Privacy Policy

1. Data controller

“SMLE Rounds” is a digital study service operated in the Kingdom of Saudi Arabia (the “Operator”, “we”, “us”), which is the data controller responsible for your personal data.

The SMLE Rounds platform and brand may be operated by, or licensed to, affiliated entities. The Operator is the responsible controller and remains so until any change is notified through the Service. For privacy matters, contact support@smlerounds.com.

2. Scope

This policy covers our website (smlerounds.com) and our iOS and Android apps. Some data practices differ by platform. Sign-in, payments, and certain other features are provided by third parties who process limited data on our behalf, as described in §6.

3. What we collect

Information you provide

• Account: your email address, sign-in provider (Apple, Google, or email), and optional name and avatar.
• Study profile: exam date, study pace, and goals you set.
• Payments: billing details are handled by our payment providers; we receive transaction metadata (amount, plan, status, a customer reference) — never your full card number.
• Support: the content of messages you send us and any context you include.

Information created as you use the Service

• Study activity: questions attempted, answers selected, correctness, timing, progress, notes, bookmarks, and collections.
• Device and technical data: device/browser type, language, time zone, IP address, and similar information used for security and to operate the Service.
• Product analytics events: pages/screens viewed, features used, and checkout/purchase outcomes.
• On the web only: marketing-attribution data (UTM parameters, referrer, and click identifiers such as gclid and fbclid) used to measure advertising.
• On mobile only, and only where enabled: masked session-replay recordings used to diagnose problems. Text inputs, images, and question content are masked before leaving your device.

4. How we use your data

• Provide and secure the Service: authenticate you, deliver purchased access and group-pack codes, and prevent fraud and abuse.
• Communicate with you: transactional and lifecycle emails (welcome, code delivery, redemption confirmation, and expiry reminders). We do not send marketing newsletters.
• Improve the Service through analytics and error diagnosis.
• On the web, measure and optimise advertising where you have consented (see §5).
• Comply with legal, tax, and accounting obligations.
• We may also process personal data for other purposes compatible with those above — including product analytics, research, and measuring how features are used to improve the Service — or where you have consented or the law otherwise permits.

5. Legal bases and consent

Where the law requires a legal basis, we rely on: performance of our contract with you (delivering the Service); our legitimate interests (security, fraud prevention, and product analytics) balanced against your rights; your consent (for advertising and non-essential cookies/pixels, and for mobile session replay where offered); and compliance with legal obligations.

You can withdraw consent at any time — by adjusting cookie/tracking choices on the web, declining or disabling optional analytics, or contacting support@smlerounds.com. Withdrawing consent does not affect processing already carried out.

6. Who we share data with (processors)

We share personal data with service providers and partners that help us operate, provide, secure, analyse, and improve the Service. We share only what is needed for these purposes, under contract, and we do not sell your personal data.

We may also disclose data where required by law or to protect our rights, users, or the Service.

7. How long we keep data

• Account and study data: kept while your account is active. If your account is inactive for 24 months we may anonymise or delete it.
• Payment and tax records: retained for the period required by Saudi tax and accounting law (up to ~10 years), even after account deletion.
• Support tickets: retained for up to 36 months for audit and quality purposes; the email and message you sent are kept even if you later delete your account, unless you ask us to remove them.
• Analytics and advertising data: retained according to each provider's settings.

8. Deleting your account

You can delete your account at any time from the app (Settings → Account) or by emailing support@smlerounds.com. Deletion removes your identity and study data — profile, attempts, progress, notes, bookmarks, and collections.

For legal, tax, and fraud-prevention reasons we retain a limited, anonymised record after deletion: a non-reversible hash of your email and summary billing and activity figures, kept separately from your identity. This record cannot be used to re-identify you.

9. Your rights

Subject to applicable law, you may request to access, correct, complete, or delete your personal data; obtain a copy in a portable format; restrict or object to certain processing; and withdraw consent. To exercise any right, email support@smlerounds.com. We respond within 30 days and may need to verify your identity.

If you are in the Kingdom of Saudi Arabia, you also have the right to lodge a complaint with the Saudi Data & AI Authority (SDAIA). If you are in a region covered by the GDPR, you may complain to your local data-protection authority.

10. International transfers

Some of our providers process data outside the Kingdom of Saudi Arabia (for example, analytics and advertising providers). Where we transfer personal data across borders, we rely on appropriate safeguards and the conditions permitted under the PDPL and, where applicable, the GDPR.

11. Children

The Service is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@smlerounds.com and we will delete it.

12. Security

We use reasonable technical and organisational measures, including HTTPS, access controls, and database row-level security. No system is perfectly secure; if we become aware of a personal-data breach that is likely to cause harm, we will notify affected users and the relevant authority as required by law.

13. Changes to this policy

We may update this policy at any time and at our discretion. We are not obligated to notify you individually of routine changes, so please review it periodically. Where applicable law requires advance notice or fresh consent for a material change in how we process your personal data, we will provide it.

14. Contact

Privacy questions or requests: support@smlerounds.com. SMLE Rounds, Kingdom of Saudi Arabia.