Privacy Policy

1. Who we are

The Service is operated by Nowaty iCode. For privacy purposes we act as the controller of personal data we decide how to process for operating the platform, and as a processor when an educational institution (university, school, or training provider) instructs us to host courses and learner records for them.

Website

https://icodelearn.com

Service

The iCode learning platform: courses, assessments, automated grading, materials, announcements, and inbox messaging.

Primary location

Jordan (operations and hosting arrangements may involve other regions — see International transfers).

2. Scope

This Privacy Policy applies to personal information processed through the Service, including when you create an account, enrol in a course, take exams or practice exercises, upload or view materials, use messaging, or contact us.

It does not apply to third-party websites or tools we link to. Those providers have their own policies.

Where local law grants stronger rights than described here, that law prevails.

3. Data we collect

We collect only what we need to run a secure learning platform. Categories typically include:

Account & identity

• Name
• Email
• Username
• Password (hashed)
• Phone (optional)
• Profile photo
• Role (student, teacher, admin…)
• Institution identifiers

Learning & academic activity

• Course and section enrolments, roles, and participation.
• Exam and exercise attempts, code submissions, answers, grades, feedback, and related metadata (timestamps, attempt counts).
• Course materials you access or that instructors publish for your sections.
• Announcements targeted to your courses or roles.
• Inbox messages, reactions, and related delivery/read status within the Service.

Technical & usage data

• IP address, browser and device type, operating system, language, and approximate region derived from network data.
• Log data for security, abuse prevention, diagnostics, and performance (e.g. page views, error traces, compiler job status).
• Cookies and similar technologies (see Cookies).

Communications

Messages you send to us (support, privacy requests) and related correspondence.

Sources

• You — registration, profile updates, submissions, messaging.
• Your institution — bulk enrolments, section membership, or SSO if configured.
• Automatically — when you use the Service.
• Service providers — limited technical data needed to host, email, or secure the platform.

We do not require special-category data (e.g. health, religion, biometrics) to use iCode. Please do not submit such data unless your institution expressly requires it and has a lawful basis.

4. Legal bases (where applicable)

Depending on your location (for example under GDPR or similar laws), we rely on one or more of:

• Contract — to provide the account and learning features you or your institution requested.
• Legitimate interests — to secure the Service, prevent fraud/abuse, improve reliability, and support instructors/admins, balanced against your rights.
• Legal obligation — when we must retain or disclose information to comply with law.
• Consent — where required (e.g. optional marketing or non-essential cookies), which you may withdraw at any time.
• Public interest / education — where an institution processes assessment data under its educational mandate and we process it on their instructions.

5. How we use personal data

• Create and manage accounts, authentication, and access control.
• Deliver courses, exams, exercises, grading, materials, announcements, and messaging.
• Show progress, results, and academic records to authorised teachers and admins.
• Operate compilers, queues, and related assessment infrastructure.
• Maintain security, audit trails, rate limits, and incident response.
• Provide support and respond to privacy or account requests.
• Analyse aggregated or de-identified usage to improve product quality (we do not sell personal data).
• Send service notices (security, downtime, material policy changes). Marketing emails, if any, are optional and opt-out capable.

6. Sharing

We share personal data only as needed to operate the Service:

• Within your institution — teachers, coordinators, and admins for courses you belong to may see relevant academic and account information.
• Service providers — hosting, email delivery, monitoring, or similar processors bound by confidentiality and data-processing terms.
• Legal & safety — if required by law, court order, or to protect users, the Service, or our rights.
• Business transfers — in a merger, acquisition, or asset sale, with notice where required and continued protection of your data.
• With your direction — when you ask us to share information or use an integration.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

7. Cookies and similar technologies

We use cookies and local storage to keep you signed in, remember preferences (such as light/dark theme), protect against abuse, and understand basic Service usage.

You can control cookies through your browser settings. Blocking essential cookies may limit access to the Service.

8. Retention

We keep personal data only as long as needed for the purposes above, including:

• Account data — for the life of the account, then deleted or anonymised within a reasonable period after closure (unless the institution requires longer archival).
• Academic records — for the duration required by the institution’s academic policies and applicable law (often the length of the course plus an audit period).
• Messaging — while the conversation is active for participants; soft-deleted content may be retained briefly for recovery or abuse investigation.
• Security logs — typically for a limited period (for example weeks to months) unless needed for an ongoing investigation.
• Support tickets — until resolved and for a short follow-up period.

When retention ends, we delete or irreversibly anonymise data, subject to legal holds.

9. International transfers

iCode may be accessed from many countries. Servers, backups, or processors may be located outside your country. Where we transfer personal data internationally, we use appropriate safeguards recognised by applicable law (such as contractual clauses, adequacy decisions, or equivalent measures) and continue to protect the data as described in this policy.

10. Your rights

Subject to local law, you may have the right to:

• Access — obtain a copy of personal data we hold about you.
• Rectification — correct inaccurate or incomplete data (often via Profile / Manage Account).
• Erasure — request deletion (“right to be forgotten”), subject to academic or legal retention duties.
• Restriction — ask us to limit processing in certain cases.
• Portability — receive data you provided in a structured, commonly used format where technically feasible.
• Objection — object to processing based on legitimate interests, including profiling where applicable.
• Withdraw consent — where processing is consent-based, without affecting prior lawful processing.
• Complaint — lodge a complaint with your local data-protection authority.

Institution-managed accounts: some requests must go through your school or university first, because they may be the controller of your academic record. We will help coordinate where appropriate.

To exercise rights, use the contact options below. We may need to verify your identity before responding. We aim to reply within one month (or the period required by local law).

11. Security

We apply administrative, technical, and organisational measures appropriate to the risk, including encrypted transport (HTTPS), hashed passwords, access controls by role, and monitoring for abuse. No method of transmission or storage is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and/or authorities as required by law.

12. Children

The Service is intended for learners and educators in formal or organised learning settings. We do not knowingly collect personal data from children under 13 (or under 16 where a higher digital-consent age applies) without appropriate parental or institutional authorisation.

If you believe a child has provided data without proper authorisation, contact us and we will take steps to delete it promptly, unless retention is required by the institution under a lawful educational purpose.

13. Third-party links and content

The Service may contain links, embeds (for example YouTube), or previews of external sites. We do not control those sites and are not responsible for their privacy practices. Review their policies before providing personal information.

14. Changes to this policy

We may update this Privacy Policy to reflect product, legal, or operational changes. The “Effective” date at the top will be revised. Material changes will be highlighted on the Service or communicated by email where appropriate. Continued use after the effective date constitutes acceptance of the updated policy, except where consent is required by law.