Privacy Policy

1. Introduction

rlearn.ai ("we", "us", or "our") is operated by R Saudi, a company registered in the Kingdom of Saudi Arabia. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use the rlearn.ai platform and related services (collectively, the "Service"). We are committed to compliance with the Saudi Personal Data Protection Law (PDPL), Royal Decree M/19, and its implementing regulations.

2. Data Controller

The data controller responsible for your personal data is:

3. Personal Data We Collect

We collect the following categories of personal data:

4. Legal Basis for Processing

We process your personal data on the following legal bases under the PDPL:

• Contractual necessity: Processing required to provide the Service you have subscribed to or requested.
• Legitimate interest: Platform security, fraud prevention, service improvement, and analytics that do not override your fundamental rights.
• Legal obligation: Compliance with NELC reporting requirements, tax regulations, or lawful government requests.
• Consent: Where required, such as for optional marketing communications or the collection of sensitive data (e.g., National ID).

5. How We Use Your Data

• Providing and personalising the learning experience, including AI Tutor interactions and spaced repetition scheduling.
• Generating learning analytics, mastery reports, and ROI assessments for your organisation's administrators.
• Submitting xAPI statements to the National E-Learning Centre (NELC) Learning Record Store where applicable.
• Authenticating your identity via OAuth, SAML SSO, or SCIM provisioning.
• Improving the Service through aggregated, anonymised usage analytics.
• Communicating service updates, security alerts, and (with consent) marketing information.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share data with:

• Your organisation's administrators: Learning progress, assessment results, and aggregate analytics as part of the enterprise service.
• NELC: xAPI learning statements as required by Saudi e-learning regulations.
• Infrastructure providers: Cloud hosting, database, and storage services that process data on our behalf under contractual safeguards.
• Legal authorities: When required by applicable law, court order, or regulatory request.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Learning records may be retained for the duration required by NELC regulations or your organisation's data retention policy. Upon account deletion or contract termination, we will delete or anonymise your personal data within 90 days, unless retention is required by law.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted data transmission (TLS), encrypted storage, per-organisation data isolation, session-based authentication, and regular security assessments. Access to personal data is restricted to authorised personnel on a need-to-know basis.

9. Cross-Border Data Transfers

Your data may be processed on servers located outside the Kingdom of Saudi Arabia. Where such transfers occur, we ensure that adequate safeguards are in place in accordance with PDPL requirements, including contractual data processing agreements with our infrastructure providers.

10. Your Rights Under the PDPL

As a data subject, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Restriction: Request limitation of processing in certain circumstances.
• Data portability: Receive your data in a structured, machine-readable format.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint: File a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

11. Cookies and Analytics

We use essential cookies for authentication and session management. We use privacy-respecting analytics (Umami) to understand platform usage patterns. We do not use third-party advertising trackers. You can manage cookie preferences through your browser settings.

12. Children's Privacy

The Service is designed for enterprise and professional use. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or email. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact