The Masary Programme, an AI-enabled career guidance platform for students in Grades 8–12 is committed to protecting the privacy of every student, parent, counsellor, and visitor who uses Masary. This policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have over your data. Where this policy refers to “Masary” it includes the website, the learning platform, the AI guidance features, and related communications.
Data Controller: MindBase Education
Data Protection Office Contact: hello@masaryhub.com. All data-protection questions, requests, and complaints can be sent to this email address.
This policy covers personal data we process about three main groups:
Students (Grades 8–12), who use the Masary platform, complete assessments, and progress through the six-layer journey;
School staff, including counsellors, career-guidance teachers, and school administrators who use the counsellor dashboard;
Parents and guardians, who provide consent, receive updates, and use the parent portal; and
Website visitors, including general users, partners, and media visitors to masaryhub.com.
| Category | Examples |
|---|---|
| Identity & enrolment | Name, grade/year, school, gender, year of birth or age band, student identifier issued by the school or platform |
| Account & access | Username, encrypted password, login activity, device and session information |
| Assessment & profile data | Responses to the 4-D Discovery Assessment, CDSE-SF responses and scores, career archetype, RIASEC interest profile, pathway shortlist and fit scores |
| Learning & progress data | Module completion, quiz and assessment scores, layer progress, mini-project submissions, badges earned, time-on-task and engagement events |
| AI interactions | Messages exchanged with the Masary AI modules and the guidance, drafts, and feedback those generate |
| Action-plan data | University shortlists, application timelines, subject/stream choices, and target test scores recorded |
Name, work email, role, school, dashboard login activity, action-plan reviews, counsellor–student session notes, and reporting interactions.
Name, relationship to the student, contact details (email and/or mobile number for WhatsApp and broadcast communications), consent records, and parent-portal activity.
Directly from you when you register, complete assessments, interact with the AI personas, submit work, or contact us;
From your school, which provides enrolment and roster information under its agreement with MindBase;
Automatically, through the platform and website as you use them (activity logs, cookies, and analytics); and
From parents/guardians, when they provide consent or contact details.
| Purpose | Legal basis |
|---|---|
| Provide the Masary platform and deliver career guidance | Performance of our agreement with the school; consent of the student/guardian |
| Generate assessment results, pathway matches, and AI guidance | Consent; legitimate interest in delivering the service |
| Measure programme impact (e.g. CDSE-SF change, completion, longitudinal tracking) | Legitimate interest; consent for any optional follow-up |
| Report aggregated, de-identified outcomes to schools and stakeholders | Legitimate interest; contractual obligation to partners |
| Communicate with parents and schools (progress updates, events) | Consent; performance of agreement |
| Secure the platform and prevent misuse | Legitimate interest; legal obligation |
Masary is designed for students in Grades 8–12, many of whom are minors. We take particular care with their data. Where required by law, a parent or guardian must provide verifiable consent before a minor’s personal data is processed, and consent is obtained through the school and/or the parent portal as part of onboarding.
We collect only the data necessary to deliver guidance and measure impact, we do not sell children’s data or use it for behavioural advertising.
Students always operate within a counsellor-supervised environment; school counsellors have oversight of student journeys through the dashboard.
The Masary AI modules operate within strict policy boundaries. They do not write students’ essays for them, provide exam answers, guarantee admissions outcomes, or handle crisis or safeguarding situations, any such language is escalated to a human counsellor.
Parents and guardians may review their child’s data, withdraw consent, or request deletion at any time by contacting the school counsellor or our DPO.
Masary uses automated processing to generate assessment scores, pathway match suggestions, and AI guidance. These outputs are decision-support tools, not binding decisions: they are designed to inform conversations between a student, their counsellor, and their family. No student is subject to a solely automated decision that produces a legal or similarly significant effect without human counsellor involvement. Students and guardians may ask a counsellor to review or explain any AI-generated guidance.
We share personal data only with parties who help us run Masary, under written agreements that require them to protect it and use it only on our instructions.
We do not sell personal data. We may disclose data where required by law, regulation, or valid legal process in the UAE.
Masary data is hosted within the United Arab Emirates. Personal data is stored on infrastructure located in the UAE in line with national data-residency expectations. Where any processing or sub-processing would occur outside the UAE, we will only permit it where the law allows and where appropriate safeguards (such as contractual protections and an adequate level of protection) are in place.
We retain personal data only for as long as needed for the purposes described in this policy, for the duration of the school’s participation in Masary, and for any period required by law. After that, data is securely deleted or irreversibly anonymised. Longitudinal tracking data is held in de-identified form where possible. Specific retention periods are set out in our internal retention schedule and can be requested from the DPO.
We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, access controls and role-based permissions, logging, and staff confidentiality obligations. We require the same standards of our processors. No system is perfectly secure, but we work to reduce risk and to respond quickly to any incident, including notifying affected individuals and authorities where the law requires.
Access the personal data we hold about you;
Rectify data that is inaccurate or incomplete;
Erase your data (“right to be forgotten”) where there is no overriding legal reason to keep it;
Restrict or object to certain processing;
Withdraw consent at any time, without affecting processing already carried out;
Data portability receive your data in a structured, commonly used format; and
Complain to the relevant UAE data-protection authority.
For students who are minors, these rights can be exercised by a parent or guardian. To make a request, contact our DPO at hello@masaryhub.com. We will respond within the timeframe required by law and may need to verify your identity first.
masaryhub.com uses cookies and similar technologies to make the site work, remember your preferences (including language), and understand how the site is used so we can improve it. We group cookies as:
Strictly necessary — required for the site and platform to function (always on);
Preference — remember choices such as Arabic/English language;
Analytics — help us measure and improve performance; and
Marketing/retargeting — used only with your consent to support awareness campaigns.
On your first visit you will see a cookie banner that lets you accept or reject non-essential cookies. You can change your choices at any time through the cookie-settings link in the website footer, or by adjusting your browser settings.
We may update this policy from time to time. When we make material changes we will update the “last updated” date and, where appropriate, notify schools and parents. Continued use of Masary after an update means you accept the revised policy.
"*" indicates required fields
"*" indicates required fields
"*" indicates required fields
