Privacy Policy

1. Who controls your data

Nibras Learning, registered in the Kingdom of Saudi Arabia under commercial registration 7055378959, at Jeddah, Saudi Arabia, is the controller of the personal data described here.

For anything in this policy, including a request to see, correct, or delete your data, write to contact@nibmed.com.

2. The short version

• We collect what we need to run your account, build your lessons and show your progress.
• We do not sell your data and do not use it for advertising.
• Your answers, scores and progress are not sent to an AI provider.
• Lectures you upload and questions you ask the tutor are sent to an AI provider, because that is how lessons and tutor answers are made. Section 5 explains exactly what is sent.
• Some of our providers are outside the Kingdom of Saudi Arabia; section 7 says where.

3. What we collect

Your account: your name, email address, a hashed version of your password (never the password itself), the date you agreed to these terms and which version, and your study profile: university, year and current block.

If you are under 18: that you are under 18, and your parent or guardian's name, email address, and the date they consented.

What you upload and write: lecture files and the text we extract from them, the lessons, flashcards and questions built from them, your notes, folders and highlights, whiteboard drawings, the reasons and notes you add to your mistakes, and any exam goals and study plans you set.

How you study: which questions you were shown, the answers you chose, whether they were right, how long you took, the confidence you selected, your flashcard reviews and their schedules, the questions you saved or reported, and the progress figures we calculate from all of that. We also count how many lessons you build and tutor answers you receive, to apply your plan's limits.

Study groups: the groups you join, notes you share, and the messages, question sets, goals and screenshots you post.

When you subscribe: your plan, its dates and status, whether you chose automatic renewal and when, payment references, the card brand and last four digits, and a token from Moyasar that lets it charge your saved card on renewal. We never receive or store your card number, expiry date, or security code.

Beta diagnostics: during the active beta, approved student accounts automatically report named features opened, request status and duration, numeric resource identifiers, browser failure categories and lesson or tutor completion outcomes. These administrator-only technical records are retained for up to 30 days. They exclude lecture text, tutor questions and answers, exception messages, screen recordings and keystrokes. Optional detailed content capture is explained separately on the Beta testing page.

Automatically: a session cookie so you stay logged in, ordinary server logs including IP address and browser type, and performance monitoring of our own servers. If you turn on study reminders, we store the notification address your browser gives us.

4. Why we use it

• To provide the service: authenticate you, build lessons from your lectures, run practice and reviews, calculate progress, plan your study, run study groups, and apply your plan's limits.
• To review new accounts: we check new registrations before they can be used, and for students under 18 we rely on a parent or guardian's consent.
• To take payment and manage your subscription.
• To email you about your account: verification, password resets, receipts, renewal problems, and the notice before an introductory price ends. These are service messages, not marketing.
• To improve content: when students report a question, or one is answered wrongly far more often than expected, we look at it using aggregated answer data.
• To keep the service secure: detect abuse, shared accounts, and bulk extraction.

5. What is sent to AI providers, and what is not

Sent: when you upload a lecture, the text extracted from it and its file name are sent to Anthropic to build your lesson. When you ask the tutor something, your question and the passages it found to answer from (which can include your own notes, flashcards and lecture text, and reference content) are sent to Anthropic. The same passages, and sample passages from your lectures, may also be sent to TypeSafe to check that an answer is supported by its sources and to suggest which block a lecture belongs to. Your name, email address and account details are not included.

Not sent: your answers, scores, progress, mistakes, reflections, schedules, payment details, and anything in study groups.

We use these providers only to deliver those features, under their business terms. We do not keep copies of tutor replies. Copies of the responses used to build a lesson are kept for troubleshooting and deleted when you delete that lecture or your account.

6. Who else receives your data

We share the minimum necessary with these service providers:

• Laravel Cloud, which hosts the application and database.
• Anthropic, as described in section 5.
• TypeSafe, as described in section 5.
• Bunny, which stores your uploaded lecture files privately@if (filled(config('learning_tools.processor.url'))) and runs the service we use to read text from scanned slides, and delivers our site's images.
@endif
• Moyasar, our payment processor, which handles card details and charges under its own privacy policy.
• Our email provider, which delivers account emails.
• Your browser's notification service (for example Google, Apple or Mozilla), only if you turn on reminders.

Other members of a study group see what you share or post in that group (see the Terms of Service). We do not sell personal data, share it with advertisers, or give it to third parties for their own purposes. We may disclose data where the law requires it.

7. Where your data is kept

Our application and database are hosted in Frankfurt, Germany. Uploaded lecture files are stored in the storage region we have chosen with our storage provider. Anthropic processes the content described in section 5 in the United States. Moyasar operates in the Kingdom of Saudi Arabia. Where data is transferred outside the Kingdom of Saudi Arabia, we do so in line with the Personal Data Protection Law and its regulations on transfers.

8. How long we keep it, and what deleting your account does

We keep your data while you have an account. You can delete your account at any time from your profile. When you do:

• your account, notes, lectures, lessons, cards, practice history, reviews and plans are deleted straight away;
• your uploaded files, stored lesson responses and any saved card token are removed from our providers shortly afterwards (we retry automatically if a provider is unavailable);
• notes you shared with a group stop being visible to it, and screenshots you posted are deleted;
• messages, question sets and goals you gave a study group stay in that group, shown as from a former member;
• a group you owned passes to its longest-standing member, or is closed if nobody else is in it;
• payment records (amounts, dates and payment references) are kept for accounting and tax, without your name or email, for as long as the law requires.

Answer statistics aggregated so that they no longer identify anyone, such as how often a question is answered correctly, are kept because they help us find faulty questions.

9. Your rights

Under the Personal Data Protection Law you have the right to:

• be told how your personal data is used, which is what this page is for;
• request a copy of the personal data we hold about you;
• have inaccurate data corrected;
• request deletion of your data, subject to records we are legally required to keep;
• withdraw consent where we rely on it.

Write to contact@nibmed.com and we will respond within 30 days. We may ask you to confirm your identity first. If you are under 18, your parent or guardian may make these requests for you. If you are not satisfied with how we handled a request, you may complain to the Saudi Data and AI Authority (SDAIA).

10. Students under 18

Students under 18 can use Nibras only with a parent or guardian's consent, given at sign-up. We record the guardian's name, email address and the date of consent, and we may contact the guardian to confirm. A guardian can ask to see or delete the student's data, or withdraw consent, by writing to contact@nibmed.com; if consent is withdrawn, we close the account. If you believe someone under 18 joined without consent, tell us and we will close the account.

11. Cookies and storage on your device

We use a session cookie to keep you logged in, a security token to protect forms, and a cookie that remembers the interface language you choose. Your browser also stores a few preferences on your device, such as your place in a lesson and focus mode, and can keep review cards for offline study. All of these are needed for features to work. We do not use advertising or tracking cookies.

12. Security

Passwords are hashed, traffic is encrypted and uploaded lectures are stored privately. During beta, authorized Nibras administrators may inspect original lecture files to investigate processing failures and support issues. Each source opening is recorded in an audit log. This support access does not publish the file or make it available to other students. Access to the production systems is limited to those who need it. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

13. Changes

If we change this policy in a way that materially affects you, we will tell you before it takes effect. The effective date at the top of this page tells you which version you are reading.