Privacy Policy

Last UpdatedAugust 31, 2026

Controller and contact

Mohamed Megehed, trading as Yalla Araby, is the controller responsible for the personal information described here. Yalla Araby is a Swiss sole proprietorship (Einzelfirma). Address: Rathausgasse 1, 3011 Bern, Switzerland. Email: info@yalla-araby.com. Telephone: +41 79 867 44 44. This notice covers our public website, adult accounts and parent-managed learner profiles, enquiries, consultations, lessons, courses, purchases, support and communications for customers worldwide. Applicable rights depend on the laws governing the processing; this notice does not reduce them.

Information and sources

We process information you or your authorised parent/guardian provide: contact details, country/city, age information, language and learning preferences, questionnaire answers, enquiries and messages. Accounts and learner records can include names, account/learner identifiers, language, age band, level, gender, goals, and notes or birth year where provided. We also keep purchase and payment references, access permissions, learning progress and record timestamps. Child profiles are explained below. Information also comes from identity, payment and booking providers, such as account verification, payment status and booking details. Stripe processes your card details; Yalla Araby does not store them. We keep transaction references, amounts and payment statuses to verify payments, protect against fraud, handle refunds and disputes, and meet accounting obligations. Technical processing includes IP addresses, device/browser information, requests, security and error information, usage/performance events, and an approximate country derived from IP for displayed prices. Depending on diagnostic configuration, error reports may contain URLs, cookies, headers and request/response information. Do not put sensitive information into free-text fields unless needed for the requested service. When you submit consultation details, we automatically save the coarse device type and operating system reported by your browser with your enquiry for internal booking analytics. No additional cookie or device fingerprint is used. Detection may be incomplete or inaccurate.

Purposes and legal bases

We use account, learner and order information to provide requested services, arrange teaching, manage access and support, and perform contracts or take requested pre-contract steps. We process records needed for applicable legal and accounting duties. Security, abuse prevention, troubleshooting and necessary administration may rely on legitimate interests, balanced against your rights where that basis applies. Optional analytics and advertising measurement use separate consent choices where required. Promotional communications require an applicable lawful basis and a way to unsubscribe; service confirmations are distinct from promotions. Acknowledging this notice or accepting the Terms is not consent to optional tracking. If information is necessary to provide a service and you do not supply it, we may be unable to provide that service.

Providers and disclosures

Our platform uses Vercel for hosting, Web Analytics, Speed Insights and Blob file storage; Neon (NeonDB) for PostgreSQL database hosting; Clerk for identity; Stripe for payments; Resend for automated service emails; Spacemail by Spaceship for business email, including support and privacy requests; Cloudflare Turnstile for public-form protection; Google Analytics 4 for optional analytics; Meta and TikTok for optional advertising measurement; and Sentry for error diagnostics. We use Zoom for live online lessons. Booking and communications may also involve Cal.com and WhatsApp. Neon hosts application records described in this notice. Zoom processes meeting participation and technical information and, when used, participants’ audio, video and chat. Spacemail processes correspondence, addresses and attachments. Its published terms describe automated email security scanning and possible use of OpenAI to scan limited email content for harmful activity. We do not use Spacemail’s optional AI writing assistant. This does not disable or exclude the provider’s separate security scanning described above. Relevant staff, teachers and providers receive information needed for their role. Provider roles differ: some process data on our instructions, while others also have their own legal responsibilities and purposes under their applicable terms. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims. Contact us for details of the providers involved in your service. Lessons are not routinely recorded. If we propose recording a lesson, we obtain consent beforehand from the affected participants and, for a child, their parent or legal guardian. Before requesting consent, we explain the recording’s purpose, who may access it and how long it will be retained.

Cookies, analytics and advertising choices

When no choice is saved, all four apps offer Essential only and Allow all. More options lets you allow analytics or marketing independently. Essential only denies both optional categories; Allow all permits both, subject to Global Privacy Control. Privacy choices in the footer lets you change or withdraw your selection without deleting it merely by opening the chooser. Existing opt-outs are preserved. The first-party cookies ya_analytics_consent and ya_marketing_consent_v4 store choices for 180 days and are shared across HTTPS production yalla-araby.com subdomains in this browser. Preview domains use host-only choices. This preference period is not the retention period for provider event data. GA4 loads after analytics consent. Meta Pixel and TikTok Pixel load after advertising consent. Pixels can receive device/browser identifiers, visit and conversion information. For successful contact submissions, TikTok may receive SHA-256 hashes of your email and valid international phone number for matching and advertising attribution. Hashing does not necessarily make these identifiers anonymous. Our custom advertising fields exclude names, free-text messages and questionnaire answers; the pixels' own technical collection is separate. Vercel Web Analytics and Speed Insights require analytics consent, like GA4. Necessary Sentry error diagnostics operate separately from these optional choices. Web Analytics strips query strings and fragments from page URLs; that is not a blanket assurance about every diagnostic provider. Necessary identity, security and preference technologies support the service. Browser settings can restrict storage, but may affect functionality. Withdrawing consent affects future consent-based processing, not earlier lawful processing or automatic deletion of previously collected data. We use Bing Webmaster Tools for search visibility. Site ownership verification and search reporting are distinct from Microsoft advertising pixels or Clarity session recording. On the public website, Global Privacy Control (GPC) blocks Meta and TikTok advertising, including matching, even if advertising was previously allowed. It does not delete information already sent. Do Not Track is not treated as an additional consent signal. Cookie inventory: ya_analytics_consent and ya_marketing_consent_v4 — preference storage, 180 days, managed through Privacy choices. _ga and _ga_* — Google Analytics identifiers after analytics consent; their duration depends on Google configuration. _fbp/_fbc and _ttp/ttcsid* — Meta/TikTok advertising identifiers after advertising consent; provider settings determine their duration. Declining the relevant category stops our optional tags and removes accessible first-party identifiers. We cannot directly remove third-party cookies; browser settings can clear them. Identity, booking and payment providers may set additional necessary cookies when you use their services. Their exact names and lifetimes depend on the service and configuration. Essential only keeps sign-in, security and requested services working. Allow all also enables analytics (Google and Vercel) and advertising measurement (Google, Meta and TikTok on the public website). Google ad measurement needs both analytics and marketing permission; Google ad personalization stays off. Campaign codes are kept in this tab for up to 30 minutes of inactivity and can accompany a booking; Google click identifiers require both permissions and are not forwarded to Cal.com. Pixels collect technical visit data; after a successful enquiry, TikTok may receive non-anonymous hashes of email and international phone for matching. Choices apply across Yalla Araby apps in this browser. Change or withdraw them using Privacy choices. Necessary error diagnostics operate separately.

International processing

Our Neon application database and its backup/restore storage are hosted in Frankfurt, Germany (EU). This location statement does not cover all other providers, provider support access or their technical and account data. We serve customers worldwide and use providers that may process information outside Switzerland or your country, including in Europe and the United States. Processing locations and remote access depend on the provider and service configuration. Contact info@yalla-araby.com for information about the destinations and safeguards relevant to your data. Where required, transfers need a valid legal mechanism, such as applicable adequacy arrangements or contractual safeguards with necessary supplementary measures. A provider's own privacy policy or a default hosting setting does not by itself replace our obligations concerning international transfers.

Retention and deletion

We retain personal information only while needed for the stated purpose. The periods below are maximum ordinary retention periods, not a reason to retain unnecessary information. We delete or irreversibly anonymise information sooner where appropriate. A specific legal requirement or documented legal hold may require limited records to be kept longer, with restricted access and regular review. Adult accounts and service records: while providing the service or maintaining agreed purchased access, then up to 3 years after the service relationship ends for necessary support, cancellation, refund and dispute records. We retain only the information needed for those purposes; unrelated activity does not restart the period for every record. Children’s ordinary learner profiles, teaching notes and progress: while needed for the child’s learning or agreed access, then up to 12 months after that learning relationship ends. Necessary parent-held order and agreement records follow their separate periods. We do not retain all child information until age 25. Actual safeguarding concerns and legal claims are handled as separate, restricted case records, retained only for an applicable legal requirement or documented case-specific need and reviewed at least annually. Accounting records, invoices and necessary payment/refund evidence: 10 years from the end of the relevant financial year where Swiss accounting requirements apply, or a different period required by applicable law. Records subject to a specific continuing legal hold remain restricted until that hold ends. We do not retain financial records forever by default. Stripe handles card payment details; our transaction references, amounts and statuses are still personal information even though we do not store full card numbers. Enquiries that do not become a service relationship: up to 24 months after the enquiry is resolved or the last substantive contact, whichever is later. Marketing contacts and associated profiles: only while we have an applicable lawful basis, and no longer than 24 months without meaningful marketing engagement. An active course or account does not override an opt-out. When consent is withdrawn or you object, we stop the affected marketing and remove information no longer needed for it. We may keep a minimal do-not-contact record solely to respect your preference, reviewed annually. Sending messages or recording automated email opens does not itself restart the retention period. Lessons are not routinely recorded. Any exceptionally agreed lesson recording is deleted within 30 days of the lesson unless a shorter period is agreed or a specific legal requirement or legal hold applies. This does not cover separately produced teaching materials that contain no participant personal information. Necessary evidence of recording consent follows the relevant service or case-record period. Retention applies to relevant database records, files, messages and provider-held copies under our control. Technical data and provider backups have separate, purpose-limited retention cycles; they are not retained indefinitely merely because a provider permits it. Deleted data in a backup is kept out of ordinary use until that backup expires and deletion must be reapplied if a backup is restored. Deleting an account does not erase legally required accounting records or mean that every backup disappears immediately. Send access, correction or deletion requests to info@yalla-araby.com. We assess identity or parental authority proportionately, coordinate relevant provider action, and explain any lawful retention exception. We respond within the applicable legal deadline and notify you of any permitted extension. These periods do not remove rights to earlier deletion, objection or withdrawal.

Children and parent-managed profiles

Only adults aged 18 or over may register accounts. Children may learn through profiles created and managed by a parent or legal guardian; they must not register independent accounts. One adult account may manage multiple child profiles. The adult must be authorised to provide the child's information. Parents or legal guardians handle registration, profile management, bookings, purchases and communications. Children participate only in scheduled lessons or use learning resources made available to them, such as children’s videos, under the parent’s or guardian’s supervision. This can involve lesson participation and resource-usage data even though the child has no independent account. Child profiles include a name, age band and Arabic level and may include gender, learning goals, preferred language and, where supplied, birth year or learning notes. They are linked to the parent's account and may have associated course access, order references, progress, playback position, completion and access timestamps. Optional fields are not necessarily populated for every learner. We process this information to support parent-managed learning and the relevant service; storing it on the platform is processing even when the profile is managed by the parent. We do not request child identity documents or an exact date of birth for ordinary learner profiles. Contact us to request access, correction or deletion for a child, or report an account created by a child; we may check parental authority proportionately.

Security and sensitive information

We use access controls, least-privilege permissions, transport encryption, provider security controls, rate limits and audit records. No online service is completely secure. Diagnostic collection is described above; do not assume all technical reports are anonymous. Do not submit classified material, government credentials, state secrets, diplomatic communications or unrelated sensitive personal information through our services. We do not intentionally infer political opinions from a profession. Advertising disclosures described above may be treated as sharing or a sale under some laws even when no payment for data is involved; this notice does not make a blanket claim that all such processing is exempt. Qualifying security incidents are subject to applicable notification duties. Our diagnostic configuration disables performance tracing and automatic collection of user information, cookies, HTTP headers and bodies, URL query parameters, database query values and local variables. Error messages, stack traces and request paths may still contain personal information; diagnostics are not guaranteed anonymous.

Rights, regional protections and changes

Mohamed Megehed personally handles support and privacy requests received at info@yalla-araby.com. Depending on applicable law, you may request access, correction, deletion, portability or restriction, object to processing, withdraw consent, or opt out of qualifying sale, sharing or targeted advertising. Where applicable, you may appeal a rights decision and complain to a competent regulator. We will not unlawfully discriminate against you for exercising privacy rights. Send requests or complaints to info@yalla-araby.com or contact us by telephone or post using the details above. We may verify identity or authority proportionately where needed, but not impose unnecessary verification on advertising opt-outs. Applicable legal deadlines and permitted extensions govern responses. Privacy choices controls optional tags; this notice does not claim that every browser privacy signal is automatically recognised. Swiss residents may contact the FDPIC; EU/EEA residents their competent data-protection authority; UK residents the ICO; and people elsewhere their competent privacy or consumer authority. Local protections, including applicable American and African laws, remain unaffected. We do not make decisions with legal or similarly significant effects solely by automated processing. We will update this notice and its date and provide additional notice or request fresh consent where required for material changes.