Sub-processors
Effective 22 Oct 2026 · If the Arabic and English texts differ, the Arabic text governs.
To run Mudarraj we rely on specialist companies for hosting, video, email, notifications and payments. They are called sub-processors because they process personal data on behalf of us and the academies. This page is for academy owners, data protection officers, and anyone who wants to know where their data goes.
How we choose and manage them
- We give each provider only the data it needs for its role.
- Each provider commits to us in writing to process data only on our instructions, keep it confidential, and protect it with appropriate security.
- We remain responsible to academies for our providers meeting these terms, as set out in the data processing addendum.
Current list
| Provider | Purpose | Data | Location and safeguards |
|---|---|---|---|
| Cloudflare | Lesson video (Cloudflare Stream), content delivery and site protection, and storage (R2) if used | Videos and files, IP address and technical request data | Global network that may process data outside Egypt; with the transfer safeguards and permits the law requires |
| File storage provider (Cloudflare R2 or another S3-compatible provider) | Storing uploaded files | Profile photos and course files | We list the provider and region here before any personal data is processed there |
| Hosting and database provider | Running the application servers and the database | All the data categories in the privacy policy | We list the provider and region here before any personal data is processed there |
| Email (SMTP) provider | Sending account email: verification codes, password resets and payment notices | Name, email address and message content | We list the provider and region here before any personal data is processed there |
| Google Firebase Cloud Messaging | Sending notifications to the mobile apps | The device's push token and the notification text | Google servers outside Egypt; with the transfer safeguards and permits the law requires |
| YouTube (Google) | Lessons and live streams an academy chooses to host on YouTube | IP address and browser data when you play | Google servers outside Egypt; YouTube follows its own privacy policy |
| Zoom, Google Meet and Jitsi | Live sessions an academy chooses to hold on them | Name and email when you join, IP address, and audio and video if you share them | Each service's own servers, possibly outside Egypt; chosen by the academy |
| Paymob and Fawaterak | Payments at academies that enable one of them | Name, email, phone and order amount; card details are entered on the gateway's own page | The academy contracts with the gateway directly; the gateway handles payment data under its own privacy policy |
Transfers outside Egypt
Some providers on this list process data on servers outside Egypt. We transfer personal data abroad only to parties that offer an adequate level of protection, and only after obtaining the permits required by the Personal Data Protection Law No. 151 of 2020. The table above shows where each provider processes data.
When we add or change a provider
- Before we add a new provider or replace one, we notify academy owners by email and in the dashboard at least 30 days in advance, and we update this page.
- An academy owner may object within those 30 days by writing to privacy@mudarraj.dev with the reason. We will work with them on a reasonable solution.
- If we can't find one, the owner may end their subscription before the new provider starts processing their academy's data, and we refund any prepaid fees for the remaining period.
- In an emergency affecting security or service continuity, we may replace a provider at shorter notice, and we tell academy owners as soon as possible, with the reason.
Contact us
For more details about any provider or about transfer safeguards, write to privacy@mudarraj.dev.