Privacy Policy

This policy explains how Efham.ai handles personal data when you use our website, member platform, courses, community, messages, AI learning assistant, payments, and related notifications.

Efham.ai is the service provider referred to in this policy. We do not state an unverified legal entity name or business address. If you use a third-party service connected to the platform, that provider's policy may also apply.

We collect name, email, a hashed password, phone number and country code, age, interface language, country of residence, and nationality, plus optional profile details such as city, company, job title, bio, social links, and membership-question answers.

For email/password registration, we may send a one-time email verification code. With Google sign-in, we receive the provider identifier, verified email, name, and avatar from Google, then ask you to complete required profile details and accept the Terms and Privacy Policy.

We record operational and security evidence such as IP address, session, device and browser information, signup and login timestamps, and may infer the network country at signup, latest login, and latest observation. We use a local MaxMind GeoIP database to map an IP to an approximate country; we do not request precise GPS location.

This network evidence is separate from your declared residence and nationality. We do not automatically overwrite either with the IP country; we may compare signals to reduce fraud, protect accounts, and apply appropriate payment pricing.

We process plan, billing cycle, amount, currency, payment status and dates, provider references, and subscription, cancellation, and renewal details. Egypt pricing is shown in EGP and international pricing in USD or the currency shown at checkout, based on residence and related verification signals.

Card payments and recurring subscriptions are handled by Stripe, so Efham.ai does not store full card details. Manual Instapay payments may include an uploaded payment screenshot and remain pending for review, approval, or rejection. We retain transaction and review records for support, accounting, and fraud prevention.

We collect course enrollment, progress, watched episodes, watch time, quiz results and attempts, uploads, and feature or quota usage. This supports learning continuity, achievement measurement, badges, and content improvement.

When you use the Nagaty assistant, we process your prompts, conversation context, attachments, and usage signals, and may send necessary content to the AI provider Anthropic/Claude to generate a response. MongoDB, Redis, and Qdrant may support operational storage, sessions, semantic search, and retrieval context. Avoid entering highly sensitive data that is not needed for the answer.

We process posts, comments, likes, mentions, media, images, videos, GIFs, reports, and moderation decisions. Content posted to community or public-profile areas may be visible to other members according to the service's settings and features, together with your name and avatar.

Direct messages and voice notes are intended for conversation participants, but they are not end-to-end encrypted. We may access them on a limited basis when needed to operate the service, investigate a report or abuse, or comply with a valid legal request. GIPHY may provide GIF search results when that feature is enabled.

We process points, levels, streaks, badges, leaderboards, and founding-member status, plus referral codes, referrer relationships, commissions, and affiliate payout requests and details as needed to run referral and affiliate programs.

We may collect NPS scores, surveys, feedback, support requests, and notification and marketing preferences. We use these to understand satisfaction, improve the service, and communicate according to your choices.

We use cookies and local storage needed for sessions, language, security, and interface preferences. We may use PostHog for product, conversion, and campaign analytics. Meta Pixel or Google Ads are used only when configured and enabled, with consent where required by law.

Analytics events may include pages, features, signup, subscription, campaign source, and technical identifiers. You can reject non-essential analytics or marketing through the consent tool when shown or through browser controls, while essential storage remains necessary to operate the service.

We use Resend for verification codes, service mail, permitted campaigns, and audience synchronization. We record delivery, bounce, and complaint status and suppress invalid or complaining addresses. You can opt out of marketing email; necessary transactional, security, and account messages may continue.

We may use Web Push for notifications and Socket.IO/realtime web connections for presence, messaging, and updates. Web Push requires browser permission, which you can revoke in browser or account settings.

We share data as needed with processors and operational providers, including Google OAuth for authentication; Stripe for payments; Resend for email; Anthropic/Claude for AI; PostHog for analytics; Sentry for error reporting; Cloudflare Turnstile for bot protection; MaxMind for network-country estimation; Linode hosting and Object Storage; MongoDB, Redis, and Qdrant data layers; GIPHY for GIF search when enabled; and Meta Pixel or Google Ads when enabled.

We may disclose limited data to advisers or authorities when needed to protect rights or safety, comply with law, or support a legitimate corporate transaction with appropriate safeguards. We do not sell personal data for money.

We use data to deliver the service and perform our subscription agreement, verify identity, operate learning, community, payments, and support, personalize the experience, measure performance, prevent fraud and abuse, maintain security and reliability, and comply with legal obligations.

Depending on applicable law, we rely on service or contract necessity, consent where required, legitimate operational interests not overridden by your rights, and legal compliance. You may withdraw consent for future processing without affecting prior lawful processing.

Our providers may process data in countries other than yours. We use safeguards available and proportionate under applicable law and provider contracts, although data-protection rules vary by country.

We retain data while an account is active or as needed for service delivery, security, dispute resolution, and financial or legal obligations. Periods vary by record type. After deletion, eligible data is erased or anonymized, while limited copies may remain temporarily in backups, fraud-prevention logs, or required financial records until securely rotated.

We use technical and organizational controls including transport encryption, password hashing, access controls, verification, rate limits, logs, and monitoring. Sentry may capture error and technical context for diagnostics. No service is 100% secure, so protect your credentials and report suspicious activity.

Subject to applicable law, you may request access, a downloadable copy, correction, deletion, restriction, or objection. Data export and account deletion tools are available in settings, and we may verify identity before acting. We may deny or limit a request where law permits.

The service is intended for people aged 18 or older. We do not knowingly seek data from a child under 18. If you believe a minor created an account, contact us so we can review and take appropriate action, including deletion when required.

We may update this policy as the product or law changes. We will post the revised version and effective date, and provide additional notice where a change is material or law requires it.

For privacy requests or questions, email support@efham.ai. This address is used pending owner verification of a dedicated privacy contact.