Draft placeholder. This text is a starting point only and has not been reviewed by a lawyer. It must be reviewed and adapted (UAE PDPL, GDPR and any other applicable law) before launch.
Rahma Calliope (“we”, “us”) provides educational video courses about mental wellbeing. We know that simply being a member of a platform like this can feel personal, so we collect as little as we can and protect what we keep.
Who is responsible
[LEGAL ENTITY NAME, REGISTERED ADDRESS, CONTACT EMAIL, and data protection contact if one is appointed.]
What we collect
- Account details: your name, email address and (if you set one) a securely hashed password.
- Learning activity: which courses you join, lesson progress, where you paused a video, and which parts of each video were played. This lets us resume your place and helps us improve lessons.
- Your notes: encrypted before they are stored. Our team cannot read them through the platform.
- Purchases: processed by Stripe. We receive the amount, currency, status and a Stripe customer reference. We never see or store your full card details.
- Technical data: an essential session cookie to keep you signed in, a language cookie that remembers your preferred language, your browser's user-agent for your list of signed-in devices, and short-lived security logs (for example, to limit repeated sign-in attempts).
We do not ask for health information, and you don't need to share any to use the courses.
Why we use it (legal bases)
- To provide the courses you signed up for (performance of a contract).
- To keep the platform secure and prevent abuse (legitimate interests).
- To send optional reminder emails, only if you turned them on (consent, which you can withdraw in Settings at any time).
- To keep accounting records of payments (legal obligation).
Cookies
We use one essential cookie to keep you signed in and one to remember your language. We do not use advertising or third-party analytics cookies, so we don't show a cookie banner. If that changes, we'll ask for your consent first.
Who we share it with
Only with service providers that help us run the platform, under contracts that protect your data:
- Hostinger (website and database hosting): [server location, e.g. Malaysia]
- Bunny.net (video delivery and file storage)
- Stripe (payments)
- Resend (transactional email)
Some of these providers process data outside your country. [Describe cross-border transfer safeguards required by UAE PDPL / GDPR, e.g. standard contractual clauses.]
How long we keep it
- Account, progress and notes: until you delete your account.
- Raw video-viewing events: about [120] days, then only aggregated, non-identifying counts remain.
- Email delivery logs: 90 days.
- Payment records: as required by tax and accounting law [e.g. 5 years], detached from your account if you delete it.
Your rights
You can access, correct, export or delete your data. Most of this is self-service in Settings & privacy: download all your data as a file, export your notes, or permanently delete your account. For anything else, or to object to or restrict processing, contact [CONTACT EMAIL]. You may also complain to your data protection authority (in the UAE, the UAE Data Office; in the EU/UK, your local supervisory authority).
Security
Data is encrypted in transit (HTTPS). Passwords are hashed with Argon2id. Notes are encrypted at rest with AES-256-GCM. Access to admin tools is limited to named team members and their actions are logged.
Children
The platform is intended for adults aged [18+]. [Confirm minimum age with counsel.]
Changes
We'll update this page and the date above if anything changes, and email you about significant changes.