Privacy Policy

This policy explains how Darsly uses personal data. Please read it with our Terms of Service.

1. Who we are

Darsly ("Darsly", "we", "us") is operated from Jordan. Our legal identity and contact details are in section 18.

• Privacy questions and requests: privacy@darsly.org
• General support: support@darsly.org

Darsly is software for independent tutors. Tutors use it to run courses, sessions, recordings, materials, invoices and payment records for their university students.

2. Who is responsible for your data

Two parties are responsible for different data.

Your Teaching Provider is responsible for course data. "Teaching Provider" means the tutor, or the academy, whose Darsly workspace you use. Each Teaching Provider runs its own workspace on Darsly. It decides which students to enroll, what to record, what to upload and what to invoice. For this data, the Teaching Provider is the controller. Darsly is its processor. We only use it to provide the service to the Teaching Provider, and we follow its instructions and our data processing terms with it. Where this policy says "tutor" in connection with who decides on, or is responsible for, course data, the same applies to a Teaching Provider that is an academy. Course data includes enrollments, schedules, attendance votes, notes, materials, study files, recordings, inquiries, invoices, payments and payment proofs.

Darsly is responsible for its own data. For the following data, Darsly is the controller:

• account data needed to sign in (name, email, phone number, password hash, two-step sign-in settings);
• security data (sign-in events, IP addresses, device details, audit and error logs);
• support messages you send us;
• WhatsApp opt-in records, and the records we need to send alerts lawfully;
• billing data about tutors' own use of Darsly, if we charge tutors a fee.

Academies and their teachers. A workspace can also belong to an academy that has administrators and teachers. In that case the academy is the Teaching Provider and the controller of course data, and Darsly is its processor. In an academy workspace:

• the academy's administrators see all course data. A teacher sees only the courses assigned to them;
• a teacher sees the names of the students enrolled in their courses (with enrollment status), and the course content: sessions, attendance, materials, recordings and notes. A teacher does not see a student's email address, phone number, WhatsApp opt-in, time zone or payment currency;
• an inquirer's intake files (the files uploaded with an inquiry) may be shared with a teacher before the academy accepts the inquiry. The public inquiry form shows a short notice about this before the inquirer uploads a file. The teacher then sees the subject, university, status, whether the work is assessed coursework, the administrator's note and the uploaded files. The teacher does not see the inquirer's name, email, phone or message. The sharing ends when the inquiry is accepted or declined, the administrator withdraws it, or the inquiry is deleted. After acceptance, the teacher assigned to the new course sees the files as course content;
• teachers see no payment data: no prices, invoices, payments, payment proofs or credit.

What this means for students. For questions about your course data, contact your Teaching Provider first. You can also write to privacy@darsly.org. We will pass your request to your Teaching Provider within 5 working days and help it answer. If the Teaching Provider does not answer, or the workspace has closed, we will handle the request ourselves where the law allows.

3. Data we collect

• Account: name, email, phone number, time zone, preferred language and preferred payment currency.
• Course data: enrollments, schedule, attendance votes, notes, materials and study files that students upload.
• Recordings: video and audio of sessions. They include the image and voice of anyone whose camera or microphone is on.
• Inquiries: subject, university, uploaded material and the tutor's decision.
• Finance: invoices, payments, amounts, currencies, exchange rates and payment proofs. A payment proof is a screenshot or receipt. It may show a name, bank or wallet details and part of an account number.
• Messaging: WhatsApp opt-in status and date, and whether each alert was delivered.
• Zoom data (tutors who connect Zoom): see section 7.
• Google Calendar data (tutors who connect Google Calendar): see section 8.
• Calendar link (students who create one): a hash of the link's secret token, so the link can be checked. See section 8.
• Technical: sign-in events, IP address, browser and device type, and error logs.

Please do not upload sensitive data, such as health, religion or government ID numbers, unless it is truly needed for tutoring. If a student shares health or disability details to get support, the tutor must ask for the student's explicit consent first.

We do not sell personal data. We do not use it for advertising. We do not make decisions about you by automated means alone that have legal or similarly significant effects.

4. Why we use data, and our legal basis

Some laws require a "legal basis" for each use of data. The table shows ours.

Where the law of your country requires consent for a use, we or your tutor will ask for it. You can withdraw consent at any time. This does not affect what was done before you withdrew.

5. Age and children

Darsly is only for adults aged 18 or over. It is built for university students and their tutors. Tutors must not invite anyone under 18.

If we learn that a user is under 18:

• we suspend that user's access and tell the tutor;
• we delete that user's account and course data within 30 days, except financial records the law requires us to keep (see section 12);
• we ask the tutor to delete or edit any recording that shows the child, and we limit access to it until they do.

If you think a child is using Darsly, email privacy@darsly.org.

Recordings can catch other people by accident, such as family members in the background. Tutors and students should make sure no one else, especially a child, is on camera or can be heard.

6. Session recordings

How recording works. Tutors record sessions with Zoom cloud recording. When Zoom finishes processing a recording, Darsly copies the session video into Darsly's private storage. We import only the video. We do not import Zoom transcripts, captions, audio-only files or chat. Tutors can also upload a recording directly.

The Zoom copy. By default, after we check our copy, we move the Zoom copy to Zoom's trash. Zoom deletes it after 30 days. A tutor can turn this off. The tutor's Zoom account then keeps its own copy under Zoom's terms.

Notice. Students are told that sessions are recorded before they enroll and in each session invitation. We store the date each student agreed.

Legal basis. The tutor decides the legal basis. Where UK data protection law applies, the basis is the tutor's legitimate interest in giving enrolled students a recording to revise from. Where the law of your country requires consent, the basis is the consent you give at enrollment.

Your choices. If you do not want to be recorded, tell your tutor before you enroll. You can keep your camera off; your voice is still recorded when you speak. You can object to recording, or withdraw consent, at any time for future sessions by telling your tutor. You can also ask your tutor to delete or limit a past recording that shows you. The tutor decides and must answer under the law that applies. In a group course, the tutor may need to balance your request against other students' needs.

Who can watch. Only the tutor and the students enrolled in that course. In an academy workspace, also the academy's administrators and the teachers assigned to that course. They can watch only inside Darsly. Students lose access at the course end date. Students must not download, copy or share recordings (see our Terms).

7. Zoom

Tutors can connect a Zoom account. Students do not connect Zoom.

What we access and why:

• Your Zoom profile (Zoom user ID, account ID, name and email): to link your Zoom account to your Darsly workspace, and to check that a recording belongs to you.
• Meetings: we create, update and delete Zoom meetings for your Darsly sessions. We use the meeting ID, topic, time, duration and join link.
• Cloud recordings: we read the list of your cloud recordings and their details (meeting ID, start time, duration, file type and size). We download the video file of a recording that matches a Darsly session, or that you assign to a course. We then move the imported file to Zoom's trash, if you left that setting on.

We never delete other recording files, such as audio, chat or transcripts. We never permanently delete anything in Zoom. Recordings of meetings that do not match a session wait in a review queue. We copy nothing from them unless you assign them to a course.

Storage. Your Zoom connection tokens are stored encrypted on our servers. We use them only for the purposes above.

Identity check hash. When a tutor connects Zoom, we also store a one-way hash of the sign-in email of the connected Zoom account. We do not store that email itself. We use the hash only to verify identity if a former tutor loses access to their email and asks for their records. It is deleted with the workspace.

How to remove Darsly from Zoom. Either disconnect Zoom in Darsly settings, or:

1. Sign in to the Zoom App Marketplace (marketplace.zoom.us).
2. Go to Manage, then Added Apps.
3. Find Darsly and select Remove.

What happens when you remove it. We delete your Zoom tokens, Zoom user ID and account ID at once. We cancel imports that have not finished. We delete unmatched and dismissed imports. We clear Zoom file and meeting IDs from finished imports within 10 days. Recordings that were already imported are kept in your Darsly workspace as your course content. You can delete them in Darsly at any time, or ask us at privacy@darsly.org to delete them.

8. Google Calendar

Tutors can connect Google Calendar. This is optional, and Darsly works without it. Students do not connect Google.

What Google user data we access. We ask for one permission (scope): https://www.googleapis.com/auth/calendar.app.created. Google describes it as letting an app make secondary calendars, and see, create, change and delete events on them only. In practice:

• we create a separate calendar called "Darsly" in your Google account, and write, update and delete session events only on that calendar;
• we never read your other calendars, events or free/busy times;
• we ask for no identity permissions, so we do not receive your Google name, email address or profile.

What an event contains. The course subject, the start and end times, a fixed description and a link back to Darsly. An event has no attendees, no student names or emails, no other student data and no meeting links.

How we use it. Only to keep the "Darsly" calendar in line with your Darsly schedule. This is the calendar feature you see and choose in Darsly settings.

Limited Use. Darsly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google data only to provide the calendar feature you see in Darsly;
• we do not sell it, or use or transfer it for advertising;
• we do not use or transfer it to determine credit-worthiness or for lending purposes;
• we do not transfer it to others, except as needed to provide the feature, to keep the service secure, to comply with the law, or as part of a merger or sale of the business with notice to you;
• no person at Darsly reads it, unless you ask us to (for example, for support), it is needed for security or the law, or it is aggregated and anonymised for internal operations;
• we do not use it to develop, improve or train generalised artificial intelligence or machine learning models.

If we ever change how we use Google data, we will tell you and ask for your consent before we use it in the new way.

Storage and sharing. Your Google connection tokens are stored encrypted at rest, on our servers only. They are refreshed automatically and never shown in the browser. We also store the IDs of the "Darsly" calendar and of the events we created, so we can update and delete them. We share Google data with no one, except the providers that host Darsly for us and process it only on our instructions (section 11), and only in the cases listed above.

How long we keep it, and how to remove access. We keep your Google tokens and IDs until you disconnect. To disconnect, use Darsly settings. We then try to delete the "Darsly" calendar and its events from your Google account (this is best effort; if it fails, you can delete the "Darsly" calendar yourself in Google Calendar), revoke our token at Google, and erase your Google tokens and the stored IDs at once. We keep a record that the connection existed (without tokens) until your workspace is deleted. If your workspace is deleted, we take the same steps. If you instead remove Darsly first at myaccount.google.com/connections, we can no longer reach your calendar. We mark the connection as broken, and you can delete the "Darsly" calendar yourself in Google Calendar.

Calendar link for students (.ics). Students can get a personal calendar subscription link (an .ics link) in the student portal and add it to any calendar app, such as Google Calendar, Apple Calendar or Outlook. Your calendar app then fetches your Darsly session schedule from Darsly. Each event has an ID, start and end times, the course subject (with "(make-up)" for make-up sessions), its status and update stamps, and a fixed description with a link to the session in the student portal. It has no location, attendees, organiser, meeting link or reminders. The calendar's name in your app includes your tutor's display name. Darsly uses no Google API for this link. If you subscribe in a calendar app (such as Google Calendar or Apple Calendar), that provider fetches the schedule from the link under its own terms. Anyone who has the link can see your schedule, so keep it private. We store only a hash of the link's secret token, not the token itself. You can rotate or turn off the link at any time in the student portal, and the old link then stops working at once. When your access to a course ends, that course's sessions drop out of the feed, but the link itself keeps working while you have an account. We keep the hash until your account is deleted, except that after you rotate or turn off the link we delete the old hash 90 days later.

9. WhatsApp

• We message students on WhatsApp only if they opt in. We ask separately from account creation. We record the date. Opting in is not a condition of tutoring.
• Messages come from one Darsly business number. They are service alerts only: reminders, cancellations, time changes, invoices, payment confirmations and new recordings. They are not marketing.
• You can opt out at any time in portal settings or by replying STOP. We also honour a request to stop or block messages made in any other way, on or off WhatsApp. We stop WhatsApp alerts right away. Portal and email alerts continue.
• Messages pass through Meta's WhatsApp Business Platform. Meta handles them under its own terms and privacy policy.

10. Cookies

We use only cookies that are strictly needed: to keep you signed in, to remember your language and to protect against attacks. We do not use advertising or tracking cookies. If we add any other cookies, we will update this policy and ask for consent where the law requires.

11. Who we share data with

We share data only with the service providers (sub-processors) below, so they can run parts of Darsly for us. Each one is bound by a contract that limits how it uses the data.

We will update this list before any new provider receives personal data. Tutors are told of changes in advance and can object under our data processing terms.

We also share data:

• with your Teaching Provider (if it is an academy, its administrators and the teachers assigned to your course, as section 2 describes), and with other students in your course only where the product shows it (for example, your name in a group session recording);
• with authorities when the law requires it, or to protect people's safety or rights;
• with a buyer, if the business is sold. We will tell you first, and this policy will continue to protect your data.

The operator of Darsly accesses data from Jordan to run and support the service.

12. How long we keep data

If a tutor closes their workspace: it is read-only for 60 days, with full export. Then all data except financial records is deleted. Financial records are kept until the end of the 6 years. They are available only as an export from Darsly, on the tutor's request.

Financial records and deletion requests. Tutors must keep financial records for tax purposes. In the UK this is up to about 6 years. So we keep them for 6 years, even if you ask us to delete them. The legal basis is the legal obligation to keep financial records, and the defence of legal claims. During this time:

• the records are not shown in the product after the workspace closes;
• only the operator can reach them, and only to answer the tutor, a tax authority or a court;
• we do not use them for anything else;
• we delete them when the 6 years end.

Some countries require tutors to keep records longer. Tutors are responsible for keeping their own export if they need it.

13. International transfers

Your data is stored mainly in London, United Kingdom. Some of it is also processed in other countries: by the operator in Jordan, and by the providers in section 11, mainly in the United States and the European Union.

We protect data that leaves your country in these ways:

• From the UK: we use UK adequacy decisions where they exist (for example, for the European Union), the UK–US Data Bridge for providers certified under it, and otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Transfers to the operator in Jordan are covered by the UK International Data Transfer Agreement in our data processing terms with tutors.
• From Saudi Arabia, the UAE, Qatar, Jordan and other Gulf states: we transfer data only as the law of that country allows. This means: to countries with adequate protection; under standard contract clauses or other safeguards the law recognises; or where the transfer is needed to perform the service you asked for, or you have consented.

We apply the same security (section 14) wherever your data is. You can ask for a copy of the safeguards at privacy@darsly.org.

14. Security

• Data is encrypted in transit (HTTPS) and at rest.
• Files are kept in private storage. Access is limited by tutor workspace and by course, and checked on every request.
• Recordings play only through Darsly after an enrollment and date check. Links to files expire after a short time.
• Tutors must use two-step sign-in.
• Uploads and Zoom imports are checked for file type, size and content before use.
• Zoom and Google tokens are encrypted, and are never shown in the browser.
• Important actions are written to an audit log.

No system is perfectly secure. If a breach affects your data, we will tell the tutors affected without undue delay, and within 48 hours of becoming aware of it. We will tell regulators and you where the law requires. If you find a security problem, email privacy@darsly.org.

15. Your rights

Depending on where you live, you may have the right to:

• access your data and get a copy;
• correct data that is wrong;
• delete your data;
• restrict or object to how we use it;
• move your data to another service (portability);
• withdraw consent at any time;
• know how your data is used and who receives it.

These rights come from laws such as the UK GDPR and the UK Data Protection Act 2018, Jordan's Personal Data Protection Law No. 24 of 2023, Saudi Arabia's Personal Data Protection Law, the UAE's Federal Decree-Law No. 45 of 2021, and Qatar's Law No. 13 of 2016. We give users in other Gulf states the rights their own laws provide.

How to use them. Email privacy@darsly.org, or ask your tutor for course data (see section 2). We may ask you to confirm your identity. We answer within one month (30 days), or sooner if your law requires. If a request is complex, we may extend this where the law allows, and we will tell you why. There is no fee, unless a request is clearly unfounded or excessive.

Some rights have limits. For example, we keep financial records for 6 years (section 12).

Complaints. Please contact us first so we can try to help. You can also complain to your data protection authority, for example:

• United Kingdom: the Information Commissioner's Office (ico.org.uk);
• Jordan: the Personal Data Protection Council;
• Saudi Arabia: the Saudi Data and AI Authority (SDAIA);
• United Arab Emirates: the UAE Data Office;
• Qatar: the National Cyber Security Agency.

16. How to delete your data or revoke access

• Google Calendar: see section 8.
• Zoom: see section 7.
• WhatsApp: reply STOP, or turn it off in portal settings.
• Tutor workspace: close it in settings (see section 12).
• Student account or course data: ask your tutor, or email privacy@darsly.org.
• Anything else: email privacy@darsly.org. We answer within one month.

17. Changes to this policy

We may update this policy. We will post the new version here with a new date. For material changes, we will email users at least 30 days before the change takes effect, unless the law or a security need requires a faster change. Where the law requires, we will ask for consent again.

18. Contact

Operator and data controller: Motasem Abdellateef, an individual resident in Jordan, trading as Darsly.

• Privacy: privacy@darsly.org
• Support: support@darsly.org