Privacy Policy
Effective date: 25 May 2026
Last reviewed: 25 May 2026
Governing framework: UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
Decifer Learning is operated by DECIFER, based in Dubai, United Arab Emirates. This policy explains what personal data we collect when you use www.deciferlearning.com, why we collect it, who we share it with, and the rights you have under UAE law.
Questions? Contact us at legal@deciferlearning.com before using the service if anything here is unclear.
1. Who We Are
Data Controller: DECIFER
Product: Decifer Learning (www.deciferlearning.com)
Registered location: Dubai, United Arab Emirates
Contact for privacy matters: legal@deciferlearning.com
As Data Controller, DECIFER determines the purposes and means of processing your personal data. Where we use third-party services to process data on our behalf, those services act as Data Processors under our instruction.
2. What Personal Data We Collect
Parent and guardian account data
- Email address
- Display name
- Password (stored as a one-way cryptographic hash; we never store or see your plain-text password)
- Role selection (parent or guardian)
- Account creation date and last login date
Child profile data
- Display name (a chosen nickname, not a legal name)
- Year group (Year 3 or Year 7)
- Avatar configuration (cosmetic choices only; no photographs)
- Theme and study buddy preferences
- Accessibility settings
Learning activity data
- Topics studied and lesson pages visited
- Practice exercise sessions completed
- Quiz attempt records: scores, individual answers, hints used, time taken
- Topic completion status and mastery level
- Daily login dates and streak length
- XP points earned, badges awarded, and Discovery Cards collected
- Spaced-repetition review schedule
Technical and device data
- IP address (collected by our hosting provider; used for security)
- Browser type and version
- Device type (desktop, tablet, or phone)
- Session identifiers and authentication tokens
Analytics data (where enabled)
If Google Analytics is active for your session, anonymised usage patterns (pages visited, session duration) are collected by Google LLC. We use this only to understand how the platform is used in aggregate. You can prevent this via your browser settings or an ad blocker.
3. Why We Collect It and Our Legal Basis
Under Article 4 of the UAE PDPL, we process personal data only where we have a recognised lawful basis. The bases we rely on are set out below.
Performance of a contract
We need certain data to provide the service you have registered for: creating and managing accounts, linking parent accounts to child profiles, delivering lessons and quizzes, recording progress so parents can view it, and operating the rewards system.
Legitimate interest
We use aggregated, de-identified learning data to improve the quality and relevance of our educational content. We also process technical data to detect and prevent fraudulent or abusive access to the platform and to maintain the security and stability of the service.
Legal obligation
We may process and retain data where required by UAE federal law, including anti-fraud, record-keeping, and child safety obligations.
Consent
Where we send service announcements or product updates by email, we do so on the basis of your consent given during registration. You may withdraw consent at any time by contacting us at legal@deciferlearning.com. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
4. Children's Privacy
Decifer Learning is designed for children aged 7 to 13 studying the UK National Curriculum at Year 3 or Year 7 level. Children do not register directly. Parents and guardians create the parent account, then enrol their child by creating a linked child profile.
Under Article 8 of the UAE PDPL, processing personal data relating to a person under 18 years of age requires the consent of a parent or legal guardian. By creating a child profile on Decifer Learning, you confirm that you are the parent or legal guardian of that child and you give your explicit consent to the collection and use of that child's data as described in this policy.
We apply data minimisation to child profiles. We do not collect:
- Real photographs or biometric data of children
- Full legal names (a display name or nickname is sufficient)
- Medical, health, or diagnostic information
- Social media usernames, phone numbers, or contact details for children
- Location data beyond country-level (inferred from IP for fraud prevention)
If you believe a child account has been created without proper parental consent, contact us immediately at legal@deciferlearning.com and we will delete the profile.
5. How Long We Keep Your Data
- Active accounts: personal data is retained while the account remains active.
- Deleted accounts: all personal data associated with a deleted account is permanently removed within 30 calendar days of a verified deletion request, except where retention is required by UAE law (for example, transaction records if applicable).
- Anonymised aggregate statistics: usage data that has been fully de-identified (no link back to any individual) may be retained indefinitely for product research and improvement.
6. Who We Share Data With
We do not sell personal data. We do not share personal data with advertisers or data brokers. We share data only with the following service providers acting as Data Processors under our written instruction:
Supabase (database and authentication)
Supabase, Inc. operates our database and authentication infrastructure on Amazon Web Services. All account data, child profiles, and learning activity records are stored in Supabase databases. Supabase processes your data only to provide and maintain the platform.
Vercel (web hosting and delivery)
Vercel, Inc. serves the Decifer Learning web application globally. Vercel may process technical request data (IP address, browser information) as part of normal web hosting operations and DDoS protection.
Google Analytics (optional, anonymised)
Where Google Analytics is active for your session, Google LLC may process anonymised usage data. We use this only for aggregate product analytics. No personally identifiable information is sent to Google Analytics. You can opt out via your browser settings or a browser extension.
Anthropic and OpenAI (content pipeline only)
These providers are used exclusively by our automated content generation pipeline to create and verify educational content. They do not receive personal data about individual users, child profiles, or learning activity records. User data and content generation are strictly separated systems.
We require all processors to maintain appropriate technical and organisational security measures and to process personal data only as instructed and in accordance with applicable law.
7. International Data Transfers
DECIFER is based in the United Arab Emirates. Our service providers (Supabase and Vercel) operate infrastructure primarily in the United States and European Union. When your personal data is transferred outside the UAE, we ensure appropriate protections are in place under Article 22 of the UAE PDPL through:
- Data processing agreements with our processors that incorporate appropriate contractual safeguards
- Your informed consent, provided when you register for Decifer Learning and accept this policy
If you would like more detail about the safeguards in place for a specific transfer, contact us at legal@deciferlearning.com.
8. Your Rights Under the UAE PDPL
Under Articles 14 to 20 of the UAE Federal Decree-Law No. 45 of 2021, you have the following rights regarding your personal data and the personal data of any child you have registered:
Right to access
Request a copy of the personal data we hold about you or your child, including a description of how it is used.
Right to rectification
Request that we correct any personal data that is inaccurate, incomplete, or out of date.
Right to erasure
Request that we delete your account and all associated personal data. We will action this within 30 days, subject to any retention required by UAE law.
Right to data portability
Request a copy of your learning data in a structured, commonly used electronic format so you can transfer it if you choose.
Right to restrict processing
Request that we limit how we use your data in circumstances where you contest its accuracy or object to our processing.
Right to object
Object to processing based on our legitimate interest. We will stop unless we can demonstrate compelling grounds that override your interests.
Right to withdraw consent
Where processing is based on your consent (such as marketing emails), you may withdraw at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email us at legal@deciferlearning.com with the subject line "Data rights request". We will respond within 30 calendar days. We may need to verify your identity before actioning the request.
9. Cookies
We use cookies and similar technologies in the following categories:
- Essential session cookies: required to keep you signed in and to maintain your session securely. These cannot be disabled while you are using the service.
- Preference cookies: used to remember your theme, language, and accessibility settings across sessions.
- Analytics cookies (optional): set by Google Analytics if enabled. You can prevent these by adjusting your browser cookie settings or using a browser extension.
10. Security
We implement technical and organisational measures to protect personal data, proportionate to the sensitivity of the information and the risks involved. These include:
- Encrypted transmission of all data using HTTPS and TLS
- One-way password hashing using industry-standard algorithms
- Role-based access controls limiting which systems and personnel can access personal data
- Regular reviews of our infrastructure security posture
- Separation between user data and AI content generation pipelines
No internet-based service can guarantee absolute security. If you believe your account has been compromised or you suspect a security incident, contact us immediately at legal@deciferlearning.com.
In the event of a personal data breach that is likely to result in risk to your rights and interests, we will notify the relevant UAE supervisory authority and, where required, affected individuals in accordance with Article 28 of the UAE PDPL.
11. Changes to This Policy
We may update this policy from time to time to reflect changes in the service, applicable law, or our data practices. When we make a material change, we will notify you by email (to the address on your account) or by a prominent notice on the platform at least 14 days before the change takes effect. The "Last reviewed" date at the top of this page will always show when the policy was most recently updated.
Continued use of Decifer Learning after the effective date of any updated policy constitutes your acceptance of the revised terms.
12. Complaints and Supervisory Authority
If you believe we have handled your personal data in a way that is inconsistent with this policy or with applicable law, please contact us first at legal@deciferlearning.com. We will do our best to resolve the matter promptly.
You also have the right to file a complaint with the UAE Data Protection Office (under the Ministry of Digital Economy and Remote Work) if you believe your rights under the UAE PDPL have not been upheld after contacting us.
Contact us about this policy
Email: legal@deciferlearning.com
Address: DECIFER, Dubai, United Arab Emirates
Also see our Terms of Service and our Help guides.