No obligation arises for the Establishment to enable access from outside the announced geographic scope.

101.6. Partial Invalidity: If any provision of this or other clauses is found invalid or unenforceable, the remaining provisions remain valid and effective to the extent permitted by law, replacing the invalid provision with a text closest to its commercial intent and achieving the same regulatory balance.

101.7. No Waiver: The Establishment's delay or failure to exercise any right or power under this Agreement does not constitute a waiver thereof or of any other right. Any waiver is effective only if written, express, and signed by the authorized party.

101.8. Primacy of the Arabic Language: The provisions of this clause and the rest of the Terms are interpreted according to the governing Arabic text. Any translation is for convenience only without binding effect in case of conflict.

101.9. This Agreement and all its derivatives are subject to the laws of the Kingdom of Saudi Arabia. The exclusive jurisdiction for hearing any executive or substantive dispute arising from or related to it is the courts of Dammam.

101.10. The foregoing does not prejudice the Establishment's right, and only its right, to resort to any competent judicial authority outside the Kingdom to seek or enforce protective measures/urgent injunctions to protect rights in intellectual property, trade secrets, system security, or data when the infringement or its effects occur within the territory of that judicial authority.

101.11. Exercising the above right does not constitute a waiver of the exclusive jurisdiction of the Dammam courts over the merits. Substantive claims and damages remain within the jurisdiction of the Dammam courts.

101.12. Severability: If any provision is held invalid or unenforceable, the remaining provisions remain valid, and the invalid provision is replaced with a text closest to its original purpose, to the extent permitted by law.

101.13. No Waiver: The Establishment's delay or temporary failure to exercise any right does not constitute a waiver thereof, nor does the partial exercise of any right prevent its later exercise or the exercise of any other right.

101.14. The Client may only bring actions before the Dammam courts. Using the Service from outside the Kingdom does not create an alternative jurisdiction.

102.1. Appointment and Status: The Establishment appoints — where required by law or appropriate for the nature of processing — a Data Protection Officer with functional independence and no conflict of interest, granted sufficient access rights to oversee compliance.

102.2. Dedicated Communication Channels: Email [email protected], and the "Privacy Requests" form within the account. Active channels are published in the Privacy Policy and updated upon any change.

102.3. Scope of Use: These channels are used exclusively for data subject rights (access/rectification/deletion/objection/portability), privacy complaints, notifications to competent authorities, and inquiries from schools acting as controllers/processors under the DPA.

102.4. Outside Scope: DPO channels are not for technical support, billing, or refund requests; these are forwarded to general support channels without undue delay.

102.5. Verification and Agency: Identity verification uses OTP, valid document, or trusted school channel. Minor representation is through a proven Guardian. Requests by proxy require valid and acceptable authorization.

102.6. Request Requirements: The requester must include the type of right requested, data/time scope, account/school number, and a contact method for the reply. We may request additional information to identify relevant records.

102.7. Response Deadlines: Requests are processed within a reasonable period not exceeding 30 days from the completion of identity verification, with the possibility of one extension of a similar period for complex requests with a reasoned notice of the extension.

102.8. Confidentiality and Security of Correspondence: Channels are technically secured (TLS) and requests are handled confidentially according to "Appendix 2 — Security and Retention." Sending passwords or 2FA secrets via email is prohibited. A secure upload channel is provided for sensitive documents.

102.9. Audit Log and Retention: An immutable log of rights requests and dealings with competent authorities is created. Retention and deletion periods in "Appendix 2" apply.

102.10. Security Incidents: Initial notifications of data incidents are sent via the announced security channel (e.g., [email protected] or dashboard) with a copy to the DPO when personal data is affected, consistent with Clause (44) "Data Breach Notification."

102.11. Coordination with Competent Authority: The DPO coordinates responses to government/law enforcement requests related to data according to Clause (37), with the principle of minimum disclosure and after internal legal review.

102.12. Compliance Support for Schools: The DPO provides professional guidance to schools on processing bases, ROPAs, DPIAs, data transfers, and receives school objections on adding sub-processors according to Clause (35).

102.13. Fees and Limits: Data rights are processed free of charge, unless requests are repetitive or excessive. In such cases, a reasonable fee may be imposed or the request refused, with an explanation of reasons, as permitted by law.

102.14. Working Hours and Acknowledgment: Reports are received around the clock. An acknowledgment of receipt is sent within two Business Days during official working hours within the Kingdom. Urgent cases related to security incidents are handled via the emergency path.

102.15. Language: Arabic is the governing language for communication and responses. Correspondence in English is accepted for convenience without binding effect in case of conflict.

102.16. Delegation and Follow-up: The DPO may delegate some tasks to the compliance team while remaining responsible for overall supervision and response quality. Escalation to the internal legal counsel may be requested when necessary.

103.1. Legal Entity: Qader 3aididak Alali Establishment, Commercial Registration No.: 7050636419, Head Office: Al Khobar, Al Olaya, Bseil Tower, Floor 2.

103.2. Official Website: https://Qader.vip

103.3. Help/Support Center: https://qader.vip/contact

103.4. General Support Channels: Email [email protected]

103.5. — In-app chat — Tickets via the "Help Center." For individuals: "best effort" without a commitment to a specific response time; for schools: according to the SLA (Clause 84).

103.6. Billing and Collection Channels: [email protected]

103.7. For invoices, payment receipts, tax adjustments, and inquiries about Purchase Orders.

103.8. Legal and Official Channels: [email protected]

103.9. For serving legal notices and contracts, according to "Service Notices" (Clause 69). Social media is not a valid channel for legal notice.

103.10. Security and Abuse Channels: [email protected]

103.11. For reporting security vulnerabilities (according to the Responsible Disclosure Policy in Clause 39), and [email protected]

103.12. For reporting abuse/harassment/violating content (Clause 45).

103.13. Data Privacy (DPO): [email protected]

103.14. And the "Privacy Requests" channel within the account for data subject rights (Clauses 42–43 and 76).

103.15. Partnerships and Media Channels: [email protected]

103.16. For institutional collaborations, [email protected]

103.17. For media inquiries.

103.18. Phone/Customer Service: +966580590406 (Business Days: Sunday–Thursday, 9:00–17:00 KSA time). Calls may be recorded for quality and compliance.

103.19. Working Hours and Public Holidays: The Establishment follows the official calendar within the Kingdom (Timezone: Asia/Riyadh). Urgent security requests are handled via the security channel around the clock.

103.20. Accessibility: We provide suitable communication alternatives for people with disabilities (email/chat/phone) and strive to align interfaces with WCAG principles through reasonable efforts (Clause 6).

103.21. Proper Use of Channels: Each channel is designated for its purpose. Requests sent to non-matching channels (e.g., billing issues sent to general support) may be redirected without undue delay.

103.22. Updating Contact Data: The Client/School is responsible for updating contact details registered within the account. Notices are considered received according to the mechanism in Clause 69 upon sending to the registered email or publishing in the dashboard.

103.23. Physical Mailing Address: Al Khobar, Al Olaya, Bseil Tower, Floor 2, Office 221. Designated for official correspondence only.

103.24. Limit of Liability for Guidance: Responses from support channels are operational/general educational support and are not binding legal or academic advice (Clauses 6 and 67).

103.25. Channel Changes: Channels/addresses may be updated, or new channels added, with reasonable notice via the website/dashboard, without affecting the "Notices" mechanism (Clause 69).

104.1. Scope and Definitions: This appendix applies to the processing of student/teacher/parent data within the "Qader" Service. Terms (Controller/Processor/Sub-processor/Sensitive data/Minor) are interpreted according to Saudi laws (PDPL) and what is stated in the general Terms. The Arabic version prevails.

104.2. Role Matrix (Controller/Processor/Joint): As a general principle, the educational institution is the "Controller" and the Establishment is the "Processor" for matters related to school accounts. The Establishment may be a "Joint Controller" exclusively for general community features or aggregated analytics where it determines the purposes. Scenarios are documented in the attached "Role Matrix."

104.3. School Registration (Student accounts via school identity): Educational Institution = Data Controller; Establishment = Processor for curriculum and assessment features; Establishment may be a Joint Controller for general community features according to the announced policy.

104.4. Individual Registration (Guardian/Student outside school framework): Establishment = Data Controller; Sub-processors according to the Sub-processors page.

104.5. Community/Public Posting Features: Establishment = Data Controller for what is published within the Platform; User is responsible for the legality of content.

104.6. Technical Support and Security Telemetry: Establishment = Data Controller/Processor depending on the nature of the data and purpose, according to the description in this appendix.

104.7. Processing Instructions and Adherence: The Establishment processes data only based on documented instructions from the educational institution and within the purposes of the Service. Any additional processing requires new instructions or an independent legal basis.

104.8. Data Categories and Minimum Scope: Only data necessary for operating the features is processed (account, educational activity, security telemetry) and limited in type and volume according to the data minimization principle. No biometric features are extracted, and no facial/voiceprint recognition is performed (Clause 29).

104.9. Processing Purposes and Legal Basis: Educational path personalization, performance measurement, security, aggregated statistics, and customer support. The educational institution provides the appropriate legal basis (consent/contract execution/legitimate interest/legal obligation) and manages rights requests for its students.

104.10. Processing Period and Location: The period is limited to the contract term and necessities thereafter according to the Retention and Deletion Appendix (Appendix 2). The default is processing within the Kingdom. Any cross-border transfer complies with controls in Clauses 34–35 and the "Data Flow Maps" Appendix (Appendix 6).

104.11. Information Security: The Establishment adopts reasonable security controls (encryption in transit and at rest, least privilege, quarterly permission reviews, logging and auditing, annual independent penetration tests) according to a flexible framework aligned with best practices and Clauses 39–40.

104.12. Sub-processors: An updated live list is published (to be created and published on qader.vip/sub-processors within thirty (30) days of the effective date of these Terms) with processors and country categories. The Establishment notifies the educational institution before adding a new processor with a 15-day notice and a reasonable, reasoned objection right (security/compliance). Obligations are contractually flowed down to processors.

104.13. Objection to a New Processor — Remedial Treatments: Upon a legitimate objection and unavailability of an alternative within 30 days, the remedy is limited to suspending/stopping the affected feature and relieving future fees only, with data export for relevant data; without any monetary refund for previous periods.

104.14. Assistance in Individual Rights: The Establishment assists the educational institution — as the controller — in responding to access/rectification/deletion/objection/portability requests within the specified deadlines (usually 30 days, extendable once) after identity verification (Clauses 42–43).

104.15. Minor Privacy and Guardian Consents: For school registrations, linking to school identity is considered evidence of obtaining Guardian consent according to the educational institution's policies, with the Establishment retaining an audit log. For non-school registrations, a minor's account is not created except after documented Guardian consent via OTP to a number in their name or a valid guardianship document and manual verification, with retention of timestamp/IP address/device ID.

104.16. Security Incident Notification: The Establishment notifies the educational institution and competent authorities — where applicable — within 72 hours of the "documented internal confirmation time" of the incident, with phased updates until closure, stating the impact and measures (according to Clause 44).

104.17. Auditing and Compliance: The right to audit is limited to recent third-party compliance reports/certificates (annually or upon material change) and control evidence. On-site visits are only with prior agreement and proportionate costs, without jeopardizing security controls or the confidentiality of other clients.

104.18. Cross-Border Data Transfer: Transfers only occur to countries/processors announced on the Sub-processors/Appendix 6 page, and through one of the PDPL legal means (binding contractual safeguards/legal exception/explicit consent), with reasonable prior notice and a right to object for schools.

104.19. Retention and Deletion: Periods and categories in Appendix 2 apply. Upon the end of the relationship or a verified request from the educational institution, data is deleted/masked within the specified periods, with backups removed within 30–90 days according to the backup cycle, documented in an audit log.

104.20. Confidentiality: The parties undertake to maintain the confidentiality of non-public information and not to use it except to execute the agreement, with exceptions for legal disclosure and regulatory obligations.

104.21. DPIA and Impact Reviews: The Establishment conducted a Data Protection Impact Assessment (DPIA) for minor data processing, updated annually or upon material change, available to the competent authority/educational institutions under confidentiality upon request. The Establishment assists the educational institution in any required DPIA/regulatory consultation.

104.22. Records of Processing Activities (RoPA): The Establishment maintains a RoPA relevant to schools. An excerpt is available upon a justified compliance request and under confidentiality.

104.23. Educational Institution Obligations: Providing the legal basis for processing, data accuracy, managing rights requests, and adhering to Platform policies. The educational institution indemnifies the Establishment for claims arising from its failure to obtain consents, manage rights, or misuse by its affiliated users, to the extent permitted by law.

104.24. Usage Restrictions and Redirection: Any instructions violating the law/PDPL/Platform security may be refused by the Company with a reason and suggestions for secure alternatives.

104.25. Document Precedence and Order of Priority: For privacy/processing matters, this appendix prevails over the general Terms in case of conflict, with the general order of precedence (Purchase Order/School Agreement ← DPA ← SLA ← General Terms ← Privacy/Cookie Policy) as in Clause 100.

104.26. Termination and Return/Export: Upon the end of the relationship, the Establishment allows the export of the "Smart Educational Profile" and relevant data in CSV/JSON format within a reasonable period, then deletion/masking according to Appendix 2.

104.27. No Sale of Data or Secondary Uses Without Consent: The Establishment does not sell personal data. Any secondary use requires separate revocable consent and does not affect essential service notices (Clause 31).

104.28. Government/Law Enforcement Requests: Disclosure only upon written, signed, and legal requests, to the minimum extent necessary, with notification to the educational institution/data subject where permitted (Clause 37).

104.29. No Waiver of Controls: Any compliance herein is not interpreted as a waiver of liability limits or exclusivity of remedies (Clauses 62–67). Financial remedy — where applicable — remains non-cash Service Credits according to the SLA.

105.1. Scope and Purpose: This appendix defines default retention periods for each data category, deletion/masking procedures, backup controls, deletion limits within models (memorization), and No-Mix/Differential Privacy options, consistent with the PDPL and data minimization principles.

105.2. General Rule Upon Expiry: Upon subscription or trial expiry, data is deleted or masked within the periods specified in this appendix, unless the law requires longer retention or a "Legal Hold" is issued.

105.3. Data Categories and Default Periods (subject to contractual adjustment with schools provided it does not compromise security/law):

105.4. Account and Core Identity Data (name, email, permissions, school identity linkage): Throughout the contractual relationship period + twelve (12) months after the end of the contractual relationship or last recorded activity for archiving/legal defense.

105.5. Student Learning and Educational Content Data (solutions, progress, notes, "Smart Educational Profile"): Throughout the subscription period for operational and internal improvement purposes, then masked/deleted upon school request or termination, with export available before deletion.

105.6. Operational Telemetry and Non-Security Usage Logs (application errors, performance, general metrics): Retained for a reasonable operational period for improvement and service stability, then masked/deleted.

105.7. Security Logs (security events, login/logout, permission changes, compliance logs): Twenty-four (24) months for investigation, compliance, and cybersecurity purposes.

105.8. Support Correspondence and Tickets: Twelve (12) months from ticket closure to support warranty/compliance claims, then masking/deletion.

105.9. Financial, Billing, and Tax Records: No less than five (5) years according to ZATCA and accounting law requirements.

105.10. Cookies and Similar Identifiers: According to the Cookie Policy (Cookie Appendix) and preference settings/consent withdrawal.

105.11. Aggregated or Anonymized Data: May be retained indefinitely for statistical and service improvement purposes, provided re-identification is not possible.

105.12. Backups: Backups are masked/deleted within 30–90 days according to the backup cycle. Execution is documented in an audit log; an excerpt is available to schools upon request.

105.13. Deletion/Masking Mechanisms: Standard deletion from production environments, followed by masking/deletion from backups within a 30–90 day window. Immediate deletion is exempted for items under "Legal Hold" or mandatory/security obligations.

105.14. Data Extraction Before Deletion: Portability is available in standard format (CSV/JSON/PDF) within reasonable technical limits before final deletion/masking, based on a verified request from the school or data subject.

105.15. Deletion Limits within Models (Model Memorization):

105.16. Statistical model learning may result in indirect retention of patterns; deletion is not understood to "erase" training traces from all existing parameters.

105.17. Available Mitigation Techniques: (a) No-Mix: not mixing school data in general training through isolation, (b) Differential Privacy for selected groups, (c) periodic retraining excluding deleted datasets where practical, (d) inference filters to prevent the release of identifiable data.

105.18. Disclosure and Choice: No-Mix/DP options are offered to schools if necessary, with an explanation of their impact on performance/cost/functions.

105.19. Alignment with Individual Rights: This appendix does not prejudice access/rectification/deletion/objection/portability rights (Clauses 42–43). Requests are processed within a reasonable period not exceeding 30 days from identity verification, with the possibility of one extension of a similar period for complex requests with notice.

105.20. Consistency of Periods with Security and Policy: In security and retention matters, this appendix and the Security Policy (if any) prevail. Any exceptional request to shorten/extend periods is subject to security risk and compliance assessment.

105.21. Execution Reliability and Documentation: Deletion/masking operations are performed through documented procedures with audit logs (date/time/scope/executor/result). An excerpt is available to schools upon a justified compliance request and under confidentiality.

105.22. Sub-processors: The Establishment uses binding contracts imposing retention, deletion, masking, and backup provisions on sub-processors no less than this appendix, especially the 30–90 day backup window, with reasonable notice and objection according to Clause 35.

105.23. Conflict with Legal/Investigative Obligations: When a legal obligation or effective judicial/investigative proceeding restricts deletion, the relevant data is frozen (Legal Hold) until the impediment ceases, then deletion is resumed according to this appendix.

105.24. No Waiver: Any longer retention than stated here is not interpreted as a waiver of the data minimization principle or data subject rights, but is compliance with a documented legal or security obligation.

105.25. Relationship of this Appendix to Other Documents: For retention/deletion/backup matters, this appendix prevails over the general Terms in case of conflict, with the general order of precedence in Clause 100.

106.1. Scope and Application: This policy applies to all community spaces within the Platform (discussions, posts, comments, private messages, groups, "Study with Me" feature, "Streak" system) and to any interaction generated via AI features within them. It is a complementary part of the general Terms (refer to Clauses 12, 14, 18, 45).

106.2. Hosting Principle and Disclaimer: The Platform is a host that does not conduct prior review of all materials. The User is solely responsible for the legality of their content and permissions. The Establishment reserves the right to remove/suspend without compensation when content violates this policy or the law, to the extent permitted by law.

106.3. Posting and Interaction Rules: Publishing or promoting any material that violates the law, the rights of others, or minor safety is prohibited. Respect and non-abuse are required. Collecting or sharing personal data of others without a legal basis or explicit permission is prohibited.

106.4. Prohibited Content (Non-Exhaustive Examples):

106.5. Hate speech, discrimination, incitement to violence or terrorism, or glorification of crime.

106.6. Exploitation, abuse, or any sexual content concerning or suggestive of minors; pornographic or child sexual abuse material is strictly prohibited.

106.7. Bullying, harassment, threats, blackmail, or revealing sensitive information (Doxxing).

106.8. Publishing viruses/malware, phishing links, or any attempt to breach the privacy or security of others.

106.9. Publishing exam solutions, leaks, or tools for cheating on exams/Platform, or enabling others to do so (refer to Clause 14).

106.10. Identity theft, false academic claims, or misleading users regarding qualifications/affiliations.

106.11. Unauthorized advertising or commercial promotion, spam, misleading incentive schemes.

106.12. Any content infringing intellectual property rights or neighboring rights.

106.13. Restricted/Tagged Content: The Platform may subject certain sensitive topics (religious/social/health) to additional controls, warning tags, audience/age restrictions, or blocking where required by laws and local values (refer to Clause 28).

106.14. Minor Protection: Minor safety reports are given highest priority. The Company may notify competent authorities and take immediate action including permanent termination and blocking devices/addresses, without prior notice when there is a serious risk.

106.15. Rapid Reporting Mechanisms: In-product reporting and dedicated support links are available. Reports are logged (time/channel/reporter/reported content/initial action). Reports are evaluated, and reasonable actions are taken promptly.

106.16. Intellectual Property Rights Reporting Form: The report must include: (a) notifier identity and contact, (b) valid authorization/agency if submitted on behalf, (c) accurate description of the protected work, (d) link/location of the infringing content on the Platform, (e) undertaking of the accuracy and good faith of the claim, with the understanding that a vexatious or misleading report may lead to suspension/blocking actions and claims for actual damages and processing costs against the reporter, to the extent permitted by law.

106.17. "Repeat Offender" Policy: The Establishment applies a repeat offender policy for intellectual property rights and safety violations. After proven repeated notices, the account may be suspended/terminated, devices/addresses blocked, and/or injunctive relief sought, along with recovery of actual losses and reasonable legal fees.

106.18. Disciplinary Measures Scale: (Warning) → (Feature/Visibility Restriction) → (Temporary Suspension) → (Permanent Termination). The Company may bypass stages and apply the appropriate measure directly for serious violations or safety/security risks.

106.19. Objection and Appeal: The User has an objection path regarding removal/restriction decisions via specified channels. A decision is made within a reasonable period after identity verification, without stopping the removal action taken to protect the community/compliance.

106.20. Transparency and Documentation: Removal/restriction decisions are briefly communicated, explaining the reason where possible without compromising investigation/safety. The Establishment keeps a policy decision log for auditing and compliance.

106.21. Role of Schools as Supervisors: In school-managed spaces, supervisory roles are granted to the School Principal/Teacher within controlled permissions. The Establishment remains the final authority for enforcement at the Platform level.

106.22. AI-Generated Content: Model outputs within the community are subject to this policy. Using them to fabricate academic evidence/publish misleading information/infringe third-party rights is prohibited. The educational use must be stated, and they must not be presented as professional advice (refer to Clauses 21–27).

106.23. Non-Compliance Does Not Grant Compensation: Enforcement of this policy (including removal or suspension) does not create a right to any compensation or refund, and this remains to the extent permitted by law and consistent with the fees and non-refundability clauses.

106.24. Updates and Effect: This policy may be updated with a stated Effective Date. Continued use constitutes acceptance. For substantive changes, reasonable notice is provided via specified channels (refer to Clause 69).

107.1. Purpose and Scope: This appendix defines the governance principles for AI models used on the Platform, personalization methodologies, transparency and "Right to Explanation" requirements, fairness and bias mitigation controls, objection and human review paths, and liability limits, to the extent permitted by law and considering PDPL, NCA frameworks (ECC/CCC), and relevant education policies.

107.2. Model Sources and Roles: Internal models and third-party models may be used within the DPA framework (Appendix 1) and Data Flow Map (Appendix 6). The Establishment is a Joint Controller for general community features and a Processor for features delegated by the school, according to the scenario in the "Role Matrix" in the DPA.

107.3. Personalization Methodologies and Input Data: Personalization relies on student performance data within the Platform (attempts, time, error patterns, learning sequence, interaction signals) and contextual data provided by the User/School. No biometric features are extracted, and no facial/voiceprint matching is performed. Using media for non-educational purposes without explicit, revocable consent is prohibited.

107.4. Training and Reuse Limits: Minor educational data is not used to train general models outside the purpose of providing the Service except with explicit, documented consent from the school/Guardian, or after anonymization/aggregation according to data minimization, in a way that does not allow re-identification. No-Mix/Differential Privacy options are activated where the infrastructure supports them (refer to Appendix 2 and Appendix 6).

107.5. Transparency and "Right to Explanation": Brief explanations of "why this recommendation appeared" are provided to the Student/Teacher in simplified Arabic (proficiency factors, difficulty, prior errors). Upon request, a high-level technical summary is provided describing the methodology without disclosing proprietary secrets or compromising security.

107.6. Decisions Affecting Minors: No decisions with material academic impact on minors are made by automated means exclusively. A binding objection and human review path is available within (7–10) Business Days of a verified request, with a written summary provided to the School/Student explaining the outcome and reason, documented in an objection log for auditing.

107.7. Objection and Human Review (HITL): Objections can be submitted via the dashboard/specified channel. The Establishment refers the objection to an educational/technical specialist. A Manual Override is applied when necessary (modifying recommendation/path/difficulty/timing), with recording of the reviewer, time, reason, and scope of impact.

107.8. Impact and Fairness Measurement: Periodic fairness tests are conducted before and after deployment to measure potential biases (by grade level/language/device/network speed), without using sensitive individual attributes except where permitted by law and for protection/fairness. Methodologies, results, and remediation plans are documented, reviewed annually or upon material change.

107.9. Monitoring and Drift/Performance: Performance drift and recommendation quality are continuously monitored. Alert thresholds are defined for stopping/rolling back (Rollback) a version when risk indicators are exceeded, with clear technical/legal escalation channels.

107.10. Version and Change Management: Each model version/recommendation rule is recorded in a Model Registry with version number, effective date, change summary, and expected impact. Beta features are clearly tagged, and schools can deactivate them. They do not create continuity or performance expectations.

107.11. Safety Filters and Content: Policies against harmful and violating content (Appendix 3) are applied. Models prevent or minimize outputs related to violence, hate, suicide, exploitation, leaking exam solutions, or academic cheating.

107.12. Output Accuracy and Reliance Limits: Recommendations/outputs are advisory and may be inaccurate. They are not professional advice, and freedom from third-party rights or absolute accuracy is not guaranteed. The User is responsible for review before publication/commercial use (refer to Clauses 23 and 27).

107.13. Display of Confidence Indicators: Where possible, approximate confidence scores/certainty levels are displayed for recommendations, with the ability to adjust sensitivity for the Teacher within a safe range.

107.14. Model and Data Security: Data is protected by restricted access controls, encryption in transit and at rest, and annual independent penetration tests (refer to Clauses 39 and 40). Retention and deletion schedules in Appendix 2 apply.

107.15. Privacy and Data Sovereignty: The default is hosting within the Kingdom. Any sending to an external model provider is subject to Appendix 6 (Sub-processors/Data Flows) and lawful transfer mechanisms, with prior notice and a reasonable right to object for schools before addition (Clause 35).

107.16. No Targeted Marketing to Minors: Using model signals for direct marketing to minors is prohibited except with revocable Guardian consent, without affecting essential service notices (Clauses 31–32).

107.17. Controlled Access for Schools: The school has the right to view aggregated reports on model performance for its students and request a copy of the review summary upon objection, within confidentiality and PDPL limits.

107.18. Academic Independence: The Platform prevents automated reliance on exam question predictions. Any "prediction" is presented as a general skills exercise, not relying on leaks or restricted data (refer to Clauses 48–49).

107.19. Auditing and Compliance Obligations: Third-party compliance reports/certificates are provided annually or upon material change. The educational institution may request them under confidentiality instead of on-site visits, as specified in Appendix 1.

107.20. Liability Limits: The general liability limits (Clause 63) apply to AI components, with no limit for liability for death/personal injury/intentional fraud, to the extent permitted by law. Termination/modification/cessation of AI elements does not create a right to a monetary refund; Service Credits — where applicable — are the sole and exclusive remedy for Service Level failures (SLA).

107.21. Field Training for Teachers: The Establishment provides guidance for the safe and fair use of models in the classroom. It is advised not to make final assessments based solely on automated output.

107.22. AI-Specific Incident Management: Quality/bias/safety incidents regarding AI outputs are recorded in a dedicated log. Affected parties are notified when necessary according to the notification framework (Clause 44), with correction and root cause handling plans.

107.23. Update and Effect: Any substantive changes to this policy are communicated to Schools/Users with reasonable notice and a clear Effective Date. Continued use constitutes acceptance of the update, with the right to withdraw from Beta features.

108.1. Purpose and Scope: This appendix establishes a binding framework to safeguard exam integrity within and outside the Platform, respect the rights of "Qiyas" and similar examining entities, and prevent any conduct leading to leaks, cheating, or circumvention, to the extent permitted by law.

108.2. Respecting the Rights of "Qiyas" and Examining Entities: Any availability, circulation, or request for exam content owned by official/private measurement/testing entities, or any use of their marks/materials that violates their rights, is prohibited. The Establishment does not claim any accreditation or partnership with "Qiyas" unless expressly stated.

108.3. Prohibition of Leaks and Statement of Non-Seeking: "We do not seek or accept leaks." Uploading, sharing, or promoting any material suspected of being leaked questions/answers, or requesting it, or enabling others to do so, is prohibited.

108.4. Rapid Reporting/Removal Path: The Platform provides an announced channel for reporting suspected materials (in-product reporting form/dedicated email). Upon reporting, the material is restricted within a reasonable period for review and removed promptly if serious suspicion is confirmed. The reporter and relevant user are notified of the outcome. Intentional vexatious reporting is subject to escalating actions according to the Community Policy (Appendix 3).

108.5. Permitted Content Sources: Including copied or secret question banks is prohibited. Exam content is limited to original/licensed materials or those created specifically for the Platform, or general unrestricted materials, with a reference to the source when necessary.

108.6. Building an Authentic Question Bank: Materials are built based on recognized skill maps and learning outcomes, using originally generated/authored questions (transformations, application scenarios, simulated data) that do not mimic protected exam texts. Provenance records are kept for each question and its versions.

108.7. Legitimate Prediction vs. Leaking: A clear distinction is made between "general skills exercises" and "leaking." Any "prediction" is framed as a general training scenario, not based on protected or covertly published materials, and is not presented as reflecting actual questions. When in doubt, content is excluded as a precaution (refer to Clauses 48 and 49).

108.8. Anti-Cheating and Circumvention Tools: The Platform supports technical and organizational controls (large question banks with rotation and obfuscation, random ordering, time windows, attempt limits, copy/paste prevention where possible, monitoring unusual usage patterns, device/address restrictions upon school request), without using facial/voiceprint recognition or biometric features (consistent with Clause 29).

108.9. Prohibition of Bypass Tools: Providing or using tools to bypass identity/time/attempt limits or headless browsers/rotating proxies during exams is prohibited. This is a serious violation warranting suspension or termination (refer to Clauses 13 and 14).

108.10. School and Teacher Obligations: The educational institution must define its test policies, set the exam environment, and report any suspected material to the Establishment. It may view aggregated integrity reports for its students within privacy limits.

108.11. Graduated Enforcement and Sanctions: A scale of procedures is applied (Warning → Restriction → Suspension → Termination), with the possibility of skipping to the appropriate level for severity or repetition. Violating materials are deleted/restricted without compensation. The Company may seek injunctive relief and recover actual losses and reasonable legal fees, to the extent permitted by law.

108.12. Cooperation with Competent Authorities: The Establishment cooperates in good faith with "Qiyas" and competent authorities regarding reports and legal requests, according to Clause 37 (Government Requests), with the principle of minimum disclosure.

108.13. Transparency and Awareness: The Platform displays guidance notices reminding of integrity policies before and during assessments and provides users with examples of prohibited behavior and reporting paths.

108.14. Liability Limits: The general liability limits (Clause 63) apply to this appendix. Removing violating content or terminating a suspicious session does not create a right to refund or compensation. The remedy — where the SLA applies — remains non-cash Service Credits only.

108.15. Appendix Updates: This appendix may be updated with reasonable notice and a clear Effective Date. Continued use constitutes acceptance of the update, with the school's right to stop relevant Beta features.

109.1. Purpose and Scope: This appendix defines where data is stored and how it flows between Platform components and sub-processors, what is sent (and what is not) to model providers/cloud services, considering data sovereignty within the Kingdom and the cross-border transfer framework, to the extent permitted by law.

109.2. Abbreviated Data Flow Map: An updated live "Data Flows / Sub-processors" page is available showing local/cloud services, server locations, data collection points, sending paths, transport protocols, and the purpose of each processing, updated periodically with a "Last Updated" timestamp.

109.3. Prior Notice and Commercially Reasonable Objection Right: We notify schools/educational institutions in writing before adding or replacing any new sub-processor with basic information about it. The Client may object for reasonable reasons within 10 Business Days of notification. In this case, we endeavor to provide a suitable alternative or isolate the processing subject to the objection. If this is not possible, the Client may terminate the affected part of the service without future penalties.

109.4. Storage Locations and Data Sovereignty: Default storage and availability are within the Kingdom of Saudi Arabia. Student/minor data is isolated from external systems where required by law or contract. No transfer outside the Kingdom occurs except according to this appendix and the Data Flows page.

109.5. Separation of Local and External: Core features and sensitive user instructions are processed locally wherever possible. When resorting to an external provider, sending is limited to the minimum necessary for the purpose, with anonymization or aggregation where technically appropriate.

109.6. Encryption and Key Management: Data is encrypted "in transit" and "at rest" with appropriate industry controls. Keys are managed through key management systems with least-privilege access controls and periodic auditing.

109.7. What is Sent to Model Providers: Educational input texts and limited excerpts may be sent for generation/correction/evaluation purposes, with direct identifying fields excluded where technically feasible and no biometric media sent. The scope of permitted categories is explicitly stated on the Data Flows page.

109.8. What is Not Sent: Government identification records, biometric features (facial/voiceprint recognition), payment data, login credentials, or protected exam content are not sent to model providers/cloud services.

109.9. No-Mix and Multi-Tenant Isolation: Each school/educational institution's data is logically separated via tenant identifiers and tiered access controls. One school's content is not used to personalize another school except with an explicit prior license and with appropriate masking/anonymization techniques.

109.10. Access and Audit Logs: Detailed logs of access and processing (who/when/what) are retained and reviewed periodically, with alerts for unusual patterns. Audit excerpts are available to schools upon request under reasonable confidentiality.

109.11. Sub-processor List and Prior Notice: The Establishment publishes a Sub-processors list and country categories on the aforementioned live page. B2B clients are notified before adding a new processor with a period of no less than 15 days.

109.12. Objective Objection Right and Procedures: The school has a reasonable right to object within 15 days for objective compliance/security reasons. The Company has up to 30 days to propose an alternative or mitigation path. Failure to object within the period constitutes deemed consent.

109.13. Transfer of Sensitive Minor Data: The default is storing and processing sensitive minor data within the Kingdom. No part of it is transferred outside the Kingdom except through a declared legal means (PDPL exceptions/binding contractual clauses/explicit consent) stated on the Data Flows page, with prior notice of no less than 15 days and a reasonable right to object for schools.

109.14. Absence of Local Alternative and Partial Termination Right: If a local alternative cannot be provided with commercially reasonable efforts, the School's sole remedy is to suspend/stop using the affected feature and be relieved of its future fees only, without any monetary refund for previous periods, with the ability to export relevant data in CSV/JSON format within 30 days.

109.15. Restrictions on Secondary Use: Sub-processors are prohibited from using data for any purpose other than providing the contracted service. They must apply equivalent security controls, confidentiality obligations, and process according to the Establishment's instructions.

109.16. Transparency of Data Categories: Categories are classified (account data, operational telemetry, educational content, results and assessments, support reports, security logs). For each category, the storage location, purpose, involved processors, and retention period (according to Appendix 2) are stated.

109.17. Minimization and Retention Controls: Data minimization and limited retention principles in Appendix 2 are applied. Backups are masked/deleted within 30–90 days according to the backup cycle, documented in an audit log.

109.18. Page Updates and Proof of Effect: Any material change in storage locations, sending paths, or the Sub-processor list is published on the live page with a clear Effective Date. Notification is sent within the dashboard/email to affected schools. Continued use after the Effective Date constitutes acceptance, with the school retaining the partial termination right as above.

109.19. API and SDK Integrations: Any non-essential SDK/integration is activated only after explicit consent (where required). Dropping unnecessary tracking identifiers before consent is prohibited (according to the Cookie Policy).

109.20. Reports and Transparency: Schools are provided — upon request — with a brief compliance/audit report or suitable certificate from a third party instead of on-site visits, under confidentiality.

109.21. Reference License for Name/Logo: The educational institution licenses the Company to use its name and logo as a client reference in client lists and presentations, according to trademark guidelines, without implying endorsement. This license may be revoked with written notice (30) days for the future only and without retroactive effect.

109.22. Liability Limits and Remedies: The general liability limits apply. Suspension/modification related to compliance or data sovereignty does not create a right to a monetary refund. The remedy — where the SLA applies — is non-cash Service Credits or future fee relief for the affected feature only, to the extent permitted by law.

110.1. Scope and Effect: This appendix applies only to school/educational institution subscriptions (B2B) and is read with the general Terms and relevant privacy and security appendices, to the extent permitted by law.

110.2. Target Availability Level: A monthly target availability of no less than 99.9%, excluding pre-announced maintenance, force majeure events, and failures of telecommunications providers and third-party services outside reasonable control.

110.3. Definition of Availability: Monthly Availability = (Total Minutes in Month − Measurable Outage Minutes — after excluding pre-announced maintenance ≥24 hours in advance, force majeure, telecommunications/third-party failures, and misuse —) ÷ Total Minutes in Month × 100%.

110.4. Exclusions from Outage Count: Maintenance announced ≥24 hours in advance, Force Majeure events, national telecommunications provider outages, third-party service failures outside the Establishment's control, non-compliance with published technical requirements/misuse, failures arising from the Client's equipment, network, or unsupported browsers.

110.5. Response Times and Support: Initial response ≤ 2 Business Hours (excluding public holidays and announced maintenance windows), with periodic updates until closure. Support channels are available via the Help Center, support tickets, and dedicated email.

110.6. Severity Classification and Escalation: Incidents have severity levels (P1/P2/P3). P1 incidents (complete outage or failure of a core feature for a wide segment) trigger immediate escalation to the incident leader and reasonable progress updates until restoration.

110.7. Emergency Channels and Success Manager: Schools are assigned an emergency channel and a Success Manager for account escalation outside peak times. Legal escalation paths are available when necessary (Support → Success Manager → Legal Notice).

110.8. Status Logs and Evidence: Monthly availability percentages and outage incidents are published in a "Status Log" with archiving for no less than 24 months. Monitoring records/logs/status dashboard are considered a decisive reference evidence for measuring availability, outages, and response times. A counter technical evidence is not acceptable unless provided by an independent accredited entity using a pre-agreed measurement methodology, and only if manifest error is proven.

110.9. Service Credits — Entitlement Schedule: When Monthly Availability (as defined above) falls below the target, Service Credits are applied as follows (monthly cap 25%):

110.10. 99.9% to 99.0%: Credit of 10% of the affected month's fees.

110.11. <99.0% to 98.0%: Credit of 15% of the affected month's fees.

110.12. <98.0% or proven "Material Defect": Credit of 25% maximum of the affected month's fees.

110.13. Credit Caps and Limits: Credits do not exceed 25% for the affected month, with an aggregate annual cap of 10% of the annual contract value. Credits are non-cash, non-transferable, non-setoffable, not exchangeable for cash, and are consumed during the current subscription period. They lapse upon its expiry and do not extend the period.

110.14. Eligibility Conditions and Claim Procedure: A credit claim must be submitted within 30 days of the end of the affected month via a support ticket, including incident dates and ticket identifiers. The Client must be in good financial standing (no payment delay exceeding 15 days), and the outage cause must not be within the exclusions. Claims are processed within a reasonable period, and credits are applied to the subsequent invoice.

110.15. Non-Entitlement to Refund: Partial failures, slowdowns, or short outages that do not reach the specified failure levels do not create a right to credit. Announced maintenance windows are not counted as outages. The sole remedy for any failure related to Service Levels — including Material Defect — is Service Credits according to this appendix, without termination or monetary refund, to the extent permitted by law.

110.16. Force Majeure and Compliance: During Force Majeure (including national telecommunications outages or emergency regulatory blocks), obligations are suspended, and credits or penalties do not apply. Time periods are extended by the duration of the event (refer to the Force Majeure Clause).

110.17. SLA Amendments: This appendix may be updated with reasonable prior notice, applying to future periods only. Continued use after the Effective Date constitutes acceptance, with the school retaining the right to terminate the affected feature if the amendment materially affects explicitly stated commitments.

110.18. Publicity and References: The Client licenses the Company to use its name and logo in client lists and presentations according to trademark guidelines, without implying endorsement or publishing performance data without prior written consent. This license may be revoked with (30) days' notice for the future only and without retroactive effect.

110.19. Credit Request and Outage Proof: The Client must submit a credit request within 30 days of the end of the affected month via the dedicated support channel within the dashboard or email [[email protected]]. The request must include: account/contract number, outage dates and times, a brief description of the impact, and any local screenshots or logs. Outages are calculated based on the Establishment's status dashboard and monitoring records data. Any incomplete request or one outside the time window is formally rejected.

111.1. Scope and Definitions: "Cookies" and LocalStorage/SessionStorage, in-app SDKs, Pixels, device identifiers (IDFA/AAID), and session identifiers are included. These technologies are used for Platform operation, security, usage measurement, and experience improvement, to the extent permitted by law.

111.2. Consent Banner and Preference Management: On the first visit, a consent banner is displayed explaining cookie categories (essential/functional/analytics/advertising if any). Non-essential files are not dropped before explicit choice. The user can always modify or withdraw consent via the Cookie Preference Dashboard within the Platform. We respect DNT/GPC browser signals. For minor accounts, non-essential categories are disabled by default and activated only according to Guardian consents.

111.3. Dropping Files: The Establishment does not drop any cookies, similar identifiers, or activate any non-essential SDKs (analytics/marketing/non-core performance) before obtaining explicit consent from the User via the Cookie Preference Dashboard, with the ability to withdraw at any time. "Do Not Track" settings are respected where technically feasible. Direct marketing to minors is prohibited without documented Guardian consent.

111.4. Categories and Purpose: (a) Essential: security/authentication/fraud prevention/session memory, (b) Preferences: language/interface/accessibility, (c) Analytics: measuring usage, user experience, and aggregated statistics, (d) Performance/A-B: testing and improving speed and reliability, (e) Marketing: campaign attribution/targeted ads — not activated without prior consent, not applied to minors.

111.5. Prior Consent Principle: The Establishment does not drop any files or activate any non-essential SDKs (analytics/performance/A-B/marketing) before obtaining explicit consent via the "Cookie Preference Dashboard." Consent is revocable at any time from the dashboard or account settings without affecting essential service notices.

111.6. Respect for Privacy Signals: The Platform attempts to respect "Do Not Track" and/or "Global Privacy Control" (GPC) settings to the extent possible according to browser/system capabilities. The automatic loading behavior for non-essential items may be modified based on those signals.

111.7. Minors and Marketing: Direct marketing to minors is prohibited. For minor accounts, all non-essential cookie categories are disabled by default. The marketing category is never activated. In school registration, permissions are managed via the educational institution according to the DPA. In non-school registration, non-essential categories are not activated except with revocable Guardian consent.

111.8. Third Parties and Vendors: We may use measurement/performance/anti-fraud tools from third parties. The vendor list, categories, and countries are published on the updated Sub-processors/Data Flows live page. Their use is subject to their independent terms. The Establishment remains committed to the principle of minimum necessity and data processing agreements with them.

111.9. Conditional Loading (Click-to-Load): Embedded content from third parties (e.g., videos) is not loaded and does not plant non-essential identifiers before consent. A "click to load" option is provided with the purpose explained.

111.10. Data That May Be Collected by These Technologies: Randomly generated session/device identifiers, browser/OS type, time zone, referral, pages/usage events, IP address for approximate geographic derivation and security. No facial/voiceprint recognition is used, and no biometric features are extracted.

111.11. Legal Basis for Processing: Essential are processed on the basis of contract execution and balanced legitimate interest (security/reliability). Non-essential (preferences/analytics/performance/marketing) are processed on the basis of revocable consent, without prejudice to mandatory consumer rights in the Kingdom.

111.12. Cookie Security: Appropriate security attributes (HttpOnly/Secure/SameSite where possible) are set, and access controls are reviewed. Passwords are not stored in cookies.

111.13. Consent Validity and Expiry: The consent status is stored in a preference cookie for up to 12 months, after which we re-request it or upon material changes. Consents/withdrawals are recorded with a timestamp and possibly IP address/device ID in an audit log.

111.14. Indicative Retention Periods: Essential up to 12 months, preferences up to 12 months, analytics/performance up to 13 months, marketing up to 6–12 months depending on the vendor; may vary according to purpose and legal requirements.

111.15. Effect of Withdrawal/Refusal: Withdrawal may limit some personalization, measurement, and performance optimization benefits, while core features continue. Accepting non-essential cookies is not a prerequisite for accessing the core service.

111.16. Mobile Applications: System-level advertising/device identifiers may be used. The user can restrict advertising tracking or reset the identifier from operating system settings. No marketing SDKs are activated in minor applications.

111.17. Policy Updates: This policy may be updated with reasonable prior notice (e.g., 15 days) upon material changes or addition of a new vendor to non-essential categories. The update applies to future periods only.

111.18. How to Manage: The "Cookie Preference Dashboard" within the product allows enabling/disabling categories granularly, in addition to browser/device link guidance for disabling or deleting cookies.

111.19. Language and Sovereignty: The Arabic version of this policy prevails in case of conflict with any translation. This appendix is read with the Privacy Policy and related processing appendices.

112.1. Reference and Integration: This appendix is read with "Appendix 8 — Cookie Policy and Similar Identifiers" and forms an integral part thereof. In case of conflict, the provisions that best protect minor privacy and Guardian oversight prevail, to the extent permitted by law.

112.2. Cookie Preference Dashboard: The Platform adopts an updatable "Cookie Preference Dashboard" allowing granular enabling/disabling of non-essential categories. The Establishment does not drop any files or activate non-essential SDKs (analytics/performance/A-B/marketing) before obtaining explicit consent via the dashboard. Consent is revocable at any time without affecting essential service notices.

112.3. Respect for Privacy Signals: The Platform attempts to respect "Do Not Track" (DNT) and "Global Privacy Control" (GPC) signals to the extent possible according to browser/system capabilities. The loading of non-essential technologies may be modified automatically based on those signals.

112.4. Minor Environment: For minor accounts, all non-essential categories are disabled by default. The marketing category is never activated. In non-school registration, no non-essential category is activated except with revocable Guardian consent. In school registration, permissions are managed via the educational institution according to the DPA.

112.5. Consent Log: Consents/withdrawals are recorded with a timestamp and may include IP address/device ID for auditing and security purposes. Schools — upon request and within DPA limits — may receive excerpts of relevant consent logs.

112.6. No Biometric Fingerprinting: Cookie/SDK technologies are not used to extract biometric features or perform facial/voiceprint matching. Identifier use is limited to the stated purposes (operation/security/aggregated measurement/experience) with the minimum necessary principle.

112.7. Mobile Applications: System-level identifiers (IDFA/AAID) may be used on devices that allow it. The user can disable advertising tracking from system settings. No marketing SDKs are activated in minor applications.

112.8. Vendor List and Material Changes: The vendor/category/country list is published on the updated Sub-processors/Data Flows page. When adding a new non-essential vendor or materially changing categories, reasonable prior notice (no less than 15 days) is provided, with a reasonable right to object for schools according to the Sub-processor clause.

112.9. Effect of Withdrawal: Withdrawal may limit some personalization/analytics benefits without affecting core functions. Accepting non-essential technologies is not a prerequisite for accessing the core service.

112.10. Language and Sovereignty: The Arabic version of this appendix prevails in case of conflict with any translation. It is read in conjunction with the Privacy Policy and related processing and security appendices.