Lurnnet Privacy Policy

Version: 1.2.0
Effective date: 13 August 2026
Replaces: 1.1.0 (10 August 2026)

This Policy explains what personal data Lurnnet collects, why, who we share it with, and the choices you have. It applies to our websites, web app, and mobile apps.

If you live in Egypt, an Arabic version will be published at the same address. Until then, this English version applies. Where a later Arabic version is published for users in Egypt, that Arabic version controls if the two conflict.

1. Who we are

Lurnnet is operated by Andrew Fahmy, doing business as Lurnnet. We may transfer the service to a company we form in Egypt, the United States, or elsewhere. If we do, this Policy moves with the service and we will notify you.

privacy@lurnnet.com is our data-protection contact.

2. How to read this Policy

Lurnnet is an education product for teachers (who subscribe), and for students and teaching assistants (TAs) who join a teacher’s class. Parents of students under 18 do not need a Lurnnet account.

Two relationships sit in one Policy:

• Your own account. For a teacher’s account and billing, and for every user’s login, date of birth, and security data, we decide how that data is used (we are the controller).
• Class data. For students and TAs inside a class — work, attendance, messages, grades, AI help — the teacher decides how that data is used (the teacher is the controller). We run the technology on the teacher’s instructions (we are the processor). Parents’ privacy questions about a child’s class data go first to the teacher. We help at privacy@lurnnet.com.

This split is the same on mobile and on the web.

3. Information we collect

We collect only what we need to run the service. We do not buy personal data from brokers. Some class information is provided by your teacher or by people in your class, not by you. If you are a parent, the student gave us your email so we could send the confirmation notice.

Account and profile

Name, email, password (stored in a form we cannot read back), date of birth (to apply age rules), optional photo and phone number, language and country inferred from your connection, and sign-in activity (including approximate location from IP — not GPS). Your email and password are collected only to create and secure your account. We do not use them to infer characteristics about you.

We may use Google’s abuse-prevention tools when you create an account or reset a password.

Class and learning

Class membership and role; materials, assignments, and submissions; attendance; grades and feedback; in-class messages; class videos you watch or upload; a schedule or task list if you use it; optional points, badges, or leaderboards.

AI

Questions and materials you send to AI features, and the replies. We ask providers not to use this content to train their models. See the AI Features page.

Payments (teachers)

Subscription status, usage that affects billing, and limited payment details returned by our payment partners (for example card type and last four digits). Full card numbers never reach Lurnnet. Egypt: Paymob. GCC and other countries: Tap Payments.

If Egyptian e-invoicing or e-receipt rules (or equivalent tax-invoice rules in your country) require it, we may ask a teacher for a National ID number (Egypt) or a tax registration number, solely to issue a compliant invoice or e-receipt. We do not collect that information today.

Device, security, and support

App and browser type, crash reports, and — if you allow notifications — a push token. During exams or video playback we may check that the device looks genuine and may show a visible mark (for example your name) to discourage sharing. We do not take your biometric data: Face ID or fingerprint, if you turn it on, stays on your device.

If you write to support, we keep what you send so we can help.

Parents (students under 18)

When a student under 18 joins a class, we collect a parent or guardian email (phone is optional) on that join screen if we do not already have one. We keep the address encrypted and a hash for lookup.

Students under 15 cannot use the class until a parent taps an electronic consent link. We record token, time, IP, and notice version. Students 15–17 may use the class immediately; we email the parent to confirm the inbox for class notes. We do not send report content to an unconfirmed inbox.

We do not collect: precise GPS; payment-card numbers; biometric templates.

4. How we use information

For class data, the teacher chooses the legal basis. For students under 18 that is typically parental consent, plus what is needed to deliver the class the parent agreed to.

You can turn off AI processing in Settings. Required account and security processing cannot be turned off if you keep using Lurnnet.

5. How we share information

We do not sell personal data. We do not share it for advertising.

We share it only:

• with people in your class (teachers, students, TAs) as needed for that class;
• with companies that help us run Lurnnet, listed at Sub-processors — hosting, files, video, email, payments, crash reporting, optional analytics, AI, and notifications;
• when the law requires it, or to protect a child.

Teachers can export consent records for their class.

6. Where information is processed

Class and account data are hosted in the European Union. We are based outside the EEA and the UK, so running the service includes access from where we are based. Some features send limited data to other countries: AI and some security checks (United States); payments (GCC or Egypt, depending on the teacher); mobile notifications (United States); delivering the website (global). Video is processed in the European Union.

These transfers use written contracts with those companies, and the transfer rules that apply — including standard contractual clauses or equivalent where those rules require them. Egyptian PDPL restricts storing or transferring personal data abroad without Centre approval. We do not currently hold that approval. We will obtain it before relying on it. You can ask us for more detail at privacy@lurnnet.com. Teachers accept this when they subscribe. The same picture is included in the parent notice for students under 18.

We will tell teachers at least 30 days before we add or replace a company on the sub-processor list. A teacher who objects may end their subscription as described in the Terms.

7. How long we keep information

We keep data only as long as needed for the purpose, or longer where the law requires it (for example tax records).

If a teacher ends their subscription (including cancellation for non-payment), class data is held in a restricted state for 30 days so the teacher can export, transfer, or delete it. Export in that window is the teacher’s responsibility. We then permanently delete what remains, except records we must keep (tax, security, or a child-safety matter). We are not a backup service.

8. Security

We use encryption in transit and at rest, access controls, monitoring, password checks against known breaches, and account protection after repeated failed sign-ins. Some accounts may be asked for extra verification.

No internet service is perfectly secure. Please keep your password to yourself and tell us at privacy@lurnnet.com if you think your account was misused.

If a personal-data incident is likely to affect you, we will notify the teacher (for class data), affected people where the law requires it, and the PDPC or other regulator within the time the law sets.

9. Children

Lurnnet is for students 13 and older. We do not allow sign-up under 13. If we learn an account is under 13, we delete it.

Egyptian law treats personal data of children as sensitive. We process it only to run the class, with parent or guardian confirmation. Qatar’s Law 13 of 2016 often treats children’s data as of a special nature; we do not claim a Qatar children’s-data permit.

Students under 18 need a parent or guardian to confirm by email before the account can join a class or use AI. Until then the account stays pending. If the parent does not confirm, we may send one reminder and we delete the pending account within 30 days of signup.

Where we process data of children or adolescents, we do so in their best interest. We do not make using a class depend on extra personal data.

Under 17, AI replies go through stricter automated safety checks. If a reply is blocked, we show a short explanation.

We do not use children’s data for marketing, advertising profiles, or training AI models. We do not run product analytics or session replay on student accounts.

Parents can email privacy@lurnnet.com to access, correct, delete, or withdraw consent for a child’s data. Include the parent’s name, the child’s name, the class or teacher, and the email used at confirmation. We acknowledge within 5 working days and route the request to the teacher. The teacher should respond in the time the law sets (in Egypt, six working days; otherwise 30 days unless a shorter local deadline applies). A parent portal is not available yet.

If we have a serious concern about a child’s safety, we may contact the relevant authorities as the law allows.

The mobile app is rated 12+ (App Store) and Teen (Google Play). Age rules in this Policy still apply.

10. Your rights

Depending on where you live, you can ask us to:

• confirm whether we process your data and access a copy;
• correct it;
• anonymise, block, or delete data that is unnecessary or excessive;
• restrict or object to certain uses;
• receive a portable copy;
• tell you whom we have shared it with and why;
• withdraw consent (this does not undo processing already done);
• have a person review a decision made solely by automated means;
• complain to a regulator.

Where we rely on legitimate interests (for example if a law outside Egypt uses that basis), you can object. We will stop unless we have a compelling reason to continue, or the law requires it. You can always object to marketing. We do not market to students, TAs, or parents.

We do not use solely automated decisions that produce legal or similarly significant effects. Suggested grades are not final until a teacher (or an authorised adult TA) acts. AI is decision-support only.

Teachers: email privacy@lurnnet.com from your Lurnnet email, or use in-app account tools.
Students and TAs: email privacy@lurnnet.com, or ask your teacher. Under 18, a parent may write instead.
Parents: see §9.

We will ask enough to confirm it is you. There is no fee unless a request is clearly excessive. In Egypt we aim to respond within six working days. Elsewhere we aim for 30 days, or sooner if local law requires. We will tell you if we need more time.

You can delete your account in the app under Settings. Teachers should export anything they need first.

11. AI in short

We use AI to help with tutoring, drafting questions, suggesting grades, TA hints, teacher summaries, and extracting text from materials you upload. AI is a decision-support tool. Outputs can be wrong. A teacher must review an AI-suggested grade before it is final. Students can ask for a human review. Academic and grading decisions sit with the teacher.

We do not make solely automated decisions that produce legal or similarly significant effects. Suggested grades are not final until a teacher (or an authorised adult TA) acts. AI is decision-support only.

Details: AI Features. Current providers are on the sub-processor list.

12. Cookies and the app

Web: see the Cookie Policy. You can accept or reject optional cookies. If you are under 18, optional cookies stay off. Only a parent (or you after you turn 18) can turn them on.

Mobile: we do not use web cookies. Sign-in details are stored in the device’s secure storage. Preferences stay on the device. See the EULA.

13. Changes

We may update this Policy. We will give at least 30 days’ notice for changes. If a change is material (more data, weaker rights, new kinds of sharing), teachers will be asked to accept again. Students and parents will be told and can withdraw consent.

14. Other countries (if we grow)

Your local law still applies where it cannot be waived.

Egypt and the GCC. This Policy is written for Egypt’s PDPL and similar rules in Saudi Arabia, the UAE, Bahrain, Kuwait, Qatar, and Oman. You can complain to the PDPC (pdpc.gov.eg), SDAIA (sdaia.gov.sa), the UAE Data Office, Bahrain’s Personal Data Protection Authority (pdp.gov.bh), or the competent authority where you live (including Qatar and Oman). Kuwait today has sectoral telecom privacy rules rather than a general PDPL; we still follow any Kuwaiti privacy law that applies to you.

European Economic Area and United Kingdom. We do not currently offer Lurnnet in the EEA or the UK. If we later do, GDPR / UK GDPR rights apply, you may complain to your local data-protection authority, and we will appoint any representative the law requires and name them here. We have not appointed one.

California and other US states. In the past 12 months we collected the information in §3 — including account email and password, date of birth, and class records — and we disclosed it only to the companies that help us run the service. We do not sell or “share” it for cross-context or targeted advertising (including for anyone 13–16). We do not give it to third parties for their own direct marketing. We use sensitive information (account login and password; and education records or under-18 student data only where a state treats those as sensitive) solely to run and secure the service. If a US state law applies, you or an authorised agent may email privacy@lurnnet.com to know, correct, delete, or limit that sensitive use. There is nothing to opt out of on sale or share. A browser “global privacy control” signal does not change this, because we do not sell or share. We will not treat you differently for asking.

Brazil. If Brazilian law applies to you, the rights in §10 apply. You may complain to the national data-protection authority (ANPD). Write to privacy@lurnnet.com. That address is our data-protection contact; we will name a data-protection officer here if the law requires one. International transfers follow §6.

Saudi Arabia. AI-generated content is labelled. We aim to follow SDAIA’s AI ethics principles for users there.

15. Contact

Also: Terms · DPA · Cookies · AI Features · EULA · Copyright · Teacher Warranty