Loading page…
Malaz Educational Company (affiliated with MALAZ GROUP) respects the privacy of its users and is committed to protecting their personal data. This policy explains how we collect, use and protect your data when you use our platform.
We collect data that you voluntarily provide when you create an account or fill out forms: name, email, phone/WhatsApp number, nationality, educational qualifications, and supporting documents (passport, certificates). We also collect technical data such as IP address, browser type, and campaign identifiers (UTM).
Your data is used for the purposes of organizing your university application, communicating with you about your application, reviewing documents, improving our services, and for legal compliance. We do not sell your data to third parties.
We may share your data with the universities to which you are applying only and to the extent necessary to process your application. Only the advisor assigned to your application or an authorized manager can view your documents, via secure temporary links.
Your documents are stored in private storage and cannot be accessed directly via public links. They are only accessed via signed URLs generated for those with permission.
You have the right to access, correct, or request deletion of your data (subject to legal restrictions). For inquiries, contact us via info@malazgroup.com.
Malath is an advisory and regulatory service and not a government agency. We do not guarantee 100% acceptance, as final acceptance is subject to the conditions of each university.
The Malaz Study app processes account, contact, academic-profile, university-application, UAF, payment-proof, document, image, PDF, message, voice-note, call-metadata, and device push-token data. Camera, microphone, and notification access is requested only for the feature selected by the user and after the relevant permission is granted.
Data is transmitted over HTTPS to Malaz services. Firebase may support Android notification delivery, APNs iOS notifications, Agora live call audio, the configured storage provider file storage, and Google authentication when selected. Malaz does not sell student data and limits access to authorized staff and processors needed for service, security, and support.
We acknowledge your request, stop account access when processing starts, and send a completion notice. Our operational target is 7 calendar days and the normal maximum is 30 calendar days. These are service targets, not statutory deadlines. Exceptions require a documented legal hold or external-processor dependency.
We delete account identity, credentials, sessions, devices, preferences, notifications, leads, student-owned applications, documents and eligible physical R2 files, and the student's message content and attachments. Other parties' contributions remain after proven references to the student are removed and affected translations and derivatives are invalidated. Ambiguous matches require review before completion.
Financial data is deleted when there is no completed transaction. If a completed transaction requires legal retention, the request stays on hold for review until an actual applicable requirement, legal basis and period are approved; no legal period is presumed. Any retained category, reason and approved expiry are disclosed. General operational records are anonymized; deletion evidence contains no full messages or documents.
Minimal encrypted completion evidence is retained for 90 calendar days after completion: request identifier, policy version, timestamps, terminal result, receipt hash and HMAC suppression identifiers only. Evidence access expires at that deadline; the next scheduled maintenance run removes the encrypted record. You may register immediately after completion with new identifiers. Old applications, files, messages and profiles are never relinked.
Copies may remain in disaster-recovery backups until the provider's natural retention ends. The current Supabase configuration provides 7 daily database backups. We do not extend this for deletion evidence. Restores must re-apply deletion and suppression before production is made available. Eligible R2 objects are physically deleted; its 7-day incomplete multipart-upload rule is not retention of deleted files.
We request provider deletion or revocation where an authenticated mechanism exists and record the outcome. Resend documents 30 days of email/content/log retention followed by up to 7 additional backup days. No authenticated API for early deletion of sent emails is documented; this exception is recorded. Local deletion does not prove deletion by universities, payment providers or other independent recipients. Transient failures block completion. For support or loss of access: info@malazgroup.com.
Request deletion of a Malaz account
2026-09-20 · malaz-account-deletion-2026-09-20-v3