Privacy Policy

Al-Muallim Academy teaches the Qur’an, Arabic and Islamic Studies online to students and families around the world. This notice explains what personal information we hold, why we hold it, and what you can ask us to do with it.

We are responsible for the information described here. You can reach us at [email protected] about anything on this page.

About the student: name, age or date of birth, learning level and goals, the country, city and time zone they study from, and the language they speak.

About the parent or guardian: name, email address, phone or WhatsApp number, country and city, and an emergency contact where one is given.

About the learning itself: the schedule, attendance, homework and the teacher’s lesson reports, along with any feedback or ratings you choose to give.

About payments: invoices, amounts, dates and the method used. We never see or store card numbers or bank details — payments are arranged outside the portal.

Recordings: classes are recorded, as set out in our Terms & Conditions.

Technical information: when you sign in to the portal, and basic, anonymous visit statistics for this website.

To deliver the lessons you have asked for — scheduling, teaching, tracking progress, issuing invoices and contacting you. This is necessary to perform our agreement with you.

To run the Academy properly — reviewing teaching quality, keeping accurate records, resolving a dispute about what was taught or paid. These are our legitimate interests in operating a school.

To meet our obligations — keeping financial records for the period the law requires.

We do not sell your information, and we do not use it for advertising. We do not make automated decisions about you.

Most of our students are children. Their information is provided by, and belongs with, their parent or guardian, who holds the account and can see everything recorded about their child.

A student may have their own sign-in so they can attend class and see their own homework. A student account can never see another family’s information.

We collect only what teaching requires. If you believe we hold something about your child that we do not need, write to us and we will remove it.

Classes are recorded for quality review and documentation. The recording captures the lesson — teacher and student — and is stored by our video provider.

Recordings are deleted automatically after 30 days. Within that time the student, their parent and Academy administrators can watch them from the portal. Teachers cannot.

Recordings are not published, not shared outside the Academy, and not used for marketing.

We use a small number of established services to run the Academy. They act on our instructions and may not use your information for their own purposes.

Supabase — stores the academy records. Hosted in Frankfurt, Germany.

Zoom — runs the classes and stores recordings for 30 days.

Brevo — sends the emails you receive from us.

Cloudflare — serves this website and the portal, and filters automated abuse.

Google — only if you choose it: signing in with a Google account, or syncing your class times to your own calendar.

We share information with no one else, unless the law requires it of us.

The academy records are stored in the European Union, in Frankfurt, Germany.

Some of the services above are based outside the EU and the UK, so your information may be handled in other countries. We use established providers who commit to recognised safeguards for those transfers.

The Academy itself operates from Egypt, so our own staff access your information from there.

Class recordings: 30 days, then deleted automatically.

Student and family records: for as long as the student is enrolled, and for a reasonable period afterwards in case they return or a question arises.

Invoices and payment records: kept longer, because accounting rules require it.

Backups: encrypted copies are taken each night and older ones are deleted on a rolling basis, so a deletion may persist in a backup for a short period before it disappears entirely.

Access is limited by role, in the database itself. A teacher sees only the students they teach. A parent sees only their own family. This is enforced where the data lives, not merely hidden in the screens.

Administrator accounts require two-step verification — a password alone is not enough to reach them.

Backups are encrypted before they leave our equipment, and the key is kept separately from them.

The portal is not indexed by search engines and is reachable only by signing in.

No system is perfect. If something ever goes wrong that affects you, we will tell you.

You can ask us to show you what we hold about you or your child; to correct anything wrong; to delete it; to stop or limit a particular use; or to send you a copy in a portable form.

Much of it you can already see and change yourself in the portal.

Write to [email protected] and we will respond within 30 days. We will never charge you for asking, and we will never treat you differently for having asked.

If you are in the UK or the European Union and you are unhappy with how we have handled your information, you may complain to your national data protection authority. In the UK that is the Information Commissioner’s Office.

We use no advertising or tracking cookies, and no third-party trackers. Our visitor statistics are anonymous and count pages, not people.

The portal stores your sign-in on your own device so you are not asked for your password on every page. Our hosting and anti-spam protection may set a strictly necessary cookie to tell a person from an automated script.

There is nothing here to opt out of, which is why you are not asked to dismiss a cookie banner.

If we change how we handle your information, we will update this page and change the date at the top. If a change is significant, we will tell families directly rather than expecting anyone to notice it here.