Privacy Policy

Warshati operates the warshati.ai website and the Warshati learning platform. We are based at 56 Bd Moulay Youssef, 3e etg, App. 14, Casablanca, Morocco, and we are responsible for the personal data described in this policy. You can reach us any time at [email protected] or +212 6 75 65 43 43.

Warshati is provided to schools and educational organizations. Your school signs an agreement with us, creates and manages learner accounts, and remains your main point of contact for account questions. Where that agreement contains specific data terms, they apply alongside this policy.

We process personal data in accordance with Moroccan Law 09-08 on the protection of personal data, under the supervision of the CNDP, Morocco's data protection authority. Where partner schools are located in countries whose laws grant additional rights, we honor those rights as described below.

Warshati is built for children, so privacy is not a feature we added later — it shapes how the platform works. These are the commitments we make to every learner, parent, and school:

• We collect the minimum. A learner account needs only a name or nickname, an email address, a password, and an avatar choice. We do not ask children for a birthdate, gender, phone number, or home address at signup.
• Schools stay in control. Learner accounts are created and managed by the learner's school, and a learner's progress is visible only to the learner and to their own school's teachers and staff.
• No advertising, ever. There are no ads on Warshati, no advertising cookies, no third-party analytics trackers, and no social media pixels. The only usage measurement is our own first-party system, which shares nothing with anyone.
• We never sell personal data, and we never share it for marketing.
• No hidden profiling. The only profile we build is the learning progress a learner can see for themselves — pathway, level, points, completed workshops, and certificates.
• Creative work stays close. Drawings, project boards, and any audio or video a learner records in workshops are saved in the browser on their own device, not uploaded to our servers.
• AI with guardrails. Messages to the AI learning facilitator are automatically filtered to remove email addresses, phone numbers, and links before any AI processing, and we remind learners not to share personal details.

Account data. Learner accounts are created by the school — manually, through a one-time invitation link, or with a school join code — or by the learner using their school's code. An account holds a first and last name or nickname, an email address, a username, a password stored only in hashed form, and an avatar choice. Accounts for school staff and administrators may additionally include a phone number and the school's contact details.

Learning progress data. For each learner we store the chosen pathway, current level, experience and skill points, completed workshops, certificates, program placement suggestions (including the AI's reasoning for a suggested starting point), and cohort membership.

AI conversation content. When a learner asks the AI learning facilitator a question, the typed text and the relevant workshop context are processed to generate a helpful answer. Messages are filtered for personal details first, and they are not stored as chat logs in our database. In some workshops a learner can submit a photo of their physical work — for example a wiring setup or a sketch — so the AI can describe and respond to it; these photos are processed for that purpose and are not stored on our servers.

Technical and security data. We process IP addresses transiently to rate-limit our AI features and prevent abuse; they are not stored in our database. We use two strictly functional cookies — a login session cookie and a language preference cookie — described in our Cookie Policy.

Usage data. To understand how the platform is used and to give schools meaningful dashboards, we record usage events with our own first-party system: which areas of the learning space are visited (such as Programs, Workshops, or Labs), time actively spent, and learning actions such as starting or finishing a workshop. Each event carries the account identifier, the school, a random session identifier, and the item involved — never message text, free typing, or anything from the device outside Warshati. No third-party analytics service is involved at any point.

On-device data. Work in progress, finished creative pieces, and any audio or video recorded during multimedia workshops stay in the browser on the learner's own device and are never uploaded to Warshati.

Taster session. Anyone can try a short sample workshop before signing up, with no account and no profile. The taster's progress is kept in the browser on the visitor's own device, and our servers process the visitor's IP address only transiently to rate-limit AI requests. During the taster we also record the same kind of anonymous usage events — with no account, no name, and only a random identifier — so we can see whether the taster itself works well.

Public website. If you contact us by email or phone, we process what you send us solely to respond. The contact and newsletter forms on our marketing pages do not currently send us any data, so the email address and phone number in this policy are the reliable ways to reach us.

We use personal data only to run Warshati and keep it safe. Specifically, we use it to:

• Provide the learning experience — accounts, workshops, pathways, levels, points, and certificates.
• Show each learner's progress to the learner and to the teachers and staff of their own school.
• Power AI learning features, such as the in-workshop facilitator, assessment and mini-project evaluation, and placement suggestions.
• Issue certificates when a program is completed; a certificate can be revoked if it was issued in error.
• Keep the platform secure — authenticating logins, rate-limiting requests, and preventing abuse.
• Send transactional emails only, such as school invitations and password resets. We do not send marketing emails.
• Improve our programs using the ratings and comments that school educators share about them — feedback about our curriculum, never about individual learners.

We do not use personal data for advertising, and AI-generated suggestions only influence a learner's experience inside the platform — for example, a recommended starting course — never anything beyond it.

Friendly facilitator characters guide learners through workshops. When a learner asks a question, our servers send the typed message — after filtering out email addresses, phone numbers, and links — together with the workshop context to an AI model provider, OpenAI or Anthropic, which returns the answer. AI also helps evaluate assessments and mini-projects, suggests a suitable starting point in a program, generates short certificate texts, and prepares progress insights for teachers.

Because of those last features, some personal data does reach our AI providers: a learner's name and a summary of their progress may be included when generating certificate text or teacher insights, and photos a learner submits in certain workshops are processed by a vision model. Under our API agreements with OpenAI and Anthropic, content sent through their APIs is not used to train their models.

We also teach safe habits: learners are reminded inside the platform not to share personal details in AI conversations, and harmful or inappropriate requests are blocked before any AI processing takes place.

A learner's account and progress are visible to the learner and to the teachers, staff, and administrators of the learner's own school — never to other schools, other learners, or advertisers. Within Warshati, access is limited to what is needed to operate and support the platform.

A small number of service providers process data on our behalf: the secure cloud infrastructure that hosts the platform, an email delivery provider for transactional messages, and the AI providers OpenAI and Anthropic described above. Some pages also load fonts from Google Fonts, which means Google receives your browser's IP address when it delivers the font files; beyond that, no third-party requests are made from your browser, and we use no third-party analytics or tracking services — usage measurement is done entirely by our own first-party system.

We never sell personal data and never share it with advertisers. We disclose data to public authorities only when the law genuinely requires it, and only to the extent necessary.

Learner accounts live as long as the school's relationship with Warshati. Schools manage the account lifecycle: they create accounts, can suspend them, and can request deletion when a learner leaves.

When an account is deleted, the personal data attached to it is removed from our active systems, except for the limited records we are legally required to keep. Transient security data such as IP addresses used for rate limiting is never written to our database in the first place, and on-device data can be cleared at any time by clearing the browser's site data.

Usage events from our first-party measurement system are kept in raw form for 12 months and then deleted; only aggregated statistics, which contain no personal details, are kept beyond that.

We protect learners' data the way we would want anyone to protect our own children's data:

• Traffic to warshati.ai is encrypted in transit.
• Passwords are stored only as bcrypt hashes — we never keep the actual password.
• Login sessions use a signed token in an httpOnly, secure cookie that scripts on the page cannot read.
• Access is role-based, and school data is strictly scoped: staff can only ever see learners from their own school.
• Password reset links are single-purpose and expire within one hour.

No system is perfectly secure. If you believe you have found a vulnerability or that an account has been compromised, please tell us right away at [email protected].

Warshati is operated from Morocco, but some of our service providers — notably the AI providers OpenAI and Anthropic — process data on servers outside Morocco, including in the United States.

When data leaves Morocco, we keep the transfer to the minimum the feature needs, rely on our providers' contractual confidentiality and security commitments, and apply the safeguards required by applicable data protection law, including Law 09-08 and, where it applies to a partner school, equivalent foreign rules.

You can ask to access the personal data we hold, have it corrected, have it deleted, or object to or restrict certain processing. Because learner accounts are managed by schools, the simplest route for a learner or parent is through the school, which can correct or remove account data directly. You can also contact us at [email protected], and we will work with the school to resolve your request.

Under Moroccan Law 09-08 you also have the right to lodge a complaint with the CNDP, the national data protection authority. If your school is located in a country whose data protection law grants you additional rights — for example GDPR-style rights of access, portability, or erasure — we will honor those rights as that law provides.

If your child uses Warshati through their school, the school is your first point of contact: it manages the account and can show you what your child is working on, correct their details, or remove the account.

You are also always welcome to write to us directly at [email protected] with any question about your child's data — what we hold, how the AI features work, or how to exercise any of the rights above. And we encourage you to reinforce at home a habit we teach in the platform too: not sharing personal details, even with a friendly AI facilitator.

When we update this policy we will publish the new version on this page with a fresh date at the top. If a change meaningfully affects how learners' personal data is handled, we will notify our partner schools through their administrator contacts so they can inform families.