MIFT Privacy Policy

I. Introduction

Welcome to MIFT (My Informed Future Tracker), an ed-tech platform that helps Saudi high schoolers plan, track, and prepare for the Safeer government scholarship process. This Privacy Policy explains what information we collect, how we use it, the legal basis we rely on, and the rights you have.

This policy is written to align with Saudi Arabia's Personal Data Protection Law (PDPL), issued by Royal Decree No. M/19 and its 2023 amendments, and its Implementing Regulations, as enforced by the Saudi Data and Artificial Intelligence Authority (SDAIA).

II. Who We Are and Scope

MIFT is the data controller for the personal data described in this policy. This policy applies to all individuals in Saudi Arabia who use MIFT, and to Saudi students using MIFT from abroad, consistent with the PDPL's territorial and extraterritorial scope.

III. Eligibility and Minors

MIFT is built for high school students, many of whom are under 18. Because of this:

• If you are under 18, use MIFT with the permission and supervision of a parent or legal guardian.
• A parent or legal guardian can contact basma@miftksa.com about access, correction, deletion, or consent concerns involving their child's account.
• We collect only the data reasonably necessary to provide the scholarship planning service. We do not collect more than that to create or maintain an account.

IV. Data We Collect

We do not treat any of the above as sensitive personal data under the PDPL (such as health, religious, or genetic data) unless you choose to include it in free text fields like essays. Please avoid including sensitive personal data about yourself or others in application materials unless it is required by the scholarship program itself.

We do not sell, rent, or share your data for marketing. We do not use your data for advertising. We do not use your data to train our AI models.

• Account information: name, email address, and password (hashed)
• Academic and application data: grades, test scores, preferred majors, scholarship application materials, essays, and related documents you enter or upload
• Roadmap and progress data: XP, completed milestones, kanban and roadmap status, and other gamification data tied to your account
• Recommendation data: inputs and outputs of the recommendation feature, such as major matches and flagged application gaps
• Usage data: basic analytics needed to maintain reliability and improve the platform
• Billing information, where applicable: handled by our payment processor; we do not store full payment card details

V. Legal Basis for Processing

Consent is our primary legal basis for processing your personal data, as required under the PDPL. Where we rely on a different legal basis, such as fulfilling a contractual obligation to you or complying with a legal or regulatory requirement, we will identify that basis at the point of collection. Where consent is our legal basis, you, or your parent or guardian if you are a minor, may withdraw it at any time, and we will stop the related processing going forward.

VI. Cookies and Analytics

We use cookies and similar tools to understand how people use MIFT so we can fix problems and improve the product.

• With your consent, we use Vercel Web Analytics to understand visits to public pages. Query parameters and URL fragments are excluded from those analytics events.
• We do not use session recording. Vercel Web Analytics is limited to public pages and excludes account, application, sign-in, and authentication callback routes.
• Analytics stay off until you, or your parent or guardian if you are a minor, give explicit consent. Nothing is tracked before that.
• You can decline, and you can withdraw consent later by clearing this site's data in your browser.
• We do not use this data for advertising, and we never sell it.

VII. Cross-Border Data Transfer

MIFT uses cloud hosting, authentication, storage, payment, and AI providers. These providers may store or process relevant data outside Saudi Arabia. Contact basma@miftksa.com for information about the providers and processing locations relevant to your account.

Security checks use Cloudflare Turnstile, which may process IP addresses and browser information to detect automated abuse. New-password safety checks use Have I Been Pwned with only the first five characters of a SHA-1 password hash; the password and complete hash are not sent to that service.

VIII. Data Protection and Security

• Connections to the MIFT website and API use HTTPS encryption in transit. Account and application records are stored in Supabase, whose managed database and backups use encryption at rest.
• Private database records are accessed through our authenticated backend. Ownership checks and database permissions restrict access to the relevant account; authorized administrators and service providers retain access needed to operate the service.
• Access to student application and academic data is limited to what is necessary to operate the platform
• No user data is ever sold, rented, or shared for marketing
• In the event of a data breach affecting your data, we will notify SDAIA within the timeframe required by the PDPL and will notify affected users without undue delay where required
• Legal disclosures, such as court orders, may require us to release data under compliance obligations

When you request an AI feature, the relevant text and application context are sent to external providers, including Anthropic and OpenAI, through their APIs. Their commercial API policies exclude inputs and outputs from model training by default, subject to those policies and any explicit data-sharing opt-in. Providers may retain content for service operation, safety, or legal requirements; this is not a zero-retention service.

Drafts and session information may also be stored in your browser. Protect access to your device and sign out on shared devices.

IX. Your Rights

Consistent with the PDPL, you, or your parent or guardian if you are a minor, have the right to:

• Be informed of the legal basis and purpose for collecting your personal data, and whether providing it is mandatory or optional
• Access your personal data
• Request correction of inaccurate or incomplete data
• Request deletion of your data and account, subject to any retention we are legally required to maintain
• Withdraw consent at any time, where consent is the basis for processing
• Request a copy of your data in a portable format, where applicable

To exercise any of these rights, contact us using the details in Section XX (Contact) below. We will respond within the timeframe required by the PDPL.

X. Independence and No Affiliation

MIFT is an independent, privately operated company. MIFT is not sponsored by, affiliated with, or endorsed by any government body, ministry, university, or organization referenced on our website or in our app, including but not limited to the Ministry of Education, the Ministry of Culture, SACM, Aramco, the University of California, Common App, or UCAS. Any references to these organizations, or to the Safeer program, approved majors, or related terminology, are for informational and planning purposes only and do not imply an official relationship.

We do not currently share your data with any government body, ministry, university, or scholarship sponsor. If we ever enter into a data sharing arrangement with an institutional partner, we will update this Privacy Policy, describe what data would be shared and why, and, where required, obtain your, or your parent or guardian's, separate consent before any individually identifiable data, such as essays or personal statements, is shared.

XI. Account Creation and Security

• Registration requires a valid email and a secure password
• You, or your parent or guardian if you are a minor, are responsible for activity under your account
• For suspected breaches, contact our support team immediately

XII. Subscriptions and Payments

• MIFT offers free tier access; advanced features may require a subscription
• The billing account holder must be at least 18 years old. Where the student is a minor, a parent or legal guardian holds the billing account and provides the payment method
• Payments, where applicable, are processed securely by a third-party merchant of record; we do not store full payment card details
• Pricing, renewals, cancellation, and refunds are detailed in our Terms of Service and our Refund and Cancellation Policy

XIII. Communications and Notifications

By registering, you consent to receive:

• System alerts and account related updates
• Service information, such as feature updates, scholarship deadline reminders, or billing notices

We do not send unsolicited marketing without your separate, explicit consent, and any marketing communication will include a clear way to opt out.

XIV. Intellectual Property

• All content, branding, and systems on MIFT are the property of MIFT
• Users retain rights to their own submitted content, such as essays, application materials, and reflections
• Any third-party names, logos, or trademarks referenced or displayed on MIFT, such as those of universities, government ministries, or application platforms, remain the property of their respective owners and are used for informational purposes only, as noted in Section X

XV. Acceptable Use

You agree not to:

• Violate laws or upload unlawful content
• Harass or impersonate others
• Upload harmful code or malware
• Misrepresent your academic records or application materials
• Disrupt platform functionality or attempt reverse engineering

Violation may result in immediate suspension or termination of your account.

XVI. Accessibility

MIFT is committed to providing an inclusive and accessible experience. If you encounter barriers to access, contact us and we will do our best to support you.

XVII. Third-Party Links

MIFT may include links to external websites or resources, such as official Safeer or ministry pages. We are not responsible for their content, privacy practices, or security. Use third-party services at your discretion.

XVIII. Data Retention

We retain personal data only for as long as necessary to provide the service or meet legal or regulatory obligations. When data is no longer needed, we take steps to securely delete or anonymize it, and we notify any party we shared it with to do the same.

XIX. Privacy Policy Updates

This Privacy Policy may be updated periodically. We will notify you of material changes via email or in app message. Continued use of MIFT after updates implies agreement with the revised policy.

XX. Contact

Questions, concerns, or requests to exercise your data rights: contact us at basma@miftksa.com.