Privacy Policy

1. Controller and scope

RALMIX LLC determines the purposes and means of processing personal data used to operate the RALMIX Platform. Its published details are Registration No. 300530, Tax No. 769-509-029, Office No. 6, Apartment No. 1, 1202 Mohamed Mostafa Hammam Street, Nasr City, Cairo, Egypt. Send privacy enquiries to ralmix.top@gmail.com or use https://ralmix.top/contact/.

This notice covers visitors, Students, Tutors, Parents / Guardians and people contacting RALMIX. A Tutor may have independent responsibilities for records they lawfully keep for their own professional obligations. A provider may act as processor for some activities and controller for its own account, security or statutory purposes. Roles depend on actual processing, not the label in a contract.

The DPA framework applies only to separately agreed processing on an organisation's instructions. It does not replace this notice or turn every Tutor or individual Student into a business customer.

2. Data obtained directly from you

Depending on the functions you use, RALMIX processes:

• Account and contact data: name, email, account identifier, role, authentication-related records and contact details you supply. Do not send your password in support correspondence.
• Profile data: photograph, biography, teaching subjects and languages, experience, qualifications, country, time zone, availability and displayed lesson price. Tutors may submit evidence for review through the applicable process.
• Learning information: goals, preferences, chosen Tutor, Lesson schedule, duration, attendance-related events, learning requests and materials you submit.
• Communication data: messages, support conversations and tickets, enquiries, attachments, complaint details and responses.
• Parent / Guardian information: information supplied about authority to act, relevant child and adult account references, and records of a declaration or permission where the process is used. A declaration is not independent identity or guardianship verification.
• AI input and output: questions, task instructions, answers, learning context and generated responses when you use an available AI feature.

Provide only information needed for the feature. Do not put identity documents, payment credentials, medical records, a child's home address or another person's sensitive information into a public profile or ordinary message. If sensitive information is necessary for a lawful request, contact us first about an appropriate method.

3. Technical data and information from others

Website and service operation involves network and device information, such as IP address, request times, browser characteristics, error records and authentication/session events. The extent depends on the service and its configuration. Cookies and browser storage are addressed in the Cookie Policy.

We also receive information from your counterpart in a Lesson, an authorised adult, a complaint reporter and, where used, Google sign-in. Such information can include identity/contact fields needed for sign-in, not a general right to read your Google account. We may obtain relevant information from publicly available Tutor materials or competent authorities for a specific lawful review. We do not assume a report is accurate simply because it was submitted.

4. Purposes and lawful grounds

We distinguish necessary service processing from optional uses. Where GDPR applies, the intended allocation is:

• Requested Account and Lesson administration: steps requested before a contract and performance of the relevant contract, to the extent processing is objectively necessary. Where a child's data concerns a contract with an adult, that fact alone does not establish a contractual basis for every use of the child's data.
• Account security, proportionate fraud prevention, complaint handling and legal defence: legitimate interests where permitted after balancing the interests and rights involved; a legal obligation where specifically applicable. Children require particular weight in that assessment.
• Required accounting, legal disclosure and compliance records: the applicable legal obligation, with scope limited to that obligation.
• Optional analytics, marketing or optional publication of identifiable media: consent where required, obtained separately for the stated purpose. A contract or general policy acknowledgement is not that consent.
• Emergency protection: vital interests only where the legal conditions genuinely apply, not as a routine justification for monitoring.

Egyptian and other applicable laws may impose different grounds, permits or special conditions. GDPR legitimate interests are not a universal substitute for consent or authorisation required elsewhere. Sensitive data, including children's data where classified as sensitive by applicable law, requires the additional legal conditions applicable to it. We must not use an incompatible new purpose without the required notice and lawful basis.

5. Public and private information

Information designated for an approved public Tutor profile is visible to visitors and may be indexed by search engines. Consider what you publish: a teaching biography does not need a private home address, personal identity number or contact details that circumvent Platform rules. Public content can be copied by others; we cannot guarantee removal of every independent third-party copy.

Account credentials, private support history and private messages are not public profile information. Recipients of a message or shared material can see what you send. RALMIX's content licence is limited by the Terms of Use and does not make private communications public.

6. Online classroom and live media

The published classroom uses LiveKit Cloud to transport live audio/video and connection information. RALMIX handles Lesson and participant identifiers for classroom access. Live media and screen content you choose to share are transmitted to the other participant through the video infrastructure; connection diagnostics may also be processed. This is not a claim that media remains exclusively on your device or exclusively in one country.

The current classroom does not offer routine lesson recording, transcription, AI meeting agents or hidden staff listening. Ordinary service logs are not an audiovisual recording of the Lesson. Camera/microphone controls and browser permissions allow you to control your transmission, but do not prevent an unauthorised recipient from attempting their own capture.

Reviewing submitted complaint evidence is different from joining a live Lesson. Any future recording, transcription or additional human participation requires its own legal assessment, clear notice and appropriate controls before introduction. Accepting this notice does not authorise those future uses.

7. AI-related processing

As of September 25, 2026, the deployed AI Tutor uses locally generated fallback responses: the external OpenAI API integration is not configured with an API credential. AI questions, learning preferences and conversation records are still processed by RALMIX for the requested feature; “local” means on RALMIX's service, not exclusively on your device. This configuration does not send AI Tutor inputs to OpenAI.

Before enabling an external AI provider, RALMIX must disclose that provider, the inputs sent, purposes, relevant retention and transfer arrangements, and obtain any permission required by law. A technical option requesting no response storage would not by itself guarantee zero provider logs or retention. No permission is granted to send unrelated support history or live Lesson media. Do not submit secrets or third-party sensitive data. The AI Tutor Terms explain appropriate use and limitations.

8. Recipients and service providers

We disclose information only for a defined purpose and with the applicable legal basis:

• The participating Tutor, Student and appropriately authorised adult receive the information needed for the learning interaction and agreed oversight.
• Hosting, email and technical service providers process data needed to deliver and secure the Platform. Gmail handles the published support email. Google services may receive sign-in data or technical requests for hosted fonts when those services are used.
• LiveKit processes the live media and connection data described above. AI Tutor currently uses the local fallback described in section 7; this notice does not represent OpenAI as an active recipient of AI Tutor inputs.
• Yandex Metrika is integrated for website analytics; its tags can process usage, interaction and device/network information. The Legal Center loads it only after an analytics choice and disables session replay there. The Cookie Policy explains the scope of these controls; this notice does not assert that all other pages or third-party services have been verified to honour the same choice. Website analytics is separate from recording an online Lesson.
• Enquiries routed through a connected staff messaging service, including Telegram where configured, can be accessible to the authorised receiving team and that provider. Do not submit sensitive evidence through a general enquiry form.
• Advisers, competent authorities or a court may receive records necessary for legal obligations, a lawful request or legal claims. A business transfer may require limited disclosure under confidentiality and applicable privacy restrictions; it is not permission for unrestricted sale of personal data.

Card checkout and commercial payouts are not currently activated under the published Payments information. We do not list an imaginary processor or claim that card details are already being processed by a particular bank. Provider additions require an updated assessment and disclosure where material.

9. International processing

RALMIX is operated from Egypt. A Tutor or Student may be in another country; an Egyptian Tutor can receive a European Student's live image, voice and shared learning information. Providers and authorised personnel may also process data in other countries. The actual recipients, access arrangements and provider locations matter, not merely the location selected for a media server.

Applicable transfer restrictions continue to apply. These may require an adequacy decision, appropriate safeguards, a permitted exception or regulatory authorisation, depending on the jurisdiction and transfer. Where GDPR requires safeguards, you may request information about the relevant mechanism and a copy subject to lawful redaction. Egyptian requirements must be assessed separately. Acceptance of these Terms or use of the website is not blanket consent to every international transfer.

This notice does not certify that every required transfer instrument, registration or permit has been obtained. Where a necessary condition is absent, the affected processing must not be treated as authorised merely because it is described here.

10. Retention and closure

Retention is determined by purpose, sensitivity, legal requirements, dispute periods and whether less information would suffice. Account/profile data is needed while the Account is maintained. Lesson and communication records may remain necessary to provide continuity and resolve issues. Moderation and complaint records may need to preserve the history of a decision even after a profile changes. Security logs require a proportionate period for detecting and investigating misuse. Financial records, if transactions are introduced, follow the applicable statutory retention rules.

Closure is not identical to immediate deletion of every record. We must identify what can be erased, what should be restricted and what has to remain for a stated lawful reason. A preservation requirement should be limited to relevant records and reviewed when it ends. Residual backup copies must not be restored into ordinary use in a way that defeats a completed deletion without addressing it. We do not claim an implemented universal deletion timetable that has not been established.

You can request the period or criteria for a particular category. Optional consent records may be retained as necessary to demonstrate a choice and its withdrawal, without continuing the optional activity. We do not rely on vague “future usefulness” as an unlimited retention purpose.

11. Security and incidents

RALMIX uses Account access controls and service authorisation mechanisms. Appropriate safeguards must match the sensitivity and risks of the processing. No website or communication service is immune from error, unauthorised access or disruption; this is not a disclaimer of the duty to protect personal data.

This notice does not claim SOC 2, ISO 27001, PCI certification, end-to-end encryption for every service, or a certified penetration-testing programme. Report a suspected privacy/security incident without exploiting it or collecting further users' data. RALMIX must assess and contain incidents and make any required notifications within the deadlines and conditions of applicable law, without waiting unnecessarily for every fact to be known.

12. Your rights and how to exercise them

Depending on applicable law and the processing, you may request confirmation/access, correction, deletion, restriction, portability, objection, withdrawal of consent and information about recipients or safeguards. Contact ralmix.top@gmail.com with enough information to locate the relevant Account or activity. You need not know the name of a statute to make a request.

We may ask for proportionate verification where needed to avoid disclosing someone else's data. Do not send identity documents unsolicited. An authorised representative must show appropriate authority. We must explain a lawful refusal or partial response and available complaint routes. Other people's privacy and lawful confidentiality can require redaction rather than refusal of an entire request.

Where GDPR applies, the usual response period is one month, with a permitted extension of up to two further months for complexity or number of requests; any extension and its reasons must be communicated within the initial month. Requests are normally free, subject to the limited statutory exceptions. Other applicable laws may impose different or shorter requirements.

Objection to direct marketing must be respected. Withdrawing consent does not make earlier lawful processing unlawful and does not require deleting records retained on another valid basis. You may complain directly to a competent authority, including Egypt's Personal Data Protection Center or your relevant European supervisory authority where applicable, without first exhausting support.

13. Children and automated processing

Read the Child Privacy Notice and Parent / Guardian Agreement. An adult declaration, a verified email address and legally sufficient parental consent are not interchangeable. A child's entitlement to privacy continues even where an adult arranges the service. We must limit what is disclosed to an adult to their lawful authority and the child's interests.

Recommendations or generated learning suggestions are not promises of professional assessment. If a decision with legal or similarly significant effects is based solely on automated processing, applicable legal conditions and safeguards must be satisfied, including information and human intervention rights where required. This notice is not an advance waiver of those safeguards.

14. Optional communications, updates and contact

Service messages about access, appointments, safety or a request are distinct from promotional messages. Marketing requires the applicable lawful permission and a usable withdrawal route. A newsletter form or an Account does not prove that permission exists for all channels.

We will give appropriate notice of material changes to processing and obtain new consent when required. Publishing a changed Privacy Policy cannot retrospectively legalise an undisclosed use. Questions can be sent using section 1 or the Contact and Legal Notice.