At Cravta we are committed to protecting the privacy of our users — whether learners, teachers, website visitors or representatives of partner organisations. This policy explains in plain language what data we collect, why, where it is stored, who sees it, and how you stay in control of it. It is written in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations.
Version 2.0 · Effective 1 September 2026 · This version supersedes all previous versions. A translation of the Arabic policy; the Arabic version prevails if the two differ.
Who We Are
Cravta is an AI-powered interactive educational platform that turns teaching and training material into interactive activities, and gives institutions reports on comprehension and participation. Cravta carries no external or targeted advertising, and we do not sell or rent your personal data to anyone.
The platform is operated by cravta Company (a limited liability company), Unified Commercial Registration No. 7052305781, based in Riyadh, Kingdom of Saudi Arabia.
For any question about your privacy or your data, or to exercise your rights, write to us at: info@cravta.com
1. Scope of This Policy
This policy applies to all users, including:
Learners enrolled through their educational or training institution
Teachers, trainers and institution administrators
Parents and guardians
Partners, contractors and suppliers
Visitors to Cravta's website and apps
One important distinction: when you register directly with us, we are responsible for your data. When a school or training centre subscribes and creates accounts for its members, that institution decides about its members' data and we process it on its behalf under a signed agreement.
2. Types of Data We Collect
A. Information you provide directly:
First name or username
Email address
Educational institution or job title
Created or uploaded learning content (e.g. quizzes, presentations, files)
Support enquiries or messages
B. Information collected automatically:
Device type, operating system and browser
IP address
Language and general geographic region (non-specific)
Activity on the platform (usage time, activities, pages visited)
Activity results, completion and participation rates
C. Child-specific data:
We collect the minimum learner data: a first name or nickname, their group, and their activity results — solely to enable their use of the platform under the supervision of a teacher or guardian. We do not ask a learner for a photograph, phone number or precise location data.
We do not request or knowingly collect sensitive data such as health, religious or racial data. Please do not include it in the content you upload or in support messages.
3. How We Use Your Information, and On What Basis
Your data is used to:
Deliver Cravta services, run your account and generate activities — this is the service itself and cannot work without them
Run interactive sessions, monitor progress and generate reports for teachers and institutions
Personalise content and learning recommendations based on usage patterns
Keep the platform secure and prevent misuse and fraud
Contact you for technical support or important notices about your service
Send marketing messages — with your consent alone, cancellable in one click in every message
Improve our own AI tools — only under a separate, explicit opt-in that you may withdraw at any time with no effect on your service, and never applied to data of persons below the age of legal capacity
We do not use your data for any new purpose materially different from these without your consent or without notifying you of the new legal basis.
4. Data Sharing and Disclosure
We do not share your data with anyone for marketing purposes, and we do not sell or rent it. We disclose it only in the following cases and only as far as necessary:
With the educational or training institution you belong to, to give its trainers and administrators usage and performance reports
With the hosting and infrastructure providers we need to operate the platform, under contracts requiring them to protect your data
With website analytics providers — which do not run before your consent (see section 10)
If required by enforceable Saudi law or a judicial order, and only to the extent required
In a merger or acquisition, with prior notice to you and continuity of the same safeguards
We contractually bind every provider not to use the data for any other purpose, to apply protection no less stringent than ours, and not to transfer it onward without our authorisation.
5. Artificial Intelligence and Privacy
Questions and activities are generated automatically and may contain errors or inaccuracies. Review them before using them with learners — responsibility for what reaches them rests with the teacher or the institution
Uploaded content is processed within our own technical infrastructure hosted inside the Kingdom of Saudi Arabia
Your content and learner data are never used to train any other company's models
We use them to improve our own models only under a separate, explicit opt-in that you may withdraw at any time
Comprehension and participation reports are a tool to help the teacher, not an assessment decision. No decision affecting a learner — such as failing or promotion — may rest on them alone
We do not use your data or content to build a personal profile for marketing or advertising
6. Where Data Is Stored, and How It Is Protected
Your data is stored and processed inside the Kingdom of Saudi Arabia: your account, the content you upload, the activities generated from it, learner data, performance results and reports. Platform data is hosted inside the Kingdom.
If we ever need to do otherwise for an operational reason, it will not happen before this policy is updated and you are notified, and without meeting the safeguards required by the Personal Data Protection Law and the Data Transfer Regulation.
We apply organisational, technical and administrative measures proportionate to the nature of the data and the level of risk, and review and develop them from time to time. Depending on what the circumstances require, these include:
Encryption of data in transit and at rest
Least-privilege, role-based access control
Backups and incident response procedures
Contractual confidentiality obligations on everyone with access to the data
7. How Long We Keep Your Data
We do not keep your data longer than necessary for the purpose for which it was collected. We destroy it, or convert it into data that does not identify you, once that purpose no longer exists. The period is determined in each case by the following criteria:
Whether your account remains active, and the duration of the contractual relationship between you or your institution and Cravta
The purpose for which the data was collected and how far it is still needed for it
Retention periods imposed by applicable law, such as for accounting and contractual records
Any pending claim, dispute or investigation requiring retention
You may request destruction of your data at any time under section 8. When an institution's contract ends, we allow it a reasonable period to retrieve its members' data before destruction.
8. User Rights
At any time you have the right to:
Know what we collect about you, why, and on what basis
Access the personal data we hold about you
Obtain a copy of it in a clear, readable format
Correct, complete or update it
Request its destruction once it is no longer necessary for the purpose for which it was collected
Withdraw any consent you gave, through a process no less easy than giving it
Write to info@cravta.com and we respond within thirty days of receipt. For complex requests we may need a further thirty days and will tell you why before the first period expires. There is no charge, and we may ask you to confirm your identity to protect your data.
If you are a teacher or learner enrolled through a school or training centre, send your request to your institution first, as it decides about your data. If your request reaches us directly, we refer it to them, help them act on it, and tell you.
9. Children and Parental Consent
Nobody under the age of thirteen may create a Cravta account in any form.
Anyone aged thirteen or above but below the age of legal capacity uses the platform in one of two ways:
Through a school or training centre contracted with us, under the supervision of a teacher or trainer — the institution undertakes to have obtained the parent's or guardian's consent, verified the validity of guardianship and documented it, an obligation stipulated in the data processing agreement concluded with it
Or through an individual account activated only after the parent or guardian consents via a verification link sent to their email, the use of which is logged and time-stamped; the account stays disabled until that step is completed
In both cases: data of persons below the age of legal capacity is never used for marketing, for advertising profiling, or to improve AI models, and analytics tools do not run on it. A parent or guardian exercises the learner's rights on their behalf, and the learner exercises them personally on reaching legal capacity. If we become aware that a minor's data was collected without the required legal basis, we destroy it without delay.
10. Cookies and Tracking
We use two kinds of cookies:
Strictly necessary cookies for signing you in, keeping your session and platform security — the platform cannot work without them
Analytics cookies that measure website performance and how it is used, some of which record in-page interactions — these never run before your explicit consent
Please note that analytics tools are operated by global providers whose servers are outside the Kingdom. What they collect is limited to your browsing of the website and does not include your content or learner data. They do not run before your consent, and refusing them has no effect on your use of the platform.
On your first visit a panel appears where you accept or refuse each kind separately, and you may change your choice at any time from the “Privacy settings” link in the website footer or through your browser settings. We use no advertising cookies.
11. Data Breaches
We maintain a documented procedure for any leak, damage or unauthorised access. Where an incident may harm you or your rights, we notify the competent authority within seventy-two hours of becoming aware of it, and notify you without delay in clear language explaining what happened, the potential risks, the measures we have taken and what we recommend you do.
12. Policy Updates
We may update this policy from time to time. For any material change affecting your rights, we notify you by email or by in-platform notice a reasonable time before it takes effect, and update the version number and effective date at the top of this page. Changes required by law or by a decision of a competent authority, or necessitated by an urgent security requirement, take effect on publication and we notify you of them immediately.
13. Complaints and Governing Law
If you believe our processing of your data breaches the law, please write to us first at info@cravta.com and we will address your complaint. You always keep the right to lodge a complaint with the authority competent for supervising the application of the Personal Data Protection Law in the Kingdom.
This policy is governed by and construed in accordance with the laws in force in the Kingdom of Saudi Arabia, foremost the Personal Data Protection Law and its implementing regulations. The Arabic version prevails in the event of any difference with a translation.
14. Contact Us
For any question regarding this Privacy Policy or how we handle your data:
Cravta Privacy Policy
Introduction
At Cravta we are committed to protecting the privacy of our users — whether learners, teachers, website visitors or representatives of partner organisations. This policy explains in plain language what data we collect, why, where it is stored, who sees it, and how you stay in control of it. It is written in accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia and its implementing regulations.
Version 2.0 · Effective 1 September 2026 · This version supersedes all previous versions. A translation of the Arabic policy; the Arabic version prevails if the two differ.
Who We Are
Cravta is an AI-powered interactive educational platform that turns teaching and training material into interactive activities, and gives institutions reports on comprehension and participation. Cravta carries no external or targeted advertising, and we do not sell or rent your personal data to anyone.
The platform is operated by cravta Company (a limited liability company), Unified Commercial Registration No. 7052305781, based in Riyadh, Kingdom of Saudi Arabia.
For any question about your privacy or your data, or to exercise your rights, write to us at: info@cravta.com
1. Scope of This Policy
This policy applies to all users, including:
Learners enrolled through their educational or training institution
Teachers, trainers and institution administrators
Parents and guardians
Partners, contractors and suppliers
Visitors to Cravta's website and apps
One important distinction: when you register directly with us, we are responsible for your data. When a school or training centre subscribes and creates accounts for its members, that institution decides about its members' data and we process it on its behalf under a signed agreement.
2. Types of Data We Collect
A. Information you provide directly:
First name or username
Email address
Educational institution or job title
Created or uploaded learning content (e.g. quizzes, presentations, files)
Support enquiries or messages
B. Information collected automatically:
Device type, operating system and browser
IP address
Language and general geographic region (non-specific)
Activity on the platform (usage time, activities, pages visited)
Activity results, completion and participation rates
C. Child-specific data:
We collect the minimum learner data: a first name or nickname, their group, and their activity results — solely to enable their use of the platform under the supervision of a teacher or guardian. We do not ask a learner for a photograph, phone number or precise location data.
We do not request or knowingly collect sensitive data such as health, religious or racial data. Please do not include it in the content you upload or in support messages.
3. How We Use Your Information, and On What Basis
Your data is used to:
Deliver Cravta services, run your account and generate activities — this is the service itself and cannot work without them
Run interactive sessions, monitor progress and generate reports for teachers and institutions
Personalise content and learning recommendations based on usage patterns
Keep the platform secure and prevent misuse and fraud
Contact you for technical support or important notices about your service
Send marketing messages — with your consent alone, cancellable in one click in every message
Improve our own AI tools — only under a separate, explicit opt-in that you may withdraw at any time with no effect on your service, and never applied to data of persons below the age of legal capacity
We do not use your data for any new purpose materially different from these without your consent or without notifying you of the new legal basis.
4. Data Sharing and Disclosure
We do not share your data with anyone for marketing purposes, and we do not sell or rent it. We disclose it only in the following cases and only as far as necessary:
With the educational or training institution you belong to, to give its trainers and administrators usage and performance reports
With the hosting and infrastructure providers we need to operate the platform, under contracts requiring them to protect your data
With website analytics providers — which do not run before your consent (see section 10)
If required by enforceable Saudi law or a judicial order, and only to the extent required
In a merger or acquisition, with prior notice to you and continuity of the same safeguards
We contractually bind every provider not to use the data for any other purpose, to apply protection no less stringent than ours, and not to transfer it onward without our authorisation.
5. Artificial Intelligence and Privacy
Questions and activities are generated automatically and may contain errors or inaccuracies. Review them before using them with learners — responsibility for what reaches them rests with the teacher or the institution
Uploaded content is processed within our own technical infrastructure hosted inside the Kingdom of Saudi Arabia
Your content and learner data are never used to train any other company's models
We use them to improve our own models only under a separate, explicit opt-in that you may withdraw at any time
Comprehension and participation reports are a tool to help the teacher, not an assessment decision. No decision affecting a learner — such as failing or promotion — may rest on them alone
We do not use your data or content to build a personal profile for marketing or advertising
6. Where Data Is Stored, and How It Is Protected
Your data is stored and processed inside the Kingdom of Saudi Arabia: your account, the content you upload, the activities generated from it, learner data, performance results and reports. Platform data is hosted inside the Kingdom.
If we ever need to do otherwise for an operational reason, it will not happen before this policy is updated and you are notified, and without meeting the safeguards required by the Personal Data Protection Law and the Data Transfer Regulation.
We apply organisational, technical and administrative measures proportionate to the nature of the data and the level of risk, and review and develop them from time to time. Depending on what the circumstances require, these include:
Encryption of data in transit and at rest
Least-privilege, role-based access control
Backups and incident response procedures
Contractual confidentiality obligations on everyone with access to the data
7. How Long We Keep Your Data
We do not keep your data longer than necessary for the purpose for which it was collected. We destroy it, or convert it into data that does not identify you, once that purpose no longer exists. The period is determined in each case by the following criteria:
Whether your account remains active, and the duration of the contractual relationship between you or your institution and Cravta
The purpose for which the data was collected and how far it is still needed for it
Retention periods imposed by applicable law, such as for accounting and contractual records
Any pending claim, dispute or investigation requiring retention
You may request destruction of your data at any time under section 8. When an institution's contract ends, we allow it a reasonable period to retrieve its members' data before destruction.
8. User Rights
At any time you have the right to:
Know what we collect about you, why, and on what basis
Access the personal data we hold about you
Obtain a copy of it in a clear, readable format
Correct, complete or update it
Request its destruction once it is no longer necessary for the purpose for which it was collected
Withdraw any consent you gave, through a process no less easy than giving it
Write to info@cravta.com and we respond within thirty days of receipt. For complex requests we may need a further thirty days and will tell you why before the first period expires. There is no charge, and we may ask you to confirm your identity to protect your data.
If you are a teacher or learner enrolled through a school or training centre, send your request to your institution first, as it decides about your data. If your request reaches us directly, we refer it to them, help them act on it, and tell you.
9. Children and Parental Consent
Nobody under the age of thirteen may create a Cravta account in any form.
Anyone aged thirteen or above but below the age of legal capacity uses the platform in one of two ways:
Through a school or training centre contracted with us, under the supervision of a teacher or trainer — the institution undertakes to have obtained the parent's or guardian's consent, verified the validity of guardianship and documented it, an obligation stipulated in the data processing agreement concluded with it
Or through an individual account activated only after the parent or guardian consents via a verification link sent to their email, the use of which is logged and time-stamped; the account stays disabled until that step is completed
In both cases: data of persons below the age of legal capacity is never used for marketing, for advertising profiling, or to improve AI models, and analytics tools do not run on it. A parent or guardian exercises the learner's rights on their behalf, and the learner exercises them personally on reaching legal capacity. If we become aware that a minor's data was collected without the required legal basis, we destroy it without delay.
10. Cookies and Tracking
We use two kinds of cookies:
Strictly necessary cookies for signing you in, keeping your session and platform security — the platform cannot work without them
Analytics cookies that measure website performance and how it is used, some of which record in-page interactions — these never run before your explicit consent
Please note that analytics tools are operated by global providers whose servers are outside the Kingdom. What they collect is limited to your browsing of the website and does not include your content or learner data. They do not run before your consent, and refusing them has no effect on your use of the platform.
On your first visit a panel appears where you accept or refuse each kind separately, and you may change your choice at any time from the “Privacy settings” link in the website footer or through your browser settings. We use no advertising cookies.
11. Data Breaches
We maintain a documented procedure for any leak, damage or unauthorised access. Where an incident may harm you or your rights, we notify the competent authority within seventy-two hours of becoming aware of it, and notify you without delay in clear language explaining what happened, the potential risks, the measures we have taken and what we recommend you do.
12. Policy Updates
We may update this policy from time to time. For any material change affecting your rights, we notify you by email or by in-platform notice a reasonable time before it takes effect, and update the version number and effective date at the top of this page. Changes required by law or by a decision of a competent authority, or necessitated by an urgent security requirement, take effect on publication and we notify you of them immediately.
13. Complaints and Governing Law
If you believe our processing of your data breaches the law, please write to us first at info@cravta.com and we will address your complaint. You always keep the right to lodge a complaint with the authority competent for supervising the application of the Personal Data Protection Law in the Kingdom.
This policy is governed by and construed in accordance with the laws in force in the Kingdom of Saudi Arabia, foremost the Personal Data Protection Law and its implementing regulations. The Arabic version prevails in the event of any difference with a translation.
14. Contact Us
For any question regarding this Privacy Policy or how we handle your data:
Email: info@cravta.com
Phone: +966566000315