Privacy Policy
This policy explains what personal data artickle collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to the artickle web application, our iOS and Android applications, our enrolment forms and the emails we send. We handle personal data in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19, as amended) and its Implementing Regulations.
1. Who is responsible
Artventure Company, a limited liability company trading as artickle, is the data controller for the personal data described here. We are registered in the Kingdom of Saudi Arabia under Unified National Number 7050584742, at:
Building 3028, Abi Saleh Al Jaily Street
Al Sulaimaniyah District, Unit 7938
Riyadh 12245, Kingdom of Saudi Arabia
Where a partner school collects data from you directly for its own purposes, that school is responsible for its own handling of that data. For everything that happens on the artickle platform, we are responsible.
2. What we collect
What we hold depends on who you are.
Students and parents
- Full name, and the name of the parent or guardian for a student who is a minor.
- Contact details: email address and phone number.
- Date of birth, which we use to establish whether the student is a minor or an adult.
- Gender, where provided, used to select an illustrated avatar and to address you correctly.
- The school, instrument, lesson type and enrolment the student is attached to.
- Lesson history: dates, times, duration, attendance, and the teacher who taught.
- Evaluations and progress notes written by the teacher, and comments on a lesson.
- Progress reports and certificates issued.
- Billing records: invoices, amounts, payment status and payment history.
- Enrolment and booking requests submitted through a public registration form.
Teachers and artickle staff
- Full name, email address, phone number and the name shown on reports.
- Profile information: biography, skills, instruments, teaching experience and languages.
- A profile photograph, where you upload one.
- A curriculum vitae, where you provide one, which we may process to build your teaching profile.
- A handwritten signature captured during onboarding, applied to reports and certificates issued in your name.
- Records of the agreements and consents you accepted, including the exact version and the date.
- Availability, schedule and the lessons you taught.
- Pay rates, earnings, payroll runs and payment records.
School administrators
- Name, email address, phone number and role at the school.
- The school you administer and the actions you take on the platform.
Everyone who uses the platform
- Sign in data: your email, your password in hashed form, one time sign in codes, and your linked Google account identifier if you use Google sign in.
- Session and device information needed to keep you signed in securely, and the time of your last sign in.
- Your notification preferences and whether you unsubscribed from optional messages.
- Email delivery events for messages we send you: delivered, opened, bounced or complained.
- An administrative audit record of significant actions taken on the platform, which records who did what and when.
- Your cookie and storage choice.
We do not take card payments online. artickle does not operate an online card checkout, so we never collect, see or store card numbers. Fees are settled with your school or academy directly, under your enrolment agreement with them. What we hold is the billing record: what was invoiced, for which lessons, and whether it was settled.
3. Where it comes from
- From you, when you accept an invitation, complete an enrolment or registration form, fill in your profile, or contact us.
- From your parent or guardian, where the student is a minor.
- From a partner school, which may enrol a student or add a teacher on your behalf.
- From your teacher, who records attendance, evaluations and progress notes about a student.
- From your use of the platform, such as sign in times and audit records.
- From Google, if you choose to sign in with a Google account, which gives us your name, email address and account identifier.
4. Why we use it, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Create and manage your account, and sign you in | You cannot use the platform without one | Performance of a contract |
| Schedule lessons, record attendance and manage enrolments | This is the service itself | Performance of a contract |
| Write and issue progress reports and certificates | A core part of what a family enrols for | Performance of a contract |
| Invoice schools and pay teachers | To run the business and meet our obligations to you | Performance of a contract, legal obligation |
| Send transactional messages such as invitations, schedule changes and invoices | You need them to use the service | Performance of a contract |
| Keep the platform secure, and keep an audit record of administrative actions | To protect accounts and detect misuse | Legitimate interests |
| Improve the product and fix problems | To make the service work better | Legitimate interests |
| Keep accounting, tax and commercial records | Required of us by law | Legal obligation |
| Use a photograph for publicity or promotion | Only where you have agreed | Consent, which you can withdraw |
| Send optional reminders, digests or marketing | Only where you have agreed | Consent, which you can withdraw |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we limit the processing accordingly. Where we rely on consent, you can withdraw it at any time without affecting anything done before you withdrew it.
5. Children's data
Many artickle students are children, and we treat their data with particular care.
- A child is enrolled by a parent or legal guardian, or by a school acting with the parent's authority. We do not accept self registration by a child.
- The parent controls the child's data and exercises the child's rights on their behalf.
- Where a child is given access to see their own lessons and progress, that access is granted by the parent or the school, and can be withdrawn.
- We do not use a child's data for marketing, profiling or advertising.
- We do not publish a child's photograph without the express permission of the parent.
A parent's access to a child's progress reports is granted only once a report has been approved and issued. Unapproved drafts are never visible to a family.
6. Sensitive data
We do not set out to collect sensitive personal data as the Personal Data Protection Law defines it, and we ask teachers not to record health, religious, ethnic or similar information in lesson notes unless it is genuinely necessary for the student's safety or learning. Where such information is provided to us, for example a medical note supporting an absence, we use it only for that purpose and keep it no longer than we need it.
7. AI assisted processing
We use artificial intelligence in two places: to rewrite a teacher's lesson note for clarity, and to draft a progress report from lesson history the teacher has already recorded. To do this we send the relevant lesson content, which may include a student's first name, to a third party model provider.
No automated decisions are made about you. Every AI output is a draft, marked as such in the interface, and must be reviewed and approved by a person at artickle before it reaches a family. Your content is not used by us to train any AI model, and our provider is contractually bound not to use it to train theirs.
If you would prefer that AI is not used to draft a report about your child, tell your school administrator or contact us, and we will note that preference.
8. Who we share it with
We do not sell your personal data to anyone. We do not share it for advertising or allow anyone to use it for their own marketing.
We share it only as follows.
- Your teacher, who sees the students they teach and the lessons they deliver.
- Your school, whose administrators see their own school's students, lessons, schedule and the amounts their school is charged. A school does not see what a teacher is paid.
- Your parent, where you are a student who is a minor.
- artickle staff, to the extent their role requires it.
- Service providers who process data on our instructions, listed below.
- Professional advisers, such as our accountants and lawyers, where necessary.
- Public authorities, where the law requires us to disclose.
- A buyer or successor, if the business is reorganised or sold, subject to this policy continuing to apply.
Our service providers
| Provider | What they do for us | What they handle |
|---|---|---|
| Supabase | Database, authentication, file storage and server functions | All platform data, including profiles, lessons, files and sign in credentials |
| Cloudflare | Hosting of our web application and these pages, plus network security | Technical request data such as IP address |
| Resend | Sending our transactional and notification emails | Recipient name, email address, message content, delivery events |
| Anthropic | The AI model behind note rewriting and report drafting | Lesson content submitted for rewriting or drafting |
| Optional sign in with a Google account | Your name, email address and Google account identifier |
Each provider is bound by a written agreement to process personal data only on our instructions, to keep it secure, and to return or delete it when our relationship ends.
9. Transfers outside the Kingdom
Some of the providers above store or process personal data outside the Kingdom of Saudi Arabia. Our database and file storage are hosted in the Asia Pacific (Mumbai) region, in India, and our email and AI providers operate from outside the Kingdom.
We transfer personal data outside the Kingdom only where the Personal Data Protection Law and the Regulation on Personal Data Transfer permit it, and where the transfer is necessary to provide the service to you. We assess the risk of each transfer, put appropriate contractual safeguards in place, and transfer the minimum data needed. You can ask us for more detail about a specific transfer using the contact details below.
10. Cookies and browser storage
artickle uses browser storage sparingly.
- Essential storage keeps you signed in and remembers your cookie choice. The platform cannot work without it, so it is always used.
- Optional analytics can be accepted or declined in the banner shown when you first visit. No analytics tool is connected at present, so nothing is collected either way today. We record your choice so it is already respected if we ever connect one, and if we do, we will ask you again rather than rely on an answer you gave to different wording.
We do not use advertising cookies, tracking pixels for advertising, or third party profiling. You can clear your choice at any time by clearing your browser storage for the site, and the banner will ask again.
11. How we protect it
- Access rules are enforced in the database itself, not only in the app, so a person can only read the records their role permits.
- Reads go through restricted views that expose only the fields a given role needs.
- All traffic is encrypted in transit, and data is encrypted at rest by our hosting provider.
- Passwords are stored only as salted hashes. Nobody at artickle can read your password.
- Significant administrative actions are recorded in an audit log.
- Access by our staff is limited to what their role requires.
No system is perfectly secure. If you think your account has been compromised, contact us at once and change your password.
12. How long we keep it
We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires.
| What | How long |
|---|---|
| Sign in credentials and sessions | Until you delete your account, then removed |
| Lesson records, attendance and evaluations | For the life of the student's relationship with the school, and then as part of its academic record |
| Progress reports and certificates issued | Retained, so a certificate can be verified and reissued later |
| Invoices, payments, payroll and accounting records | For the statutory retention period required of us by Saudi tax, zakat and commercial record keeping rules |
| Teacher agreements and consent records | For as long as the agreement matters, and then for the limitation period |
| Curriculum vitae and profile files | Until you remove them, or the engagement ends |
| Email delivery events | Only as long as we need them to investigate a delivery problem |
| Administrative audit records | Retained as a security and accountability record |
| Enrolment enquiries that never became an enrolment | Only as long as the enquiry may still be acted on, then destroyed |
13. Your rights
Under the Personal Data Protection Law you have the right to:
- Be informed about how and why your personal data is used, which is what this policy is for.
- Access the personal data we hold about you.
- Obtain a copy of your personal data in a readable format.
- Correct data that is inaccurate, incomplete or out of date.
- Request destruction of personal data we no longer need for the purpose it was collected.
- Withdraw consent where our use is based on your consent.
Much of this you can do yourself: you can view and edit your own profile in the app, change your notification preferences, and delete your account. For anything else, write to our privacy contact below. We will respond within 30 days, and sooner where the law requires it. We may ask you to confirm your identity first. Exercising your rights is free, unless a request is manifestly excessive or repetitive.
Some rights have limits. We cannot destroy data we are legally required to keep, or that we need to establish or defend a legal claim. Where we cannot fully meet a request, we will tell you why.
14. Deleting your account
You can delete your account yourself, at any time. Open the app, go to Account, scroll to Delete account, and confirm by typing your email address. You do not need to contact us and you do not need to give a reason.
Deleting your account permanently removes your sign in credentials: your password, any linked Google account, your one time codes and all active sessions. You are signed out immediately and cannot sign in again. This cannot be undone.
What is kept, and why. Deleting your account does not erase the business and academic records connected to it. Lessons taught and attended, enrolments, invoices, payments, payroll records, issued progress reports and issued certificates are retained, because they are the school's academic record and our accounting record, and because Saudi tax, zakat and commercial law require us to keep them for a set period. Those records carry the name and email of the people named on them or who created them, including yours, since that is what makes the record evidence of who taught, who attended and who was charged. In practice this means your directory entry remains as a label on that history after your login is gone, and it is no longer linked to any way of signing in.
If you want more than that. You can ask us to remove or mask your contact details on retained records where we are not legally required to keep them, and to destroy any personal data that is no longer needed for the purpose it was collected. Write to our privacy contact below and we will assess the request under the Personal Data Protection Law and tell you what we can and cannot do, and why, within 30 days.
Deleting your account does not end an enrolment, cancel a lesson booking or settle an amount already owed. To withdraw a student from lessons, follow the notice process in your enrolment agreement with the school.
15. Marketing choices
Messages you cannot switch off are the ones you need: sign in and password emails, invitations, invoices, schedule changes and similar transactional notices.
Everything else is optional. Change what you receive under Account then Notifications in the app, or use the unsubscribe link at the bottom of any optional email. We do not send marketing to children.
16. If something goes wrong
If a personal data breach occurs, we will notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of it, as the Implementing Regulations require, and we will notify you without undue delay where the breach is likely to cause you serious harm.
17. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the regulator:
Saudi Data and Artificial Intelligence Authority (SDAIA)
Riyadh, Kingdom of Saudi Arabia
sdaia.gov.sa
18. Changes to this policy
We may update this policy. The current version is always published at privacy.artickle.sa with its version number and date at the top. If a change materially affects how we use your personal data, we will tell you by email or in app before it takes effect, and where the law requires it we will ask for your consent again.
19. Contact us
For any privacy question, or to exercise a right described above:
Artventure Company
Email: info@artickle.sa
Building 3028, Abi Saleh Al Jaily Street, Al Sulaimaniyah District, Unit 7938
Riyadh 12245, Kingdom of Saudi Arabia
The same address handles general support. Please put privacy request in the subject line so we can route it and meet the 30 day deadline.