Privacy Policy

Last updated: 2026-09-06

Jadwalati complies with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. This policy explains what data we process, the legal basis, how we use and protect it, and your rights.

1) Legal basis for processing

We process your data based on: your consent when creating an account and using the service; performance of the service you requested (building, displaying and sharing schedules); our legitimate interest in securing accounts and preventing misuse; and legal obligation when a competent authority requires it. You may withdraw consent at any time by deleting your account.

2) Data we process

Account data: name, email, password (stored as a secure irreversible hash), language and preferences, and a two-factor secret if enabled. School & schedule data: school and education-department name, stages, grades, subjects, and teacher names and emails. Student & guardian data: student names and guardian email (added by the school to display schedules). Limited technical data: last login time, IP address, and device type — for security and audit only.

3) How we use data

We use data to operate the platform, build/display/share schedules, send schedules and notifications on your request, and secure your account (email verification, blocking suspicious logins, activity log). We never sell your data, use it for advertising, or share it for marketing.

4) Minors’ (students’) data and the school’s role

When a school adds its students’ names and guardian emails, the school is the data controller for that data and Jadwalati acts as a processor on its behalf solely to display schedules. The school undertakes to obtain the required guardian consent before entering children’s data and to use it only for scheduling. A guardian can only view the schedules of children linked to their email, and no data is collected from students beyond what the school enters.

5) Data sharing

We do not share your data with third parties except where technically necessary to run the service (e.g. the mail server), or under a legal obligation or official request. In all cases sharing is limited to the minimum necessary.

6) Where data is processed & transfers

Your data is processed and stored on the hosting provider’s servers (please confirm country). We do not transfer data outside the Kingdom except as permitted by the PDPL and its Regulations, with the required safeguards.

7) Data protection

We apply technical and organizational controls including: encrypted connections (HTTPS/TLS); passwords stored with secure hashing (bcrypt); optional two-factor authentication; a permissions system limiting each user to their own school’s data; an audit log of sensitive actions; sensitive configuration kept outside public access; and regular backups.

8) Data retention

We retain your data while your account is active and to provide the service. When you delete your account, its associated data is permanently removed shortly after. We may keep limited security logs (e.g. last-login IP) no longer than the security need or as required by law.

9) Your rights under the PDPL

You have the right to: be informed of how your data is processed (this page); access and obtain a copy in a clear format (“Export my data” on the account page); correct or update it; erase/delete it permanently (“Delete account”); and withdraw consent at any time. To exercise any right, email us above. You may also lodge a complaint with the competent authority (Saudi Data & AI Authority — SDAIA).

10) Breach notification

If a breach affecting your personal data occurs, we take the necessary actions and notify the competent authority and affected individuals as required by the law and its Regulations.

11) Cookies

We use a single necessary session cookie only to keep you signed in; we use no advertising or tracking cookies.

12) Changes to this policy

We may update this policy from time to time and will post any changes on this page with an updated “Last updated” date above.

13) Contact

For any privacy question or to exercise your rights, contact the data controller Yasser Alsubhi at: [email protected]