Privacy policy
1. Who we are
Isnad is operated by ZE RE SE HUB TECHNOLOGY (LLC) — زد آر إس هَب تكنولوجي — an Egyptian limited liability company, commercial register no. 237478, registered office: Administrative Building 5, Zizinia Resort, Fifth Settlement, New Cairo, Egypt ("the company", "we").
For anything about your data: info@zrs-hubtech.com.
2. What this policy covers, and who decides about your data
This policy covers the public website isnadeg.com and the hosted instance of the application, app.isnadeg.com, which we operate. It does not cover instances of Isnad that an organisation runs on its own servers or inside its own network; those are governed by that organisation's policy and its contract with us.
Who decides: when you use Isnad inside a workspace created by an organisation — a court, an arbitration centre, a board, a school, a training centre or a tutor — that organisation decides why the data is processed and who sees it (the controller), and we process it on its behalf and only to provide the service (the processor). The company is responsible for the basic account data it needs to run the platform, and for visits to the public website.
3. The data we process
| What | Examples | From |
|---|---|---|
| Account data | Name, email address (your login), phone number if added, interface language. Your password is never stored as such — only a one-way fingerprint of it, which nobody, including us, can turn back into the password. | You, or the organisation that invited you |
| What is filed in workspaces | Documents and recordings and the text of their pages, machine readings of scanned pages, notes and discussions, submitted work, marks, certificates | People in each workspace |
| Session and attendance log | When each person joined and left, in-room check-ins and who recorded them, answers given in live solving | Running a session |
| Viewing log | Which parts of a recording were watched, and when | The video player |
| Access log | Who opened what and when, what was refused, the IP address and the route requested | Every request to the system |
Points and standings in the education product are not stored; they are worked out from the records above each time they are asked for.
4. Why we process it
- To provide the service the organisation asked for: keeping, numbering, showing and searching its files, running sessions, producing records.
- To protect the files: authenticating people, applying permissions, logging every access and every refusal.
- To meet a legal obligation that applies to us.
We do not use your data for advertising, sell it, profile your behaviour, or train artificial-intelligence models on it.
5. What we do not do
- We send no email and no text messages. The platform sends nothing to your inbox or phone; invitations are links and codes handed over by whoever invited you, and notifications are in the app only.
- No cookies in the application, and no tracking or analytics tools. One sign-in token is kept in your browser; it expires after eight hours or when you sign out.
- No workspace content is sent to any outside party for processing. Machine reading of scanned pages runs on the platform's own server. Any automated tool that proposes marks or anything else is off by default; if an organisation switches one on and it is outside its network, the instance's admin console says so.
- Checking a certificate identifies nobody. The "Verify a certificate" page computes the file's fingerprint on the checker's own device and sends only that fingerprint; nobody can be looked up by name or number.
6. Who sees your data
- Inside each workspace: according to the role the organisation gave, and for an access window that can end on its own. Private notes are seen by their author only. In the education product, pupils do not see classmates' names in the standings.
- The system administrator runs the instance and cannot open a workspace they are not a member of.
- Company staff, as far as needed to run and maintain the platform, or at the organisation's request.
- Our hosting provider, Contabo GmbH (Germany), on whose servers the hosted instance runs, as a sub-processor.
- An authority, where the law or a court order requires it.
The public website loads its fonts from Google Fonts and shows a Google Maps frame in its contact section, so your device's IP address reaches Google when you open it. The application itself loads nothing from any outside party.
7. Where it is stored, and how it is protected
The hosted instance's servers are with Contabo in France. Which means this instance’s data leaves Egypt, said here rather than left to a line in a document. Where your own law or rules require otherwise, organisations can contract for a dedicated instance hosted where their law requires, or running entirely inside their own network.
What we do today:
- Every connection between your browser and the platform is encrypted (TLS).
- Passwords and invitation codes are stored as fingerprints, not as text.
- Every request passes a single permission check based on your role in the workspace, and is written to an access log.
- Every file is kept with a SHA-256 fingerprint that proves it has not changed since it was filed.
What we do not do today, stated plainly: files stored on the server are not encrypted at the storage layer. Someone with access to the server itself, or to a copy of its disk, could read them. We say so because an organisation needs to know it when choosing where its instance is hosted.
8. How long we keep it, and how it is deleted
- A workspace's data is kept while the workspace exists. The organisation can conclude it (it becomes read-only) and then archive it.
- Only its owner can delete a workspace, and only from the archive. Deletion removes everything in it, including stored files, and cannot be undone. What remains is one summary row for each person who reached it — name and email, first and last access, how many times, and whether anything was refused — and not the detail of what was opened.
- There are no backups on the hosted demonstration instance; what is deleted cannot be recovered.
- An issued certificate is a fixed record: it is revoked, never edited, and is deleted with the course.
- An account is deleted at your request or the organisation’s; there is no way inside the app today to delete your own account.
9. Children
The education product may be used by pupils under eighteen. The body that enrols a pupil — the school, centre or tutor — is responsible for obtaining their guardian's consent before enrolling them. Pupils do not see each other's names in the standings, and a pupil is never shown what an automated tool proposed about their work before the teacher adopts it.
10. Your rights
Under the Personal Data Protection Law No. 151 of 2020 you may know what data we hold about you and see it, ask for it to be corrected, deleted or restricted, and object to its processing, within the limits the law sets.
If your data is inside an organisation's workspace, contact that organisation first, as it decides about it; we will help it respond. You can always write to us at info@zrs-hubtech.com, and you may complain to the Personal Data Protection Centre.
11. Changes to this policy
Any change is published on this page with its date. Material changes are notified to contracted organisations before they take effect.