Privacy Policy

1. Who is responsible for your data

wa3i by GHS is a business-to-business service. Your employer or organization (the "Organization") signs up, invites you, and decides which courses and phishing-awareness exercises you take. For the learning and account data described below, the Organization decides why and how it is used (it acts as the data controller) and GHS processes that data on its behalf (GHS acts as the data processor).

GHS is the data controller for a small set of data it handles for its own purposes: enquiries sent through the public contact form, support requests, security and audit logs, and the operation and protection of the Platform itself.

If you have a question about how your Organization uses your training results, contact your Organization's administrator first.

2. What we collect

We collect only what is needed to run the training service.

• Account data: name (and optional Arabic name), work email address, role, department, job title, preferred language, and your organization. Your password is stored only as a one-way hash, never in readable form.
• Security data: if you turn on two-factor authentication (MFA), your authenticator secret, stored encrypted. We also record your last login time.
• Learning data: course assignments and due dates, progress, start and completion dates, quiz answers, scores and pass/fail results, certificates issued, points, badges, and challenge progress.
• Phishing-awareness exercise data: when your Organization runs a simulation, practice messages appear inside your logged-in inbox on the Platform (no real email is sent). We record whether you opened, clicked, reported, or marked a message as safe, and whether you reached the fake credential form. Anything you type into that fake form is not stored; only the fact that you submitted it is recorded.
• Notifications: in-app notifications and the emails sent to you (invitations, password resets, email-change confirmations, course reminders).
• Requests you send us: the subject and text of support requests, and for visitors the name, email, organization, interested plan, and message submitted through the public contact form.
• Audit and technical data: a log of important actions (sign-ins, failed sign-ins, password and role changes, invitations, course assignments, report exports, account deletion requests), each with the acting account and, for security-relevant events, your IP address. Request IP addresses are also used transiently for rate limiting.

3. Why we use it

We do not sell personal data, and we do not use it for advertising or to build advertising profiles.

• To create and secure your account and sign you in.
• To deliver courses, quizzes, certificates, gamification, and phishing-awareness exercises, and to show progress to you and your Organization.
• To let your Organization's administrators and managers assign training, follow completion and risk results, and produce compliance reports.
• To send service emails and notifications that you need to use the Platform. We do not send marketing email to learners.
• To detect and prevent abuse (rate limiting, audit logging, brute-force protection) and to investigate security incidents.
• To answer support requests and contact-form enquiries.
• To meet legal obligations and to establish or defend legal claims.

4. Who can see your data

• You can see your own account, progress, results, certificates, and badges.
• Your Organization's administrators can see the accounts, assignments, progress, quiz results, certificates, and phishing-exercise outcomes of people in that Organization, and can export reports. Managers see the people in the scope they are given.
• GHS platform administrators can access any Organization's data when needed to provision accounts, provide support, keep the Platform secure, and carry out deletion requests. Such access is limited to authorized staff.
• Other Organizations cannot see your data. Each Organization's data is separated at the database level with row-level security.

5. Service providers and third parties

We use a limited number of providers to run the Platform. They receive only what they need for their function:

• Hosting and database: the servers, database, and cache that run the Platform host all of the data described above.
• Content delivery and security: web traffic to the Platform passes through Cloudflare, which acts as a reverse proxy and security layer. Cloudflare therefore processes the technical details of each request (such as IP address and request contents) in transit.
• Email delivery: service emails are sent through our email provider (Microsoft 365 SMTP or Resend), which receives the recipient's email address and the message.
• Video lessons: some lessons embed YouTube videos using YouTube's privacy-enhanced mode (youtube-nocookie.com). When a lesson page with a video loads, YouTube receives your IP address and browser details under its own privacy policy.
• AI-assisted course authoring: GHS administrators can use an AI provider to draft course content. Only the course topic and target audience typed by the administrator are sent; no learner data is sent.
• Fonts are served from our own server; the Platform does not load third-party fonts, analytics, or advertising scripts.

6. Cookies

The Platform uses only cookies that are needed for it to work or to remember your choices. It does not use advertising or analytics cookies.

• Session cookie (ghs-lms-session): keeps you signed in; HTTP-only, expires after 1 hour.
• Login-ticket cookie: a short-lived (5 minutes) cookie used during sign-in, for example while you complete two-factor verification.
• Language cookie (NEXT_LOCALE): remembers English or Arabic.
• Theme cookie (theme): remembers light or dark mode for up to one year.
• If you play an embedded YouTube video, YouTube may set its own cookies once you press play.

7. How long we keep data

• Account and learning data are kept while the account is active and the Organization uses the Platform.
• When an account or an Organization is deleted, deletion is not immediate: it enters a 30-day grace period during which it can be cancelled and the account cannot be used. After the grace period, the account and the data it owns (enrollments, quiz attempts, certificates, phishing results, points, and badges) are permanently erased.
• Audit records are kept for security and accountability. When a person is erased, the audit entries they created are kept but detached from their account; the email address of the erased account is retained in the audit entry that records the erasure. When a whole Organization is erased, its audit history is erased with it and a single platform-level record of the erasure (organization name and identifier) is kept.
• An organization whose free trial ends is locked but not deleted, and its data is preserved until it upgrades or is deleted.
• Contact-form enquiries and support requests are kept for as long as needed to respond and for our business records.

8. How we protect data

• Passwords are hashed with Argon2; MFA secrets and AI provider keys are encrypted at rest.
• Connections to the Platform use HTTPS, and session cookies are marked Secure.
• Each Organization's data is isolated using database row-level security, and access is checked on the server for every action based on role.
• Sign-in and two-factor attempts are rate limited, and sensitive actions are written to an audit log.
• No system is perfectly secure. If a personal-data breach affecting you occurs, we will notify the affected Organization and the competent authority as the law requires.

9. Your rights

Under the PDPL you have the right to know what data is held about you, to access it, to ask for it to be corrected, and to ask for it to be destroyed, subject to legal limits. Because your Organization is usually the controller of your training data, the fastest route is to ask your Organization's administrator, who can correct your details and request erasure of your account. You can also contact us at the address below and we will help route or fulfil the request, and we may need to verify your identity first.

You can change your password, your language, and your two-factor settings yourself under your account settings. You may also file a complaint with the competent Saudi authority if you believe your data was handled unlawfully.

10. Where data is processed

Data is stored on the servers we use to host the Platform. Some providers listed above (for example Cloudflare, our email provider, and YouTube) may process data outside Saudi Arabia. Where personal data is transferred outside the Kingdom, we do so only as permitted by the PDPL and its implementing regulations and with appropriate safeguards.

11. Children

The Platform is a workplace service for adult employees. It is not directed at children, and we do not knowingly collect data from them.

12. Changes to this policy

We will update this page when our practices change and revise the "Last updated" date. For material changes, we will notify Organization administrators.