Security and privacy

Academies keep children's details in Madar, so we built it to show each person only what they need and to keep each academy apart from every other. This page says how, in plain words. The privacy policy and the data processing agreement are the binding texts.

Each academy apart

Every record in Madar carries the academy it belongs to, and the database itself refuses to show or change another academy's records, whatever a screen asks for. Every release is tested for this: each new screen and function comes with a test that tries to reach another academy's data and must fail.

Passwords are stored only as a slow, salted hash; nobody can read them, not even Kifaya.
Two-step verification with an authenticator app is always required for administrators, required by default for accountants (an administrator can change that) and offered to every other role. Each person gets recovery codes for a lost phone, and an e-mail when one is used.
Repeated wrong passwords block sign-in for a while; an administrator can unblock it.
Kifaya's team works in a separate console with separate accounts, always with two-step verification. A session of the academy app can never open the console.

Each person sees what their role needs

Permissions are checked on the server for every request, not only hidden on the screen. Parents' phone numbers are masked for roles that do not need them, also inside exported files. Coaches see their players' names, ages and photos, never phone numbers, balances or invoices.

Children's data

Madar keeps what the academy needs: a child's name, birth date, gender if the academy records it, groups, attendance and subscriptions. A photo is kept only when the parent agreed, and withdrawing consent deletes it. Photos are served only to signed-in staff with permission, never through a public address. The parent page shows one child to their own parent, with no photo and no phone number.

A record of who did what

Every sign-in, creation, change, cancellation and export is written to an audit log that cannot be edited or deleted. The academy's administrator can read it, as sentences, in Arabic or English.

Files you download

Reports and lists are prepared in the background. Only the person who asked can download the file, for one hour after it is ready; the file is deleted after 24 hours.

How we protect your data

Madar runs on servers operated by Kifaya. Personal data may be processed outside the Kingdom as far as needed to provide the service, under the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, and the Standard Contractual Clauses issued by the Saudi Data and AI Authority. Every night the database and the stored files are backed up, encrypted before they leave the server, and kept with a second provider; we restore a backup in a separate test place every month to prove that it works. Connections are always encrypted (HTTPS).

How long we keep it

What	How long
Registration requests that did not become players	12 months
Waiting list entries	personal details removed 30 days after the entry is closed; deleted after 12 months
Downloaded files	24 hours
Audit log	at least 2 years
Invoices and credit notes	the period Saudi tax law requires
Backups	30 daily and 12 monthly copies

This website

This site sets no cookies, runs no scripts, uses no analytics and loads nothing from another site.

Reporting a security problem

If you find a weakness in Madar, write to support@kifaya-it.com. Please do not test it on another academy's data and give us time to fix it before telling anyone else.