mohamy.world
Privacy Policy
Draft pending legal review. It will be finalised before registrations open.
This is a translation. The Arabic text is the authoritative version.
This policy explains how mohamy.world collects, uses, keeps and protects personal data under the Personal Data Protection Law 151 of 2020 and its Executive Regulations. Last updated: 2026-09-29.
1. Who we are
Data controller: [Name and address of the legal entity that owns mohamy.world — to be completed before launch].
Data Protection Officer: [Name of the Data Protection Officer registered with the PDPC — to be completed], reachable at privacy@mohamy.world.
mohamy.world hosts professional pages for lawyers and law firms. We do not provide legal services and do not act as an intermediary between lawyers and clients.
2. What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Lawyer account: email and password (hashed) | Sign-in, managing the Page, subscription messages | Performing the service contract |
| Page content: name, photo, Bar registration grade and number, practice areas, bio, services, fees, address, contact details | Publishing the Lawyer’s Page once approved. The name, photo, title, Bar registration grade and years of experience also appear in the “Our Lawyers” directory on the homepage and the Lawyers page | Performing the contract, and the Lawyer’s explicit consent to publication |
| Verification Documents: a photo of the Bar card only | Checking that the account holder is a registered lawyer | Performing the contract, and our legitimate interest in preventing impersonation |
| Consent records: the consent text, its version and time | Proving consent | Legal obligation |
| Payment records: plan, period, amount, paid-until date | Managing subscriptions and accounting | Contract and legal (tax) obligation |
| Booking Requests (on Pro Pages): name, phone, chosen appointment time, case type, note | Passing the request to the Lawyer who owns the Page so they can contact you | Your explicit consent when you send it |
| Chatbot conversations (on Pro Pages): your messages and the assistant’s replies, the Page language, and when the chat took place | Answering questions from the Page’s information, free appointment times and FAQ, and letting the Lawyer read the chat and follow up any Booking Request made in it | Your explicit consent before the chat starts: the chat window shows a notice of what is stored and that an external AI service processes the messages, and the chat does not start until you tick “I agree”. We record when you agreed and the version of the notice with the conversation |
| Page statistics: views and clicks aggregated per day, without cookies or personal data | Showing Lawyers their stats and improving the service | Our legitimate interest |
| A hash of the IP address or account id for rate limiting | Preventing abuse and spam | Our legitimate interest |
| Admin Activity Log: who took which admin action, and when | Accountability and security | Legitimate interest and legal obligation |
We use no tracking or advertising cookies, only the cookies needed to stay signed in. We do not sell personal data or use it for direct marketing.
Visitors should not write case details or any health or criminal information in Booking Requests or chats: that is sensitive data.
3. How long we keep data
| Data | Kept for |
|---|---|
| Verification Documents | Until the approval or rejection decision, then permanently deleted |
| Booking Requests | 12 months after their last status change, then deleted (only counts are kept) |
| Chatbot conversations | 90 days, then deleted |
| Rate-limit data | One hour |
| Page statistics (daily totals, no personal data) | While the Lawyer’s account exists; deleted with it |
| Lawyer account and Page content | While the account exists; deleted within 30 days of a deletion request or account deletion |
| Payment records | 5 years (tax records) |
| Admin Activity Log | 3 years |
| Consent records | As long as the data they cover |
4. Where data is stored, and transfers outside Egypt
- Database, files and sign-in: Supabase, in a data centre in Frankfurt, Germany (EU).
- Website hosting: Vercel. Requests are processed in Frankfurt, Germany, with a global delivery network for public content.
- “Translate for me”: only when a Lawyer presses the button, their Arabic Page text is sent to Google (Gemini) or Groq in the United States for translation.
- The chatbot: chat messages are sent with the Page’s public information to Google (Gemini), or to Groq when Gemini is unavailable, in the United States to generate the reply. We currently use these services’ free tier, and the provider may use the messages to improve its services, so don’t write case details or any health or criminal information in the chat.
Transfers outside Egypt take place under a cross-border transfer licence from the Personal Data Protection Centre [licence number to be completed], with your explicit consent, and under data processing agreements with the providers.
5. Your rights
You have the right to:
- know what data we hold about you, see it and get a copy
- correct, update or complete it
- have it deleted once its purpose has ended
- restrict or object to its processing
- withdraw your consent at any time, as easily as you gave it
- be told of any breach affecting your data
- complain to the Personal Data Protection Centre
To use any of these rights, email privacy@mohamy.world. We reply within 30 days at most and may ask you to prove your identity. Lawyers can change most of their data directly in their dashboard.
6. Security and breach notification
We protect data with encryption in transit, restricted access enforced in the database, and two-step verification on every admin account. Verification Documents are kept in private storage that only the review team can open.
If a breach affects personal data, we notify the Personal Data Protection Centre within 72 hours and the people affected within 3 working days of notifying the Centre, explaining what happened and what we did about it.
7. Changes to this policy
We publish any change on this page with its date. If a change alters the purpose for which we process your data, we ask for your consent again.