Privacy policy

Flashcards Arabia (flashcardsarabia.com) is operated by Softest, based in Dubai, United Arab Emirates. We are the controller of the personal data described in this policy, which is written to meet the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

Questions or requests about your data: privacy@flashcardsarabia.com.

You give us

• Account details: your name and email address, and a password if you choose to set one (stored only as a secure hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Family profile (optional): the roles you add (such as Mum or Grandma), the names your child uses for them, and any photos you upload.
• Messages: what you write when you email or message us.

Created when you use the service

• Orders: which sets you bought, prices, discount, order number, the email used at checkout, payment status and a link to the Stripe receipt. We never receive your full card number.
• Learning progress: which cards you’ve marked “I know it” or “Still learning”, and how often cards have been seen.
• Technical data: sign-in sessions (including IP address and browser type, used for security) and standard server logs.

Kept only on your device

Your cart, player settings (such as card language) and the last card you played are saved in your browser’s local storage. They are not sent to us.

• To provide what you bought — creating your account, taking payment, giving access to your sets, personalising family cards and saving progress. (Legal basis: performing our contract with you.)
• To send service emails — sign-in links, password resets and order confirmations. We don’t send marketing emails. (Contract.)
• To keep financial records of orders, as UAE law requires. (Legal obligation.)
• To keep the service secure and prevent fraud or misuse. (Our legitimate interests.)
• To help you when you contact us. (Contract, or our legitimate interests.)
• Family photos and names are processed only because you choose to add them, with your consent as the child’s parent or guardian, and only to show them on your own cards. You can withdraw consent at any time by deleting them.

We don’t sell your data, show ads, or use your data for automated decisions about you.

We know family photos and children’s names are precious. Here is exactly how we handle them:

• You can add names once you’re signed in, and photos once you’ve also confirmed your email address, so we know the account is yours. You don’t need to buy a family set first; they appear on the family sets you own.
• Before a photo is saved, you confirm that you are the child’s parent or guardian and have permission from any adult pictured.
• Before upload, photos are cropped and resized in your browser and saved as a new image, which removes hidden data such as the location where the photo was taken.
• Photos are stored privately in our database and can only be loaded by your own signed-in account. They have no public link.
• We never publish, share or sell them, never use them for advertising, and never use them to train AI models.
• You can replace or delete any photo or name at any time, or delete all your family details in one step in My family. Deleting your account deletes them too.

The service is meant for adults to use with children. Children don’t create accounts, and we don’t knowingly collect personal data directly from children. If you think a child has given us personal data, contact privacy@flashcardsarabia.com and we will delete it.

We only use what’s needed to make the service work:

• Session cookie — keeps you signed in.
• Checkout cookie — a short-lived, signed cookie that links a guest payment to the browser it was made on, so your sets open straight away.
• Local storage — your cart, player settings and last-played card, kept on your device.

We don’t use advertising or analytics cookies. If that ever changes, we’ll update this policy first and ask for your consent where the law requires it.

We share personal data only with service providers who help us run flashcardsarabia.com, under contracts that require them to protect it and use it only on our instructions:

• Stripe — payment processing. Stripe collects your card details directly and handles them under its own privacy policy.
• Resend — delivering our emails (such as sign-in links and order confirmations).
• Our hosting provider — runs the website and servers.
• Our database provider — stores account, order, progress and family profile data, including photos.
• Google — only if you choose to sign in with Google.

We may also disclose data if the law requires it, or to protect the rights and safety of our customers or ourselves.

Some of our providers process data outside the UAE. When that happens, we make sure the transfer is allowed under the PDPL — for example because the destination has adequate data protection, or because contractual safeguards are in place.

• Account, progress and family profile: for as long as your account is open. Family photos and names are deleted as soon as you remove them.
• When you delete your account: we immediately delete your family photos and names, learning progress, sessions and sign-in details, and remove your name and email from your account record.
• If we stop offering the service: we use your email address and order history to send you a copy of the sets you bought (see our terms), then delete your account data as if you had deleted your account.
• Orders: kept for as long as UAE tax and commercial record-keeping rules require (generally at least five years), even after you delete your account.
• Emails you send us: for up to two years after your conversation ends, unless we need them longer to resolve a dispute.

All traffic to flashcardsarabia.com is encrypted (HTTPS). Passwords are stored only as secure hashes, family photos are checked against your account every time they load, and access to our systems is limited to people who need it. No system is perfectly secure, but we take care to protect your data and will tell you and the authorities if a breach affects you, as the law requires.

Under the PDPL you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete your data (subject to what we must keep by law);
• restrict or stop certain processing, or object to it;
• send your data to you or another provider in a commonly used format;
• withdraw consent you gave (for example, for family photos) at any time.

Many of these you can do yourself in Orders & account and My family. Otherwise, email privacy@flashcardsarabia.com. We’ll reply within 30 days. If you’re unhappy with how we handle your data, you can complain to the UAE Data Office.

We’ll update the “last updated” date whenever this policy changes, and email you before any important change takes effect.