Skip to content

Privacy Policy

At Smart Ostad, we are committed to protecting your personal data and processing it transparently and responsibly, in line with Law No. 09-08 on the protection of individuals with regard to the processing of personal data.

Last updated: 2026-11-03

1 Introduction and Our Commitment to Protecting Your Data

Smart Ostad is a Moroccan AI-driven educational platform aimed at students, teachers, and guardians, featuring a digital library of academic content, AI study-assistance tools, live virtual classes, and a communication and messaging system between users. We are aware of the sensitivity of the data we handle, especially since some of our users are minors, and we are therefore committed to processing your personal data transparently, to the extent strictly necessary to provide our services, and in accordance with Law No. 09-08 on the protection of individuals with regard to the processing of personal data, and the implementing texts issued by Morocco's National Commission for the Control of Personal Data Protection (CNDP).

By using the platform, you acknowledge that you have reviewed this policy and consent to the practices described in it. If you are a guardian registering a minor child, your use of the platform on their behalf constitutes your consent to the processing of their data as described below.

2 Types of Data We Collect

We collect the following categories of data, depending on how you use the platform:

  • Personal data: full name, email address, phone number, date of birth, profile picture, and account type (student / teacher / guardian / administrator).
  • Academic data: grade level, enrolled subjects, study plans, quiz results and flashcards, and files uploaded to the digital library.
  • Usage and behavioral data: login history, chat messages, participation in rooms and live classes, and searches performed on the platform.
  • AI interaction data: questions asked to the study assistant, study planner inputs, and files or text used to generate quizzes.
  • Guardian data: the guardian's email address, invitation tokens, and links between a student's account and a guardian's account.
  • Technical data: IP address, device and browser type, operating system, and cookies.

3 How Data Is Collected

  • At registration: we collect your personal data when you create a new account or link a guardian account to a student account.
  • During use: we automatically record your interactions with the digital library, study rooms, chat, and AI tools as you use the platform.
  • Cookies: we use cookies and similar technologies to remember your preferences (such as language) and improve performance.
  • Through third-party APIs: some features (such as live classes via Daily.co, or quiz generation via the Grok API) may process part of your data or content through external service providers we contract with under appropriate data-protection standards.

4 Purpose of Using Your Data

  • Providing core educational services: the digital library, study rooms, and live classes.
  • Operating AI tools (the study assistant, study planner, flashcards, and quiz generation) and tailoring them to your grade level.
  • Enabling guardians to monitor their children's academic progress through the family-linking system.
  • Improving the user experience and personalizing suggested content.
  • Communicating with you regarding updates, notifications, and technical support.
  • Ensuring platform security, and detecting unauthorized use or use that violates the Terms of Use.

We do not use your data for targeted marketing on behalf of third parties, and we do not sell it in any form.

5 Sharing Data with Third Parties

We do not sell your personal data to anyone. Limited data may be shared only in the following cases:

  • With the teacher responsible for the study room a student belongs to (their progress, uploaded files, and results within that room).
  • With the guardian linked to a student's account through the family-linking system, in accordance with the access permissions defined in the account settings.
  • With technical service providers we contract with to operate the platform (such as server hosting, live streaming via Daily.co, or AI processing via the Grok API), strictly to the extent necessary to operate the service.
  • When required to comply with a legal obligation or a court order issued by the competent Moroccan authorities.

You can also control, through your profile settings, the visibility of some of your information (such as your picture or activity) to other users through the platform's follow and search system.

6 Data Protection and Security

We employ reasonable technical and organizational measures to protect your data, including: encrypting the connection between your browser and our servers (SSL/TLS), encrypting passwords, restricting database access to authorized staff only, performing regular backups, and periodically reviewing information-security procedures. Nonetheless, absolute security cannot be guaranteed for any internet-connected information system, and we ask you to promptly report any suspicious activity on your account via the Contact Us page.

7 Your Rights Regarding Your Data

Under Law No. 09-08, you have the right to:

  • Right of access: know what data we hold about you.
  • Right of rectification: correct or update inaccurate information.
  • Right of erasure: request complete deletion of your account and personal data.
  • Right of portability: obtain a copy of your data in a machine-readable format.
  • Right to object: refuse the processing of your data for specific purposes, unless necessary to provide the service.
  • Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, you may contact us via the Contact Us page, and we will respond to your request within the timeframe specified in the "Response Times" section of that page.

8 Cookies

We use necessary cookies (to operate sessions and logins), preference cookies (to remember your chosen language), and limited analytics cookies to understand and improve how the platform is used. You can control or disable cookies from your browser settings at any time, noting that disabling necessary cookies may prevent you from using some platform features such as logging in or saving your academic progress.

9 Newsletter

  • What we keep: your email address, the language you were using, and a record of your consent (when, from which page and IP address you subscribed and confirmed).
  • Why: only to send the weekly digest of new library content (only when there is something new) and occasional announcements. We never sell or share this list; emails are sent through our email provider Resend.
  • Confirmation and leaving: you are only subscribed after clicking the link in the confirmation email. Every email has an unsubscribe link that works in one click, without logging in. Unconfirmed sign-ups are deleted after 30 days.
  • Deletion: to have your address removed completely, write to [email protected].

10 Verification documents

To confirm that teachers, tutors and school administrators are who they claim to be, we may ask them to upload supporting documents such as a teaching certificate or staff card. These documents are stored privately, are accessible only to authorised SmartOstad reviewers and only for verifying the account, and are never shared with students, parents or third parties. We keep them while the account holds the verified role and delete them within 30 days of a rejected or closed request. You can request access to or deletion of your documents at [email protected].

11 Data Retention Period

We retain your data for as long as your account remains active on the platform, plus any additional period necessary to fulfill the purposes described in this policy or to comply with a legal obligation. If an account remains inactive for an extended period (24 consecutive months without login), we will notify you by email before permanently deleting the account and its data or anonymizing and archiving it. You may also request deletion of your account and data at any time as described in the "Your Rights" section above.

12 Data Protection Officer (DPO)

For any question regarding the processing of your personal data, or to exercise any of the rights mentioned above, you may contact our Data Protection Officer by email at [email protected], or via the Contact Us page by selecting the "Privacy and Security Issues" subject.

13 Updates to This Policy

We may update this policy from time to time to keep pace with the evolution of our services or legal requirements. When a material change is made, we will notify you by email and/or an in-platform notice before the change takes effect. The "Last updated" date at the top of this page always reflects the most current version in force, and your continued use of the platform after an update takes effect constitutes acceptance of it.

Contact Us

For any question about this policy, contact us.