MAST Study is the controller of personal data processed via this platform. Privacy queries: privacy@maststudy.com. Data Protection Officer: dpo@maststudy.com.

• Account: name, email, country, role, authentication identifiers (incl. Google OAuth subject).
• Learning activity: course enrolments, lesson progress, assessment attempts, certificate records, xAPI statements.
• Commerce: invoice and bank-transfer references for offline payments (we do not store card numbers).
• Support & assistant: messages you send to support or the AI Learning Assistant.
• Technical: IP, device, browser, timestamps and security telemetry.

We process personal data to deliver the service (contract), comply with tax, accounting and certification record-keeping (legal obligation), secure the platform and prevent abuse (legitimate interests), and — where required — based on your consent (e.g., optional cookies, marketing email).

We share data with vetted processors: Supabase (hosting & database, EU region), Google (authentication and analytics where enabled), Resend or equivalent (transactional email), and OpenAI / Google AI providers strictly for assistant responses. Payments are invoiced offline; we do not process card data. We do not sell personal data.

Where personal data is transferred outside the UAE, EEA or UK, we rely on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards. A copy of the relevant safeguards is available on request.

Account and learning records are retained while your account is active and for up to 7 years thereafter to support certificate verification, audit and legal record-keeping. AI assistant messages are retained for 30 days for quality and abuse monitoring, then deleted or fully anonymised.

Subject to applicable law (UAE PDPL, GDPR, UK GDPR), you have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Email privacy@maststudy.com. You may also lodge a complaint with your local supervisory authority (in the UAE, the UAE Data Office).

We protect data with row-level security in the database, scoped access tokens, encryption in transit (TLS) and at rest, and strict role-based access controls for staff. Incidents are handled per our internal response plan and reported to authorities and affected users where required.

The platform is for adults engaged in professional learning and is not directed to children under 18.

We will update this notice as our processing evolves. Material changes will be highlighted on this page and, where appropriate, notified by email.