Privacy Policy

Depending on how you use the platform, we may collect:

• Account details — your name, email address, password (stored securely and never in plain text), role (teacher or student), and profile information such as bio, subjects, and avatar.
• Teacher details — your Teacher ID, stated terms and conditions, and the fees, currency, and payment period you set.
• Learning data — enrolments, classrooms, lesson participation, books and materials you upload, homework, submissions, grades, and progress notes.
• Communications — messages sent through the platform and any correspondence you send to us, including reports and support requests.
• Payment information — where subscriptions are enabled, billing details needed to process a teacher subscription. Full card details are handled by our payment processor, not stored by us.
• Technical data — limited information such as log data and device or session information used to keep accounts secure and the service working.

We use your personal data to:

• create and manage your account and authenticate your sign-in;
• connect students to teachers, run classrooms and lessons, and deliver materials, homework, and progress tracking;
• process teacher subscription payments where enabled;
• keep the platform safe — detecting misuse, investigating reports, and enforcing our Terms & Conditions and safeguarding obligations;
• respond to your enquiries and provide support; and
• meet our legal, tax, and regulatory obligations.

Under UK data protection law (UK GDPR) and the Data Protection Act 2018, we rely on the following legal bases:

• Contract — to provide the platform and the services you sign up for.
• Legitimate interests — to keep the platform secure, prevent abuse, and improve the service, balanced against your rights.
• Legal obligation — to comply with the law, including safeguarding and record-keeping duties.
• Consent — where we ask for it, for example for certain optional communications; you can withdraw consent at any time.

We do not sell your personal data. We share it only where necessary, and with appropriate safeguards:

• Between teachers and students — a teacher and their enrolled students can see the profile and learning information needed for lessons (for example, names, enrolment status, homework, and progress notes).
• Service providers — trusted providers who help us run the platform, such as our hosting and database provider (Supabase) and, where enabled, our payment processor. They may only process data on our instructions.
• Legal and safety — authorities, regulators, or law enforcement where required by law or necessary to protect a person from harm.

• Access to data is protected by authentication and row-level security rules, so users can generally only reach the data they are entitled to.
• Passwords are hashed, and connections to the platform are encrypted in transit.
• We limit staff and administrator access to what is necessary to operate and safeguard the platform.
• No online service can be guaranteed fully secure. If a breach affects your rights, we will act promptly and notify you and the relevant regulator where the law requires.

• We keep your personal data for as long as your account is active and for as long as needed to provide the service.
• After an account is closed or removed, we delete or anonymise personal data within a reasonable period, except where we must retain certain records for legal, tax, safeguarding, or dispute-resolution purposes.
• Records relating to a safety investigation or a legal claim may be kept for longer where necessary.

• Where a student is under 18, a parent or legal guardian is responsible for their account and for consenting to the processing of their data.
• We handle any data relating to children with particular care and only as needed to deliver lessons safely.
• If you believe a child's data is being misused, or you have a safeguarding concern, contact us immediately at info@ilmmadrassa.com.

Subject to the law, you have the right to:

• access a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data where there is no overriding reason to keep it;
• object to or restrict certain processing;
• request a portable copy of data you provided to us; and
• withdraw consent where we relied on it.

To exercise any of these rights, email info@ilmmadrassa.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we hope you will contact us first so we can help.

We use only the cookies and similar storage needed to keep you signed in and to keep the platform secure. We do not use these for advertising. Blocking essential cookies may stop the platform from working correctly.

Some of our service providers may process data outside the UK. Where that happens, we take steps to ensure your data receives an equivalent level of protection, such as relying on approved safeguards and contractual protections.

We may update this Privacy Policy from time to time. Material changes will be notified through the platform, and the “last updated” date above will always reflect the current version. Please review it periodically.