Data Privacy Policy

This policy explains what data Maahir collects, how we use it, and the rights you have under the Pakistan Personal Data Protection Bill, 2023.

1. Data We Collect

Account data — name, email, phone, CNIC (adults only), date of birth, city, education level

Learning data — exercises completed, assessment results, AI chat history, time spent, quiz answers

Activity data — IP address, device type, browser, pages visited, timestamps

Optional data — social media profiles, referral code, parental contact

2. How We Use Your Data

• To deliver learning — track progress, recommend content, grade assessments
• To improve the platform — analytics on what works, identifying gaps
• To communicate — notifications, weekly reports, critical updates
• For safety — detecting abuse, harassment, or policy violations
• Legal compliance — responding to lawful requests from Pakistani authorities

3. Data Retention

4. Your Rights

Under the PDP Bill, you have the right to:

• Access — request a copy of all data we hold about you
• Correction — fix inaccurate or incomplete data
• Deletion — request erasure (subject to legal retention requirements)
• Portability — receive your data in a machine-readable format
• Objection — object to specific data processing activities
• Withdraw consent — for optional data processing at any time

5. Data Security

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Passwords are hashed with bcrypt (never stored in plain text)
• Access is role-based; staff see only the data their job requires
• We conduct quarterly security audits and an annual third-party penetration test

6. Data Breach Response

In the event of a breach:

1. Affected users are notified within 72 hours of discovery
2. The Pakistan Telecommunication Authority (PTA) is notified as required by law
3. A public incident report is published within 30 days
4. Affected users receive free credit monitoring for 12 months

7. Contact

Data Protection Officer: privacy@maahir.io