Privacy Policy

Controller: VMCO LLC, licensed in the Sharjah Media City Free Zone (Shams), United Arab Emirates, licence no. [ ], address: [ ].

Data protection contact: [privacy email].

Account data: name, email, preferred language and password (stored hashed; we cannot read it).

Exam data: answers, results, scores by domain, start and submission times, and exam-integrity events such as leaving the exam page or losing connection.

Membership data: your organisation or course batch and its session recordings.

Purchase data: product, amount, payment status and order number. Payments are made through VMCO's online store and payment providers; we do not store card details.

Technical data: IP address and request logs for security and abuse prevention.

To provide the service: your account, running and scoring exams, and showing your results and progress.

To let your training organisation follow your results if you joined through it.

To issue and verify course-completion certificates.

To provide AI performance analysis and study plans when you request them.

To protect the platform, prevent cheating and abuse, and meet legal obligations.

We process your data on the basis of your consent at registration, to perform the service you requested, our legitimate interest in protecting the platform, and legal obligations. You may withdraw consent at any time; this may prevent us from continuing to provide the service.

We do not sell your data or share it for marketing.

Service providers process data on our behalf under contract: Supabase (database and authentication), Vercel (hosting), email provider [ ], and Anthropic (AI).

AI features receive question content and performance figures only — never your name or email.

If you joined through an organisation, its authorised administrators can see your results and attempts in that organisation's exams.

We may disclose data when required by law or a competent authority.

Your data is stored with cloud providers outside the Kingdom of Saudi Arabia, in India (Mumbai) for the database and application servers, plus the hosting provider's global content delivery network, with appropriate safeguards. By accepting this policy you consent to this transfer under the Personal Data Protection Law and its regulations.

Account and exam data: while your account is active, then [two years] after closure unless the law requires longer.

Purchase and invoice records: [statutory period].

Security logs: [12 months].

Certificate verification records: for as long as the certificate is valid, so third parties can verify it.

You have the right to be informed, to access and obtain a copy of your data, to correct it, to request its destruction when no longer needed, and to withdraw consent. Contact [privacy email]; we respond within the statutory period. You may also complain to the Saudi Data & AI Authority (SDAIA).

We apply technical and organisational controls including encrypted connections, per-organisation data isolation, least-privilege access, audit logging of sensitive actions and backups. We will notify you and the competent authorities of any breach affecting your data as required by law.

The platform is intended for users aged 18 or over. We do not knowingly collect data from minors without guardian consent.

We may update this policy and will ask for your consent again after any material change.