Mehbara is a private learning platform for the students, families and staff of one
language academy. It is not a public website, it is not advertising-supported, and there is
nothing on it to sign up for. This page says plainly what is held, why, and for how long.
The short version. We hold what is needed to teach you and to tell you
how you are doing. We do not sell it, we do not share it for marketing, and we do not
profile anybody. There is no advertising on this platform.
Who is responsible
The academy that enrolled you is the data controller. The platform is
operated on its behalf by Wexels, acting as a data processor — meaning we
run the software and follow the academy's instructions, and we do not use anybody's
information for our own purposes.
What is held, and why
Accounts
- Name, and a way to sign in — an email address or a Student ID.
- An optional phone number, where the academy has one.
- A parent or guardian's name and email, where a student's results are sent to them.
- The role, level and group a person belongs to.
Many students have no email address at all, and that is a normal enrolment
here rather than an omission. Where a student has none, their results go to a linked parent.
Work
- Answers submitted to tasks, the marks awarded, and any feedback a teacher writes.
- A voice note, where a task asks a student to record or upload one. It is kept with the
answer, and only the student, their linked parent once the result is shown, and staff who
can see that work can play it.
- When a task was opened, handed in, and whether it ran past its timer or due date.
- Practice attempts in Extras are not recorded as results. The scratchpad
holding an unfinished practice run is deleted after 30 days.
Speaking practice
In a Speaking task a student talks with the academy's AI tutor. Each spoken answer goes
straight from the browser to the AI service, is turned into text and answered. Both sides of
the conversation are recorded and kept privately for 90 days so the teacher
can listen, and then deleted. What is kept:
- The written transcript of the conversation and its short feedback report, deleted
automatically 12 months after the session.
- When a task has the pronunciation checker on, up to three sounds to practise and the tutor's own recording of each example word — never the student's voice.
- A safety check of the transcript (for example, somebody sharing a phone number or asking
to meet), kept for 30 days so staff can act on it.
The tutor is told only the student's first name and level, never a surname, email address or
Student ID.
Messages
Conversations between staff, students and parents are stored so they can be read again.
Nobody can delete a conversation from the platform — archiving hides it from an inbox and
keeps it intact. An academy owner can be granted permission to read any conversation in
their own academy; that is a deliberate setting, not the default.
Sign-in and devices
- A record of the devices an account is signed in on, capped at two, so a lost phone can
be signed out.
- The time of the last sign-in.
Passwords are stored hashed. Nobody at the academy or at Wexels can read
one, and no screen will ever show you an existing password.
What is not held
- No payment or card details — there is no payment processing on this platform.
- No advertising identifiers, and no profiles built for marketing.
- No location tracking.
- No video of students. The only student audio kept is a Speaking conversation (for 90
days, as described above), a voice note handed in as homework, or a clip the academy
features with written consent.
- No data sold or shared with anybody for their own purposes. Ever.
AI assistance
Some work is marked, transcribed or explained with help from AI. That runs on the AI service
operated for the academy by Wexels, on its own servers, under the same processor terms as
the rest of the platform.
- The AI is given the task, the question, the student's answer and the teacher's marking
guide. It is not given names, email addresses or Student IDs.
- A voice note is turned into text first, and only the text is marked.
- A teacher can review and change any mark or feedback the AI gives.
- Nothing a student writes or says is used by Wexels to train AI models.
Other services the platform uses
- Email is sent through the academy's mail provider, carrying the name and
address it is sent to.
Email
This academy has notifications switched on, so the platform emails a
student and any linked parent when work is marked, and when a message arrives.
Everything else is sent only when a member of staff presses a button: an invite, a password
reset, or a progress report. There is no marketing email of any kind, so there is no
marketing list to unsubscribe from.
Cookies and measurement
No analytics or advertising scripts run on this site. The only cookies
set are the ones that make signing in work: a session cookie and a security token. Both
are essential, neither tracks you anywhere, and neither is shared.
Embedded video
Some tasks include a video. Those are played from YouTube's
no-cookie service, which sets nothing at all until somebody actually
presses play. Related-video suggestions are switched off, so a video never leads a student
somewhere else. If a student does press play, YouTube sees that request — we cannot make
that untrue, and we would rather say so than pretend otherwise.
Children
Students on this platform include children. Accounts for them are created by the academy as
part of enrolment, never by the child, and never through public sign-up.
- A child's account holds their name, their work and their marks — nothing more than
teaching requires.
- A parent account sees a read-only mirror of their own child, and can
never act as them.
- Children can only message the staff who teach them. They cannot message each other, and
they cannot be contacted by anyone outside the academy.
- Message sending is rate-limited for students, to keep the feature calm.
Where consent is the basis for anything concerning a child, it is the parent or guardian's
to give, through the academy.
Your rights
Under the UK/EU GDPR, Egypt's Personal Data Protection Law (No. 151 of 2020), US laws such as
COPPA where they apply, and equivalent laws, you may ask the academy to:
- See what is held about you or your child.
- Correct anything wrong.
- Delete an account. Note that marked work is kept as an academic record
for as long as the academy needs it — deleting a student's grades on request would make
the academy's own records untrue.
- Export a copy in a portable format.
- Object to a particular use, or withdraw a consent you gave.
Ask the academy and they will act on it. If you are not satisfied, you may complain to your
national data protection authority.
How long things are kept
- Accounts — for as long as somebody is enrolled, and afterwards only as
long as the academy needs the academic record.
- Work and marks — kept as the academic record.
- Messages — kept, because a conversation about a child is often exactly
what somebody needs to produce later.
- Voice notes — kept with the answer as part of the academic record, and
removed if the student redoes the task.
- Speaking recordings — both sides of each conversation, kept privately for 90 days, then deleted.
- Speaking transcripts and reports — deleted after 12 months.
- Text pasted into an answer — kept with the paper's evidence for one year.
- Speaking safety checks — deleted after 30 days.
- Practice runs in Extras — deleted after 30 days.
- Device records — until signed out or revoked.
Academic honesty
While a student works on a task, the platform may note leaving the page, pasting text and how
an answer was written, so a teacher can look at it. The clipboard is never read in the background.
When text is pasted into an answer, what was pasted is saved so a teacher can see it.
The Trust System never uses a camera or microphone, and nothing is decided automatically. The details are on the
Academic honesty page.
Security
- Traffic is encrypted in transit.
- Passwords are hashed, never stored or displayed in a readable form.
- Sign-in attempts are rate-limited, and public forms are protected against automated
abuse.
- Each academy's data is isolated from every other academy at the database layer.
- Who can see what is governed by named permissions rather than by job title.
Changes
If this page changes in a way that affects you, the academy will tell you. The date at the
top always reflects the current version.
Getting in touch
Questions about this page, or about information held on you or your child, go to the
academy directly. Ask, and you will get an
answer from a person.
