Privacy Policy

The controller of your personal data is TunEdu SARL, [registered office address], [RNE / tax ID], represented by its manager, Mr Mohamed Amine Slimani.

For any question about your data: contact@hadharli.com · WhatsApp / phone 56 251 081. [Possible data protection officer: to be completed.]

We process your data in accordance with Organic Law no. 2004-63 of 27 July 2004 on the protection of personal data and its implementing texts. Hadharli’s processing is the subject of [a declaration / an authorisation request] to the National Authority for the Protection of Personal Data (INPDP) [number and date: to be completed by the lawyer].

We only collect the data needed to run the service:

• Account: name, email address, password (stored only in hashed form by our authentication service, never in clear text), language, role, optional profile photo, phone number if you add it, referral code, creation and last-activity dates.
• Student profile: school level, subjects, city and governorate, optional bio.
• Teacher application: name, phone, city and governorate, highest degree, institution, graduation year, experience, subjects, levels, teaching modes, languages, availability, rate, bio, video link, and the supporting documents you send (ID card or passport, diploma), kept in a private space that only the verification team can open.
• Public teacher profile: display name, bio, city, languages, experience, subjects and rates, video, availability, reviews and statistics (response time, completion rate).
• Lessons: bookings, classes, enrolments, cancellations and their reasons, presence in the video room (join and leave times, duration), reviews.
• Video recordings of lessons, when the teacher chooses to record (image, voice and name of the visible participants).
• Messages and community: private conversations and attachments, posts, comments, likes, follows, saved posts, quiz answers, reports.
• Courses: enrolments, progress, completed lessons, quiz results.
• Private classrooms and centres: memberships, groups, invitations; for students imported by a centre, the name and, where applicable, the email or phone provided by the centre.
• Points and earnings: points balance and history, codes used; for a teacher, earnings, commission and payout history, and payout details (holder, RIB / IBAN or D17 number).
• Payments: order reference, payment method, amount, status; Ba9chich order number; for a bank transfer, D17 or money order, the transaction reference and the receipt you upload (image or PDF); for an online payment (Flouci, card via ClicToPay), the payment id and status sent by the provider. We never receive or store your card numbers.
• Cash on delivery: recipient name, phone number(s), governorate, delegation or city, address, postal code, note for the courier, tracking number; the activation code is only stored in hashed form.
• Partners and referrals: the link or code through which you arrived, and whether a first purchase took place. Clicks on partner links are counted in aggregate, per partner and per day, with no personal data.
• Technical and security data: session cookies, IP address and browser processed by the authentication service; IP address used in memory only, never stored in the database, to limit abusive attempts; a log of sensitive actions; notifications; preferences (notifications, privacy, language, display). Your approximate country, derived from the network, is recorded on your account to understand where the platform is used; neither the IP address nor the city is stored.

• Create and manage your account and sign you in — performance of the Terms.
• Match students and teachers and run bookings, classes, live lessons, courses, private classrooms and centres — performance of the Terms.
• Check teacher applications (identity, diplomas) before listing a profile — students’ safety and performance of the contract.
• Process purchases, payments, deliveries, refunds, earnings and payouts — performance of the contract and accounting and tax obligations.
• Record attendance and handle complaints — performance of the contract.
• Keep the service secure and prevent fraud (fake accounts, abuse of codes or bonus points, repeated returns of cash-on-delivery parcels, repeated attempts), log sensitive actions — legitimate interest and legal obligations.
• Send you service notifications, in the app and by email — performance of the contract; you can turn off non-essential categories in Settings.
• Help you, including, if needed, by viewing your account in read-only mode (section 8).
• Produce internal statistics (teacher, centre and admin dashboards) from our own data, with no third-party audience analytics tool.

Where the law requires it, in particular for minors, we collect the consent of the person concerned or their legal representative. [Legal basis of each processing under law no. 2004-63 (consent, contract, legal obligation, legitimate interest): to be confirmed by the lawyer.]

We do not sell your data and do not use it for targeted advertising.

• Other users, as far as needed: a teacher sees their students’ name, level and lesson history; a student sees the teacher’s public profile; participants of a lesson see each other in the video room; your posts are visible to the audience you choose.
• Your centre or your private-classroom teacher: members, classes, attendance and recordings of the lessons they organise.
• A partner who referred you only sees your first name and last-name initial, the account type, the sign-up date and whether a purchase took place — never your email, phone or purchase details.
• The TunEdu team, with access limited to each role (teacher verification, payments, deliveries, moderation, support).
• The courier, for a cash-on-delivery order: name, phone, address and amount to collect.
• Our technical and payment providers (section 5).
• Public authorities, where required by law.

We use providers that process data on our behalf and on our instructions:

• Supabase: database, authentication and file storage (supporting documents, receipts, recordings, media) — hosting region [to be completed].
• [hosting provider]: hosting and delivery of the web application — [region to be completed].
• LiveKit: audio and video transport for live lessons and production of recordings — [service and region: to be completed].
• [email / SMTP provider]: sending account confirmation and password reset emails.
• Ba9chich: the marketplace where you pay a Ba9chich order (you enter your details directly there).
• Flouci and ClicToPay (Société Monétique Tunisie): online payment; your card details are entered directly with them.
• [delivery company]: delivery and cash collection for cash-on-delivery orders.
• Your bank, D17 or the Tunisian Post, for the transactions you make with them.

YouTube or Vimeo videos embedded in the community only load when you click them; they are then subject to those services’ rules.

Some providers (hosting, database, video, email) may store or process data on servers outside Tunisia [countries / regions: to be completed]. Law no. 2004-63 strictly regulates such transfers and in principle requires the INPDP’s authorisation. [Transfer authorisation and contractual safeguards: to be obtained and confirmed by the lawyer before going live.]

• Account: while it is active. On deletion, the name, photo, phone number and profiles are anonymised immediately; the email address and technical identifiers are kept [period to be confirmed] for security and fraud prevention.
• Cash on delivery: phone numbers, address, city, postal code and note are erased automatically 180 days after the order ends (delivered, cancelled or returned); this period can be changed but never below 30 days. Only the first name, the governorate and the amounts are kept.
• Purchases, points and earnings history, payouts: [10 years] from the transaction, for accounting and tax obligations [to be confirmed].
• Payment receipts you upload: [period to be confirmed].
• Teacher application documents: during the relationship, then [1 year] after the decision or the closure of the profile [to be confirmed].
• Lesson recordings: until the teacher deletes them; they are not deleted automatically [maximum period to be confirmed].
• Messages, posts and notifications: while the account exists, unless deleted [to be confirmed].
• Security and activity logs, including “View as” accesses: [1 year] [to be confirmed].
• Cookies: see section 11.

We protect your data with appropriate measures: encrypted connections (HTTPS), passwords and activation codes stored in hashed form, private files reachable only through short-lived links after an access check, per-account data isolation, admin rights limited by role, and logging of sensitive actions.

“View as”: to solve a problem, an authorised team member (by default, only the super admin) can display the Platform as you see it, in read-only mode. Nothing can be done, bought or sent on your behalf, your messages are not marked as read and the video room is not accessible. Each access requires a written reason, lasts at most 30 minutes and is logged. You can see the date and duration of each access in Settings → Security → “Access by the Hadharli team”.

If a data breach puts you at risk, we will inform you and the INPDP as required by law [to be confirmed].

Under law no. 2004-63, you have:

• the right to access your data and obtain a copy;
• the right to correct inaccurate or incomplete data;
• the right to object for legitimate reasons, and to withdraw your consent where the processing relies on it;
• the right to ask for your data to be deleted, subject to legal retention periods.

In the app, Settings lets you correct your profile, download a copy of your data as JSON (account, profiles, bookings, points, posts, comments, messages), set your notifications and privacy, and delete your account.

For any other request: contact@hadharli.com. We answer within one month [legal deadline to be confirmed] and may ask you to prove your identity. For a minor, the request is made by their parent or guardian.

You can also contact the National Authority for the Protection of Personal Data (INPDP) [contact details: to be completed].

Many of our students are under 18, so we take particular care:

• a minor student uses Hadharli only with the consent of their parent or legal guardian;
• law no. 2004-63 sets specific rules for children’s data: in principle, the consent of the guardian and the authorisation of the family judge, who may also authorise it without that consent when the child’s best interests require it [practical arrangements — collecting and proving consent, any steps before the family judge, ages concerned — must be confirmed by the lawyer];
• we collect as little data as possible about students (no ID document, no address except for a delivery);
• purchases must be made or authorised by an adult;
• teachers agree not to ask a minor for contact details or a meeting outside the Platform;
• a parent or guardian can exercise the child’s rights (access, correction, deletion) by writing to us.

If you think a minor is using Hadharli without permission, contact us and we will take the necessary steps.

Hadharli uses no advertising cookies and no third-party audience analytics. We only use cookies needed for the service or for your preferences:

• session cookies (sb-…): keep you securely signed in, for the length of the session;
• NEXT_LOCALE: remember the language you chose;
• tunedu-design and tunedu-accent: display preferences (interface version, colour), 180 days and 1 year;
• tunedu_ref: referral code from an invitation link, until sign-up, 30 days;
• tunedu_partner: partner from a partner link, until sign-up, 30 days (adjustable);
• tunedu_join: class invitation code, until sign-up or sign-in, 7 days;
• tunedu_imp, tunedu_imp_admin, tunedu_imp_ui: only on a team member’s device during a “View as” access (encrypted), 30 minutes at most.

Your browser also keeps locally, without sending them to our servers: light or dark theme, menu state, recent searches, notification sound and drafts (teacher application, post, delivery form). You can clear them in your browser settings; without the session cookie, you cannot stay signed in.

[Cookie notice or consent banner: to be confirmed by the lawyer.]

We may update this policy. The date of the last update is shown at the top of the page; for a significant change, we tell you on the Platform or by email.