KSA Schools

Privacy Policy

Last updated: September 23, 2026

This policy explains how KSA Schools (operated by Aspire Tech Establishment) collects, uses, shares, and protects your personal data when you use ksaschools.com.

Who we are

ksaschools.com is a product of Aspire Tech Establishment, a sole proprietorship registered in the Kingdom of Saudi Arabia. Aspire Tech Establishment is the data controller for the personal information processed through this site.

Information we collect

1. When you create an account

  • Your name, email address, and a hashed password (bcrypt).
  • If you sign in with Google or Facebook: the provider-supplied user ID, name, email address, and profile picture (if available). We request only the basic identity scopes needed to authenticate you.
  • Your preferred language for outbound emails (English or Arabic).

2. When you submit a review

  • Rating, written comment, and any optional fields you supply (grade level, years attended, reviewer type).
  • The account ID you submitted under, so we can manage your reviews on request.

3. When you claim a school listing

  • Your role at the school and a contact phone number, plus a work email address on the school’s own domain if you verify that way.
  • The authorised peoplenamed on the letter — their names, job titles, email addresses and mobile numbers. The mobile numbers are used to confirm each person’s identity over WhatsApp; they never appear on a public page and are read only by KSA Schools administrators.
  • The proof documents you upload— an authorisation letter from the school, and its Ministry of Education licence or the owning company’s commercial registration. They have one purpose: confirming you are authorised to manage that school’s listing before we give you editing rights and start forwarding parents’ enquiries to you. They are held in private storage that is not reachable from the internet, are read only by KSA Schools administrators, and are never shared with anyone else. We delete them once the claim is decided, and in any case within 180 days. For technical reasons a deleted file remains recoverable at our storage provider for seven days before it is erased for good. We do not ask for national ID, Iqama or passport copies — please do not upload them.
  • The logo and campus photos a school uploads. Every image is reviewed before it is published, and we re-encode each one on upload, which removes all of its metadata — including any location data the camera recorded.

4. When you send an enquiry to a school

  • Your name, email address, phone number, your child’s grade and your message. These always reach us so we can follow the enquiry up.
  • If the school has a verified listing with us, that whole enquiry — including your phone number and your child’s grade — is emailed to the school’s authorised staff, with your address as the reply-to. That is a disclosure to a third party and it cannot be undone once sent, so we say so on the form before you submit and again in the acknowledgement. It only happens after we have confirmed the school through a source independent of the claimant’s own paperwork, and confirmed the identity of the person who will receive enquiries.
  • If the listing is not claimed, nothing is automatically disclosed to a third party: we contact the school ourselves where we hold a contact for it, and reply to you with what we learn.

5. Automatically when you visit

  • IP address — used for abuse prevention and rate limiting. Stored transiently in our rate-limiter (up to 30 days) and not joined with your account profile.
  • Session cookies (NextAuth JWT) to keep you signed in. We do not use advertising or cross-site tracking cookies.
  • Aggregate usage metrics via Plausible Analytics — cookieless and without cross-site tracking.

How we use your data

  • Operate your account (sign-in, password recovery, displaying your reviews).
  • Send transactional emails (verification, password reset, admin approval notices). We do not send marketing email.
  • Detect and prevent fraud or abuse (e.g., fake reviews, repeated failed logins).
  • Automated review screening: the text of each review you submit (title, review, pros, cons), together with your public display name, reviewer type and preferred language, is read by an AI model that proposes to our moderator whether to publish it, reject it or ask you for an edit. Your email address is not sent, and the final decision is always made by a person.
  • Improve the platform from aggregate, non-identifying usage analytics.

We do not sell your data and we do not use it for third-party marketing.

Third-party services we use

  • Google Cloud Run (me-central2 Dammam region) — application hosting.
  • Neon (PostgreSQL) — primary database for accounts and reviews.
  • SendGrid — transactional email delivery.
  • Upstash Redis — short-lived rate-limiter counters.
  • Algolia — index of school data only; no user-personal information is sent to Algolia.
  • Plausible Analytics — cookieless, aggregate usage metrics.
  • Anthropic (Claude API) — automated screening of submitted reviews before publication. Only the review text and your public display name are sent; under Anthropic's commercial terms this data is not used to train models.
  • Google Sign-In and Facebook Login — only when you choose to sign in via one of these providers. The provider's own privacy policy governs the data they retain about you on their platform.

Data retention

  • Account information: kept while your account is active.
  • Published reviews: remain visible until you delete them or close your account.
  • On account deletion: personal data is removed within 30 days. We may retain de-identified aggregate records (e.g., review counts for a school) after we strip your account linkage.
  • Security logs (rate-limit IP buckets): up to 30 days.

Your rights

Under Saudi Arabia's Personal Data Protection Law (PDPL), you have the right to:

  • Access the personal data we hold about you.
  • Correct any inaccurate data (you can update your name from /account).
  • Delete your account and associated personal data — see our data deletion page.
  • Withdraw consent to data processing at any time.
  • Lodge a complaint with the Saudi Data & AI Authority (SDAIA).

Data security

All traffic uses HTTPS. Passwords are hashed with bcrypt at cost factor 12. We apply strict security headers (CSP, HSTS, X-Frame- Options), and rate-limit sensitive endpoints (login, registration, password reset) to mitigate brute-force and abuse.

Children

The site is intended for parents and adults. We do not knowingly collect personal data from children under 13. If you believe a child has submitted personal data, please contact us so we can remove it.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or by an in-product notice. The "last updated" date at the top of this page reflects the most recent revision.

Contact us

For privacy questions or to exercise any of your rights: support@ksaschools.com