Privacy Policy

This Privacy Notice explains how personal data is processed when you visit or use AUC Atlas, including when you create an account, sign in, edit your profile, submit professor reviews, upload or download course materials, report content, use academic tools, contact AUC Atlas, or otherwise interact with the Service.

AUC Atlas is operated from the Arab Republic of Egypt. Personal-data processing is intended to comply with applicable Egyptian law, including Personal Data Protection Law No. 151 of 2020, its Executive Regulations issued under Ministerial Decree No. 816 of 2025, applicable decisions and guidance of the Personal Data Protection Center ("PDPC"), and other mandatory Egyptian laws.

This Privacy Notice should be read together with the AUC Atlas Terms of Service.

Nothing in this Notice limits any mandatory privacy or personal-data right granted to you by Egyptian law.

For purposes of applicable Egyptian personal-data law, AUC Atlas is operated personally by Ahmed Hazem Radwan, who determines the purposes and means of processing personal data through the Service.

Data User / Controller: Ahmed Hazem Radwan

Operating Country: Arab Republic of Egypt

Privacy and Data Protection Contact: Ahmed Hazem Radwan

Email: ahmedradwan21@gmail.com

AUC Atlas is operated by Ahmed Hazem Radwan personally and not through a separate company or legal entity. No separate Data Protection Officer has been appointed. Ahmed Hazem Radwan personally handles the data-protection responsibilities applicable to AUC Atlas to the extent required by Egyptian law.

Privacy requests, complaints, questions concerning this Notice, and requests to exercise data-subject rights may be sent to the email address above.

Depending on how you use AUC Atlas, the categories of personal data processed may include:

• Account identifiers such as your internal user ID and authentication-provider information.
• Your full name or display name.
• Your AUC email address and email-verification status.
• Your AUC student ID number.
• Your academic major if you choose or are required to provide it.
• Your profile photograph and associated image-storage information.
• Authentication, session, and two-factor authentication information.
• Professor reviews, ratings, course information, semester information, notes, and other review responses.
• Course-material files and associated upload metadata.
• Content reports, complaint reasons, and moderation records.
• Academic-progress information you save through available account features.
• Technical, security, device, browser, IP-address, session, request, and anti-abuse information.
• Messages and information you voluntarily provide when contacting AUC Atlas.

AUC Atlas seeks to collect only personal data reasonably necessary for specified purposes.

When you create or maintain an account, AUC Atlas may process your full name, AUC email address, AUC ID number, major, profile photograph, internal user ID, email-verification status, account timestamps, and account-security settings.

AUC Atlas may maintain a normalized or lookup version of your AUC ID to prevent duplicate accounts and enforce account-uniqueness rules.

Password authentication is handled through Firebase Authentication. The AUC Atlas application database is not intended to store your plaintext password.

AUC Atlas processes security information necessary to authenticate users, maintain login sessions, prevent unauthorized access, investigate abuse, and protect accounts.

This may include session identifiers, authentication cookies, login-challenge records, security-panel authorization records, authentication timestamps, IP addresses, user-agent information, browser name and version, operating system, device type, rate-limit counters, failed-attempt information, and security-event timestamps.

Current authenticated site sessions are designed to expire after approximately five days unless ended earlier through logout, revocation, account deletion, or another security event.

Short-lived login challenges and security-verification records may expire substantially sooner.

If you enable authenticator-app two-factor authentication, AUC Atlas may process encrypted authenticator secrets, temporary setup information, verification-attempt records, and whether two-factor authentication is enabled. Temporary authenticator setup sessions are designed to expire after a short period.

When you submit a professor review, AUC Atlas may process the professor, course code, semester, rating, recommendation information, attendance information, workload, lecture usefulness, office-hours experience, grading style, examination difficulty, grading transparency, feedback information, written comments, submission time, anonymous-status choice, and your internal account identifier.

If you submit a non-anonymous review, your display name and profile photograph may be displayed publicly with the review.

If you choose an anonymous review, AUC Atlas is designed not to display your account identity publicly with that review. However, your internal user identifier may still be retained privately so AUC Atlas can enforce review limits, allow account controls, investigate abuse, process reports, and comply with legal obligations.

An anonymous review therefore does not mean that AUC Atlas possesses no information capable of linking the review to the submitting account.

When you upload course material, AUC Atlas may process the file itself together with metadata such as course code, course title, professor, semester, material type, title, original file name, file size, file type or MIME type, file-storage identifier, upload group, upload time, moderation status, anonymous-status choice, uploader account identifier, uploader display name, and uploader profile photograph.

Course files may be stored with a third-party file-storage provider while associated metadata may be stored in AUC Atlas databases.

If an upload is non-anonymous, your display name and profile photograph may be displayed to other users with the material.

If an upload is anonymous, your public identity is hidden, but AUC Atlas may privately retain your account identifier and related technical records for moderation, security, deletion, legal compliance, and abuse prevention.

Before uploading files, remove unnecessary names, student IDs, emails, grades linked to identifiable individuals, private messages, medical information, financial information, identification documents, or other personal information that is not necessary for the legitimate academic purpose of the upload.

If you report a review or course material, AUC Atlas may process your internal user ID, verified AUC email address, the reported content identifier, your reason for reporting it, a snapshot of relevant reported content, timestamps, report status, and moderation or resolution information.

This information is used to investigate reports, prevent duplicate or abusive reports, communicate about serious issues where appropriate, maintain moderation records, protect users, enforce the Terms of Service, and establish or defend legal rights where necessary.

When you access AUC Atlas, technical information may be generated automatically by AUC Atlas and its infrastructure providers.

This may include IP address, date and time of requests, browser information, user-agent string, operating system, device type, requested pages or API endpoints, session information, security events, error information, network information, and information used to identify abusive or unusually frequent requests.

Hosting, authentication, storage, network, and security providers may independently generate technical logs as part of providing their services.

AUC Atlas counts anonymous non-admin browsers during each weekly period to understand basic Service usage.

When a browser is first counted, AUC Atlas places a random first-party identifier in an HTTP-only cookie. The identifier does not contain a name, email address, account identifier, or other directly identifying information.

For each week, the server derives a one-way, week-specific value from the random identifier. This value is used to prevent repeat page loads, navigation, and refreshes from increasing the total again during the same week.

Different devices, browsers, private-browsing sessions, or browsers whose cookies have been cleared may be counted separately. A shared browser may be counted only once, so the displayed total is an estimate of unique browsers rather than an exact count of individual people.

IP addresses and browser user-agent information may be used for bot filtering and abuse prevention but are not used as the persistent visitor identifier. A new weekly total begins every Monday at midnight in the Africa/Cairo time zone.

AUC Atlas may use cookies, local storage, session storage, and similar browser mechanisms where reasonably necessary to provide authentication, account features, session security, login challenges, preferences, analytics, and other Service functionality.

The weekly unique-browser counter uses an HTTP-only, same-site, first-party cookie containing a random opaque identifier. The cookie may remain for up to one year unless it is cleared earlier through the browser.

Authentication and security cookies may contain random or cryptographically protected identifiers used to recognize a valid session or security challenge. AUC Atlas does not intend to place plaintext passwords inside browser cookies or local storage.

Where Egyptian law requires consent for a particular non-essential storage or tracking activity, AUC Atlas will obtain the legally required consent before using that mechanism.

AUC Atlas may receive personal data indirectly rather than directly from you.

Possible sources include:

• Firebase Authentication and related authentication infrastructure.
• Publicly available AUC or faculty information used for professor and academic profiles.
• Other users who submit professor reviews, course materials, reports, or other community content.
• Cloud-storage and image-hosting providers used to verify or retrieve uploaded files and profile photographs.
• Hosting, network, security, and infrastructure providers that generate technical request or security information.

AUC Atlas will process indirectly obtained personal data only for lawful purposes and subject to applicable legal requirements.

AUC Atlas may process personal data for the following purposes:

• Creating, verifying, administering, securing, and deleting user accounts.
• Verifying AUC email eligibility and preventing duplicate accounts.
• Authenticating users and maintaining secure sessions.
• Providing two-factor authentication and other account-security features.
• Displaying and managing user profiles.
• Receiving, publishing, managing, editing, and deleting professor reviews.
• Receiving, storing, displaying, moderating, and delivering course materials.
• Operating anonymous-submission features while maintaining necessary internal accountability records.
• Providing academic tools and saving account-linked preferences or progress where requested.
• Responding to reports, complaints, rights requests, and support communications.
• Preventing fraud, spam, harassment, unauthorized access, automated abuse, duplicate accounts, and other misuse.
• Applying rate limits and investigating security incidents.
• Counting weekly unique browsers and understanding basic Service usage.
• Maintaining, debugging, protecting, and improving the reliability of AUC Atlas.
• Complying with applicable legal duties, judicial orders, investigative requests, or regulatory obligations.
• Establishing, exercising, or defending legal rights and claims.

AUC Atlas will process personal data only where a lawful basis recognized by applicable Egyptian law exists.

Depending on the particular processing activity, the lawful basis may include:

• Your consent, where consent is the appropriate and legally required basis.
• Performance of contractual obligations, including providing account or Service features that you request under the Terms of Service.
• Compliance with a legal obligation imposed on AUC Atlas.
• Legitimate interests, where permitted by law and where those interests do not override your fundamental rights and freedoms, including appropriate security, fraud prevention, moderation, Service reliability, and limited operational analytics.
• Establishing, exercising, or defending a legal right or claim.
• Executing court judgments or complying with orders of competent investigative or judicial authorities.

Where processing relies on consent, consent will be requested in a clear manner for specified purposes and may be withdrawn subject to applicable law. Withdrawal does not automatically invalidate processing that was lawful before withdrawal or processing supported by another lawful basis.

Certain information is intended to be publicly visible through AUC Atlas.

Depending on the feature and your choices, this may include professor reviews, ratings, course codes, semesters, review responses, written comments, course-material titles, file names, material types, professor names, upload dates, and non-anonymous uploader or reviewer display names and profile photographs.

Information you intentionally make public may be viewed, copied, downloaded, screenshotted, or otherwise retained by other users. AUC Atlas cannot guarantee deletion of copies independently made by third parties before content was removed from AUC Atlas.

Where an anonymous option is available, AUC Atlas hides the account identity from ordinary public display but may retain non-public identifiers and records necessary for security, moderation, legal compliance, account deletion, and abuse prevention.

Personal data may be made available only to recipients who require it for a legitimate and lawful purpose.

Depending on the processing activity, recipients or categories of recipients may include:

• AUC Atlas's authorized operator, administrators, moderators, or persons responsible for security and support.
• Firebase and Google services used for authentication, database, verification, and related account functions.
• Cloudinary where used to store and serve user profile photographs and course-material files.
• Hosting, network, deployment, email, security, and infrastructure providers used to operate the Service.
• Other AUC Atlas users where information is intentionally made public through a review, upload, profile, or other community feature.
• Professional advisers, insurers, auditors, or legal representatives where reasonably necessary for a lawful purpose.
• Courts, the PDPC, law-enforcement bodies, investigative authorities, regulators, or other public authorities where disclosure is lawfully required.

AUC Atlas does not authorize service providers to use personal data for unrelated purposes merely because they receive data while providing infrastructure to AUC Atlas.

AUC Atlas is operated from the Arab Republic of Egypt but relies on technology providers whose infrastructure may store, access, transmit, cache, or otherwise process information outside Egypt.

Firebase Authentication: Google states that Firebase Authentication is operated exclusively from data centers in the United States. Authentication information processed through this service is therefore processed in the United States.

Cloud Firestore: AUC Atlas uses Cloud Firestore for database functionality. Firestore data is stored in the geographic location selected for the relevant Firebase database. That database location is an account-level configuration and is not contained in the public AUC Atlas source code.

Vercel: AUC Atlas uses Vercel for deployment, hosting, network delivery, and server-side functionality. The repository does not declare a custom Vercel Function region. Vercel documents Washington, D.C., United States as its default Function region, although account-level project settings may configure a different region. Static content may be delivered and temporarily cached through Vercel's global network.

Cloudinary: AUC Atlas uses Cloudinary for profile photographs and course-material storage and delivery. Cloudinary states that its standard/default storage data centers are located in the United States unless a different geographical data center has been specifically arranged. Content may also be distributed through global content-delivery infrastructure.

Because the precise Firestore database location and Cloudinary storage configuration are determined through account-level settings rather than the public source code, AUC Atlas will maintain and update the applicable location information based on the configurations actually used for those services.

Any transfer of personal data outside Egypt is subject to Egyptian Personal Data Protection Law No. 151 of 2020, its Executive Regulations, and applicable PDPC requirements. Where a license, permit, authorization, consent, safeguard, adequacy condition, or other legal transfer mechanism is required, AUC Atlas will comply with that requirement to the extent applicable to the relevant processing.

AUC Atlas will update this Notice when a material provider, storage location, processing location, or international-transfer arrangement changes where notice is required by applicable law.

AUC Atlas will not intentionally retain identifiable personal data longer than reasonably necessary for the lawful purpose for which it was processed, except where a longer period is required or permitted by law.

Retention criteria include the type of data, purpose of processing, account status, security requirements, moderation requirements, legal obligations, dispute or limitation periods, and whether the information remains necessary to operate the feature requested by the user.

• Account and profile data may generally be retained while the account remains active and until deletion is completed, subject to lawful exceptions.
• Authentication sessions are currently designed to expire after approximately five days unless terminated earlier.
• Login challenges, authenticator setup sessions, and similar temporary security data are generally designed to expire after substantially shorter periods.
• Rate-limit and anti-abuse information may be retained for the applicable security window and, where necessary, for a longer period to investigate serious abuse or defend legal rights.
• Professor reviews and course materials may remain available until deleted by the user where available, removed through moderation, deleted with the associated account, or otherwise no longer necessary.
• Content-report and moderation records may be retained for as long as reasonably necessary to resolve reports, prevent repeated abuse, maintain an appropriate moderation record, or establish or defend legal claims.
• Aggregated weekly unique-browser totals and week-specific pseudonymous deduplication records may be retained for historical analytics and repeat-count prevention while they remain reasonably necessary for those purposes.
• Backup copies may persist for a limited technical period after deletion until overwritten or removed through normal backup processes.

Independent service providers may maintain their own technical or security records in accordance with their legal obligations and applicable retention rules.

AUC Atlas provides an account-deletion process for authenticated users.

Current account deletion is designed to remove the user's authentication account and associated AUC Atlas user record, profile photograph stored through the configured profile-photo provider, course-material records and associated stored files belonging to that user, professor reviews linked to that user, upload authorization records, AUC-ID reservation records, two-factor authentication records, certain rate-limit records, and other account-linked records handled by the deletion process.

Deletion may not remove information that AUC Atlas is legally required or permitted to retain, information that has been irreversibly anonymized, information contained temporarily in backups, or copies independently obtained by third parties from information that was public before deletion.

AUC Atlas may retain limited records where necessary to comply with law, investigate serious abuse, establish or defend legal rights, respond to lawful authorities, or satisfy another lawful retention requirement.

Subject to the conditions, limitations, exemptions, and procedures provided by applicable Egyptian law, you may have rights concerning your personal data, including the right to:

• Know whether and how your personal data is being processed.
• Access or obtain personal data held about you.
• Correct, modify, update, add to, or rectify inaccurate or incomplete personal data.
• Request deletion of personal data where the legal requirements for deletion are satisfied.
• Withdraw consent where processing is based on consent.
• Request that processing be limited to a specified scope where legally applicable.
• Object to processing or its results where applicable and where processing conflicts with your fundamental rights and freedoms.
• Be informed of a personal-data breach or violation where notification is required by law.
• Submit a complaint concerning the processing of your personal data.

These rights are not absolute. AUC Atlas may lawfully continue certain processing where another legal basis applies or where retention is required for legal obligations, security, fraud prevention, claims, judicial orders, or other purposes recognized by law.

To exercise a privacy right or submit a privacy-related request, contact:

Privacy and Data Protection Contact: Ahmed Hazem Radwan

Email: ahmedradwan21@gmail.com

Your request should explain the right you wish to exercise and provide enough information to identify the relevant account or content.

AUC Atlas may request reasonable information needed to verify your identity and protect personal data from being disclosed, changed, or deleted at the request of an unauthorized person.

AUC Atlas will process valid requests in accordance with the procedures and time limits required by applicable Egyptian law.

If a request cannot lawfully be fulfilled in whole or in part, AUC Atlas may explain the applicable reason where required by law.

AUC Atlas uses technical and organizational measures intended to reduce unauthorized access, disclosure, alteration, loss, abuse, or destruction of personal data.

Current measures include authenticated server-side access, secure session mechanisms, email verification, rate limiting, account-access controls, file-validation procedures, two-factor authentication options, encryption of authenticator secrets, restricted administrative functionality, and security-related logging.

No internet-connected service can guarantee absolute security. AUC Atlas therefore cannot promise that a security incident will never occur.

If AUC Atlas becomes aware of a personal-data breach, it will investigate and take reasonable containment and remediation measures and will notify the PDPC, affected data subjects, or other competent authorities where and within the time required by applicable Egyptian law.

AUC Atlas is designed primarily as a university student resource and is not directed at children.

Users should not submit health information, financial information, government identification documents, biometric information, private family information, or other sensitive personal data unless it is genuinely necessary, lawful, and specifically requested through an appropriate feature.

AUC Atlas may remove sensitive personal information that users unnecessarily publish through reviews, uploads, reports, or other public features.

Where AUC Atlas knowingly processes children's personal data or sensitive personal data, it will apply any enhanced consent, guardian authorization, licensing, security, minimization, record-keeping, or other safeguards required by Egyptian law and PDPC requirements.

AUC Atlas may send non-promotional service communications necessary for account operation and security, such as email-verification messages, password-reset messages, security notices, authentication messages, or important changes affecting the Service.

AUC Atlas does not currently describe ordinary account-verification or security communications as direct marketing.

If AUC Atlas introduces direct electronic marketing, promotional email, or similar marketing activity using personal data, it will comply with the consent, identification, opt-out, record-keeping, and other requirements imposed by applicable Egyptian law before carrying out that processing.

AUC Atlas does not currently sell users' personal data to data brokers or advertisers.

Sharing information with infrastructure providers solely so they can host, authenticate, secure, store, transmit, or otherwise provide services to AUC Atlas is not intended to constitute a sale of personal data.

If AUC Atlas's data practices materially change in the future, this Notice will be updated and any consent, notice, authorization, or other legal requirement applicable to the new processing will be satisfied before the processing begins.

AUC Atlas uses automated technical controls for purposes such as authentication, input validation, rate limiting, duplicate-account prevention, upload verification, session validation, and abuse prevention.

These systems may temporarily reject or restrict a login, upload, review, request, or other action when security requirements are not satisfied.

AUC Atlas does not use these controls to make official university decisions concerning grades, admission, academic standing, graduation, scholarships, or other AUC academic outcomes.

AUC Atlas may update this Privacy Notice when data practices, Service features, providers, security measures, legal requirements, or regulatory guidance change.

The date shown at the top of this page identifies the most recent version.

If a change materially affects how personal data is processed, AUC Atlas will provide additional notice or obtain consent where required by applicable law before applying the new processing.

If you believe your personal data has been processed in violation of applicable Egyptian personal-data law, you may contact AUC Atlas through the privacy contact listed in this Notice.

You also have the right, subject to applicable law and PDPC procedures, to lodge a complaint with the Personal Data Protection Center of the Arab Republic of Egypt.

Contacting AUC Atlas first does not remove any right to complain directly to the PDPC where Egyptian law permits you to do so.

Egyptian PDPC guidance requires privacy-notice information to be provided in Arabic as the primary language. AUC Atlas may provide an English version for accessibility to its intended audience, but the required Arabic notice must also be made clearly available before launch.

Where an Arabic version is designated as the controlling privacy notice or where Egyptian law requires Arabic wording to prevail, the Arabic version shall control to the extent required by law.

This Notice is intended to be interpreted consistently with mandatory Egyptian personal-data law and does not waive any statutory right that cannot legally be waived.

For questions concerning this Privacy Notice, personal-data processing, correction or deletion requests, withdrawal of consent, objections, security concerns, or other privacy matters, contact:

AUC Atlas Operator: Ahmed Hazem Radwan

Privacy and Data Protection Contact: Ahmed Hazem Radwan

Email: ahmedradwan21@gmail.com

Operating Country: Arab Republic of Egypt

AUC Atlas is operated personally by Ahmed Hazem Radwan and does not currently operate through a separate company or legal entity.