Who operates the site
ArtAcad, LLC operates the site. Its sole company base is in the United States and it has no other branches. Contact info@artacad.com with privacy, access or deletion requests.
Browsing and registration
You can browse without an account. New registration asks only for email, password and confirmation. Email is the required contact and sign-in information used to preserve your course rights, purchases and account recovery. We do not require a name, phone, address, birth date or identity document to register. Password confirmation is not stored. Passwords are stored as secure hashes, not readable text. Internal account identifiers, session and security records are necessary to provide sign-in. Old account names are hidden and are not used to fill certificate names automatically; this interface change does not automatically erase historical service records.
Essential cookies and language selection
Secure cookies keep your session active. You can refuse optional analytics and advertising while continuing to use the site. Arabic and English share the same account, course and purchase access. The language links choose which page to display; choosing English does not send a separate purchase or grant a new account permission.
Optional Google Analytics
Only after consent, Google Analytics 4 measures public-page visits, course interest and enrolment-button clicks. Google may process browser and device information, approximate country and cookie identifiers. We do not send your name, email or password, measure private account, lesson or administration pages, or enable advertising features or Google Signals. Your preference is saved for 90 days and can be changed in Privacy settings. Withdrawal stops new measurement and removes this site's analytics cookies. We respect Do Not Track and Global Privacy Control. Browsing and purchasing do not require analytics consent. See Google's privacy policy.
Optional Meta advertising measurement
After a new advertising choice for the current measurement version, Meta Pixel and the server-side Conversions API may send only public PageView and course ViewContent events. This version does not send checkout or purchase events. A course view is not a purchase. The same random event ID is used for deduplication. Browser privacy tools and network conditions may prevent some events.
What Meta can receive
The browser pixel may receive network address, browser data, the public-page URL and cookie identifiers. Only after consent, the server sends the network address and browser information for technical matching, a reviewed public URL without query or fragment, event time and random event ID. A course view includes its public ID and advertised base SAR price, not a paid amount or currency. The server does not send email, name, phone, account or order IDs, advertising cookies, conversations or artwork. It does not store network addresses or browser data in its advertising-event logs. Advanced matching and automatic form reading are disabled. Pixel and CAPI are excluded from account, checkout, private lessons and administration pages.
Managing advertising consent
Closing the short notice rejects optional measurement and advertising. Previous analytics or earlier-pixel consent does not activate the newer server sharing. Advertising preference is separate and lasts up to 90 days, with a signed server-consent cookie whose identifier is not sent to Meta. Consent evidence is retained until expiry and event IDs briefly for deduplication without their content. In Privacy settings, Analytics only stops Meta; Reject optional stops both and removes local measurement cookies. Withdrawal stops new server sends but cannot retrieve an event already sent. The page may reload to stop a previously loaded tool. Do Not Track and Global Privacy Control prevent optional measurement. See Meta's privacy policy.
Payments and orders
Stripe processes payment details in secure fields or checkout under its privacy policy. We share course name, price, account email and identifiers needed for payment and delivery. We retain payment reference, status, amount, currency and the linked course entitlement, but not the full card number or security code.
Video viewing and certificates
Vimeo displays protected videos within your account and may process technical playback information such as network address and browser. When requesting a certificate, choose only the name to appear on it; no identity proof or mandatory account name is required. We retain certificate name, image, number, date and send record, and email the image through SendGrid once per course. OpenAI reviews only the empty certificate template, without learner name, email or certificate number. Account deletion includes the stored certificate image and request record, but cannot remove a copy already delivered to your email.
Digital support and artwork review
Questions, conversation context and relevant curriculum information may be shared with OpenAI to prepare a reply. An attached artwork image is sent for analysis; the site does not keep its image file. Conversation text is stored for continuity and academy review, including textual feedback that may describe the artwork. We do not send lesson videos or other students' account data. Responses are requested without API retrieval storage, but provider technical and security retention still follows its policies. Optional additional-reference search uses a prepared general course topic, not your image, full question or conversation. Chat can be used without that search. Do not send passwords, card details or unnecessary personal information. The active page keeps chat in memory rather than copying it to persistent browser storage. See OpenAI's privacy policy.
WhatsApp support
When you contact the academy on WhatsApp, Meta and Kapso process your WhatsApp number or identifier, message text and timing to deliver the conversation. The academy retains messages and replies needed for support and deduplication and may send the question and brief context to OpenAI. A WhatsApp number does not authenticate a student account or grant course or payment-data access. Human takeover in WhatsApp Business temporarily pauses automatic replies. Do not send passwords, card information or sensitive documents.
Account and service email
SendGrid may deliver essential account messages, password recovery and order confirmations from info@artacad.com. Only the recipient address and information needed for the message are shared. Open and click tracking are not enabled for these service emails, and registration does not automatically add you to a marketing list. The academy team handles replies through its support mailbox.
Hosting and processing locations
Cloudflare's global network hosts and serves the site. Pages may be delivered from distributed data centres according to the visitor's connection; the site does not rely on one traditional server in a fixed country. Delivery distribution does not mean all account data is copied to every location. Databases and files may be held in specific provider regions, and processing or storage may occur outside your country. Cloudflare may process necessary connection details, timing and operational errors.
Non-identifying aggregate statistics
The academy records daily counts of successful public-page requests, with separate totals by page, approximate network country and broad referral category. These counters contain no network address, browser data, visitor, account or order ID and use no tracking cookies or individual browsing history. Counters expire after 90 days and small report categories are suppressed. They are page-request counts, not unique people or evidence of a person's purchase source. You can stop aggregate statistics in Privacy settings; that preference lasts 90 days. Do Not Track and Global Privacy Control are respected. Opting out does not affect browsing, purchasing or necessary order records.
Consent-based visit and order attribution
After a new analytics choice for the current version, the academy may record public pages, courses, enrolment-link clicks and a sanitised referral or campaign source using a secure visit cookie for 90 days. If you sign in, that visit may be linked internally to your account and order. A recorded source does not prove an advertisement caused a purchase, and a source may remain unknown. Historical purchase sources are not guessed. Events and order-source records last up to 180 days. This mechanism does not send names, emails or account or order IDs to Google or Meta. Withdrawal stops new collection and removes the visit cookie. A necessary refusal cookie without a visitor ID lasts 90 days and blocks collection even if server cleanup is unavailable. Support can review deletion requests, and account deletion includes linked records. Earlier Google Analytics consent alone does not activate this newer linkage.
Learning and progress records
We save completed lessons and video positions to resume learning, show progress, check certificate eligibility and review refund requests. Since this feature was activated, lesson opens and video clicks are also recorded. Opening or clicking a video does not prove full viewing. These details are available only to academy administration and are not sent to advertising or optional analytics tools. Account deletion removes the related records from the active site database. Your progress remains attached to the same course across website languages.
Learner age and digital-teacher consent
Before the course teacher opens, we ask the age group of the person learning now, without a preselected answer or birth date. We save only a broad declaration: adult 18+, under 18 or unspecified, with the notice version. This is self-declaration, not verified identity or parental consent. The teacher, its images and history do not open for under-18 or unspecified learners; lessons remain available. An adult needs separate consent before questions and images are shared with OpenAI, for their own learning only. Changing learner withdraws that consent; teacher settings can also withdraw it. Adults can read and delete prior history in the app and report replies without renewing send consent. The provider's no-retrieval-storage setting does not mean zero security or technical retention.
Course likes and category follows
Liking saves a course preference and follows its category to highlight relevant and new courses. Visitor choices are stored locally; signed-in choices are stored in the account across devices. You can unlike and unfollow separately. A like is not enrolment and does not send marketing emails. Only aggregate counts are displayed, without member names. Historical category interests are distinguished from current course likes and follows.
Instagram support
When Sara support is enabled for the academy's Instagram account, incoming text messages can receive replies without a required starting keyword, subject to limits and availability. After webhook-signature and account checks, the academy stores message text, sender and message identifiers, timing and replies in Cloudflare for continuity and deduplication. An Instagram identifier does not prove ownership of a student account or grant courses or payment data. When automatic replies are enabled, questions and brief context may be shared with OpenAI with response retrieval storage disabled; provider security and technical retention still applies. This integration does not download, save or send Instagram images or attachments to AI.
Instagram retention and human handover
While the integration remains enabled, maintenance removes message and reply text after 30 days, expired-message and deduplication records after 90 days, and conversation identifiers after 90 days of inactivity once linked message records are gone. Disconnecting the integration requires manual follow-up for remaining data deletion. The owner can follow conversations in Instagram's inbox. Sending the Arabic phrases for stop reply or I want a staff member pauses automatic replies for 24 hours; a detected human response or an attachment needing review also pauses them. This is not a promise of an immediate human reply. For access or deletion, email info@artacad.com with your Instagram username. The team verifies ownership, possibly by confirmation from that account. A request is not automatic deletion and does not remove Meta's copy. See Meta's and OpenAI's privacy policies.
Data minimisation and protection
Email is the only contact information required to create a site account. Providing the service also needs orders, course permissions, progress, consent and technical security records. Payment providers may require transaction information, and support receives information you voluntarily send; these are not extra registration fields. Do not send unnecessary personal details in messages or artwork. HTTPS encrypts connections, and Cloudflare D1 provides encryption in transit and at rest according to the provider's protections. Passwords use secure hashing and certificate images are also encrypted within the application. Account, course and certificate access is tied to authenticated ownership, with limited administrative access for service delivery. This is not end-to-end encryption: the service and authorised providers can process necessary data. Contact support to request access or deletion.