Privacy Policy

Last updated: 14 September 2026

This policy explains what the SarhOnline platform, operated by Sarh International Consulting and Training Company (Limited Liability Company), collects about you, how we use it, who we share it with, and what rights you have.

What we collect

Account details

• Your name (Arabic and English), email address, phone number, and a profile photo if you add one.
• Your password — stored only as an irreversible hash. Nobody here can read it.

Study activity

• Which questions you attempted, what you answered, whether it was right, and what you bookmarked.
• Mock exam attempts and scores, study plans, streaks, and progress through courses and ebooks.

Technical and security data

This platform sells paid content, and we take measures against account sharing and content leaks. We spell them out because they are not what every site does:

• IP address, sign-in times and counts, and how long your sessions last.
• Device identifier: we record an identifier for each device you sign in from, in order to enforce the device limit on your account.
• Screenshot attempts: on protected material we log that a screenshot was attempted, against your account. We do not capture the image and cannot see what was on your screen — only that it happened, and when.
• Sharing signals (such as sign-ins from many devices or locations in a short period), which may lead to an account being suspended.

Things you write

• Forum posts and comments, support tickets, and problem reports on questions.

Cookies, and how you found us

We use cookies to run the platform and to measure our own advertising. No advertising network reads them, none of them are used to target adverts at you, and none of them follow you around other websites:

• Session and form-protection cookies: needed to keep you signed in and to protect forms. The platform does not work without them.
• Language preference: remembers which language the interface is set to.
• How you found us (sarh_attribution, kept for 30 days): on your first visit we store, on that device, the campaign parameters carried by the link itself (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the referring site's name alone — instagram.com, never the full address of the page you came from — and the first page you opened here, without anything that followed it in the address. If you arrived on a link from one of our own emails, only the name of the page is kept and never the one-time code that link carried. We never store a full URL, and we never add parameters to the links on this site.

When an account is created, that record is copied once onto the account with the date it was taken, is never replaced afterwards, and our staff can see it on the account record. Its only purpose is to know which advert or which page brought people here. Clearing cookies in your browser removes it before the 30 days are up.

Why we use it

• To provide the service: run your account, save your progress, and show the content you subscribed to.
• To protect paid content: the device limit, and preventing account sharing and material leaks.
• For support and communication: answering you, and sending messages about your account and subscription.
• To measure what brings people here: which advert or page a visit arrived from, so that what we spend on advertising is spent knowingly.

Who we share it with

We do not sell your data, and we do not use it to target advertising at you — we only measure which of our own adverts a visit arrived from, as set out above. We share it only with the service providers needed to run the platform:

• Our hosting provider, which runs the servers and database.
• Our email delivery provider, to get account messages to you.
• Our AI provider: when you use the explanation or study-assistant features, the question text and your query are sent to them to generate the answer.
• Google or Apple, only if you choose to sign in with your account there.

Retention and deleting your account

We keep your data for as long as your account is open, and for 5 years after the later of your last account activity or the expiry of your last subscription. Financial, tax, dispute and legally required records may be retained for longer where applicable law requires it.

Deletion is done on your request: write to info@sarhgroups.com from the address the account is registered under, or open a support request from inside your account (Contact us in the account menu). We identify you as the account holder first, which is why there is no instant button: an account that erases itself takes with it the email that identifies it, and nothing is left to tie the record to a person, a payment or a support conversation.

When it is carried out:

• Your name, email, phone number and photo are erased. The account cannot be recovered or signed into again.
• We keep a record of past purchases and subscriptions only, because it is an accounting record we are required to retain under applicable tax and regulatory rules.

Your rights

You can ask to see, correct or delete your data, and object to some processing. Write to info@sarhgroups.com. You also have the right to complain to the Personal Data Protection Directorate at the Ministry of Digital Economy and Entrepreneurship, within the supervisory framework of the Personal Data Protection Council of the Hashemite Kingdom of Jordan.

Children

The platform is intended for people aged 16 and over. We do not knowingly collect data from children.

Changes to this policy

We may update this policy. We will change the date above, and tell you in the app if anything material changes.

Contact

Sarh International Consulting and Training Company (Limited Liability Company) — Building No. 8, Taysir Thibyan Street, Jabal Al-Hussein, Amman, Hashemite Kingdom of Jordan — info@sarhgroups.com