Privacy Policy

Last updated: 2026-10-08

1. Who we are and our role

"Midmar" is a technical platform operated by Material Mawad Est. For the data of any academy's subscribers, the Academy is the controller and the Platform processes it on the Academy's behalf solely to operate the service. For the account data of academy owners and managers and of visitors to the Platform, the Platform is the controller.

2. Data we collect

• Account data: name, mobile number, username, email address, and password (stored hashed in a non-reversible way).
• Participant data: name, date of birth, gender, and an optional health note with the guardian's explicit consent.
• Enrolment and payment: program, group, amounts, payment method and status. We never collect or store card numbers; payment takes place on the licensed gateway's page.
• Progress: attendance, coach assessments and progress reports.
• Academy data: legal name, commercial registration or freelance certificate number, VAT number, IBAN, and the authorised signatory's name, mobile number and ID copy. Documents are kept in private, unpublished storage.
• Technical logs: IP address and time of operations, for security, proof of consent and troubleshooting.
• Support correspondence: what you send to the support mailbox.

3. Purposes

Creating and managing accounts; registering enrolments and processing their payments; sending operational notifications by email (and by WhatsApp when the Academy's package includes it); producing progress reports; activating academy accounts with the payment gateway; reminding people who started signing up to finish; and answering support requests. We do not send advertising messages, and every periodic summary carries an unsubscribe link.

4. AI-assisted processing

When the Academy enables progress reports, reports may be drafted with the help of an AI service (Anthropic), which receives only the Participant's first name and age, the coach's assessment and the attendance record — no family name or contact details. Reports are shown to the coach, the Academy and the guardian.

5. Data sharing and processors

We share data only as strictly needed to run the service:

• The Academy you enrolled with.
• The payment gateway Paymob, to complete payments and activate academy accounts.
• Hetzner, for server hosting.
• Resend, for sending email.
• Google, for managing the support mailbox.
• Anthropic, for drafting progress reports (when enabled).
• The WhatsApp provider, when enabled for the Academy.

We never sell personal data or share it for advertising.

6. Transfers outside the Kingdom

The Platform's servers are hosted by Hetzner in Germany, and some processors operate from the United States, so some data is transferred outside the Kingdom for the purposes stated only, in accordance with the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom.

7. Cookies

Essential cookies only: the login session, anti-forgery protection, and language preference. No advertising or analytics trackers.

8. Data protection

Encryption in transit; role-based access (a coach sees only their groups, a guardian only their children); academy documents in private storage; regular backups.

9. Retention

• Account and enrolment data: for as long as the account exists.
• Payment records: one year from their date, then sent to the Academy.
• Academy data after its account is cancelled: 60 days, then deleted.
• Records of Platform fees and tax invoices: 6 years.
• Technical logs: 12 months.

10. Your rights

Under the Personal Data Protection Law you may: access your data, obtain a copy of it, correct it, request deletion of what need not be kept by law, and withdraw consent to optional processing (such as the health note). Subscribers' requests go to the Academy and the Platform executes the technical side; other requests go to support@midmar.app. We respond within 30 days.

11. Data breaches

On becoming aware of any breach affecting personal data, we notify the competent authority and the Academy concerned within 72 hours.

12. Changes

We may update this policy with a change to the "last updated" date.