Fatiyyah AcademyPrivacy notice
This notice explains what personal information Fatiyyah Academy uses, why, and the choices and rights you have. It covers the Fatiyyah Academy website, the web app and the Android and iOS apps. There is a shorter notice written for children.
Fatiyyah Academy is provided by [Company name] Ltd, registered in England and Wales (company number [number]), [registered address]. We are registered with the Information Commissioner's Office (ICO) under number [ICO number]. You can reach us about privacy at privacy@fatiyyah.academy.
Who decides what happens to your information
Fatiyyah Academy is used by Quran and Islamic studies academies to teach their students. That gives us two different roles.
- Your academy is the controller of learning records. The academy decides who to enrol, which lessons to hold, whether lessons are recorded and how long records are kept. We process that information for the academy, on its instructions, under a data processing agreement. If you are a student or parent, your academy is your first point of contact for questions about your records, and it can tell you how it uses them.
- We are the controller for running the service itself: your sign-in account, keeping the service secure, billing academies, service emails and handling requests sent to us directly.
What we use
| Information | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored only as a one-way Argon2id hash), preferred language and time zone, two-step sign-in secret (encrypted) | You, or the academy for students it adds |
| Student details | Name, username, PIN (stored only as a hash), and if the academy chooses to record them, date of birth and gender; links between parents and their children | The academy, or a parent |
| Learning records | Lesson times and attendance, marks and notes a teacher makes on the mushaf during lessons, recitation recorded (which ayahs, a grade), homework and whether it is done [(only if the academy turns homework on; it is off by default in this version)], hifz plans and progress summaries | Teachers during lessons, and the platform from those records |
| [Check-ins] | [Whether a student came on each class day, so the academy and the family know: on time or late against the teacher's or the school's deadline, the time, and whether the student or a parent checked in. A student who has not checked in by the end of the day is marked absent, and teachers and administrators can correct a day, with a note] | [The student or a parent; teachers and administrators; the service, for absences] |
| [Daily reports] | [A report of each school day for a student and their family, put together when someone opens it from that day's lessons and results, the check-in, and a behaviour rating with an optional note from a teacher or administrator. Only the behaviour rating and parents' acknowledgements are stored for it] | [Teachers and administrators, for the behaviour rating] |
| [Parents' acknowledgements and signatures] | [A parent can confirm they have seen a day's report, up to 7 days back, signing with a finger or not. A signature is kept as a small image in our file storage, not in the database] | [The parent] |
| Lesson recordings | [Audio of a live lesson, recorded only when the academy records lessons and a parent of every student in it has agreed, in the app or on a signed form an administrator records. Nothing is recorded until then] | Recorded during the lesson |
| [Recitation recordings] | [A child reciting, recorded in the app at home and sent to their teacher, or recorded by their teacher in class. Only once a parent has agreed to recording] | [The child or a parent, at home; the teacher, in class] |
| [Voice notes] | [A teacher's spoken feedback on a child's recitation] | [The teacher] |
| Live audio and video | Your microphone and camera during a lesson | Your device, only while you are in a lesson and have allowed it |
| Messages | Lesson reminders, weekly summaries for parents, invitations, sign-in links and password resets [(lesson reminders and weekly summaries only if the academy turns them on; both are off by default in this version). The emails sent in this version: sign-in links, password resets and invitations; security alerts, for example after five wrong two-step codes; notices to an academy's administrators when a concern is raised or children's PIN sign-in is paused; and, to our safeguarding contact, the details of each safeguarding concern and of any concern about an administrator, and of its closing] | Sent by the service |
| Phone notifications | If you turn on lesson reminders in the app: a token from Apple or Google that lets us reach that phone, the app version, and the reminders sent to it (the lesson's title, teacher and time). The phone stops receiving them when you sign out of the app [(there are no Android or iOS apps in this version, so none of this is collected)] | Your phone, when you allow notifications |
| Concerns | What someone reports with "Report a concern", who raised it and in which lesson, and how the academy handled it | The person who raises it, and the academy's administrators |
| Security and technical information | IP address and browser or device type for each sign-in session, a record of important actions (for example adding a student or deleting a recording), failed sign-in attempts | Your device and the service |
| Billing information | The academy's billing contact and subscription details. Card details go straight to our payment provider, Stripe; we never see or store them [(not in this version: the academy is exempt from billing, so it has no subscription, Stripe is not used, and we keep only the record of that exemption)] | The academy |
[Live lessons are not used in this version of the app, so there are no lesson recordings and no live audio or video.]
We do not use your information for advertising, we do not sell it, and we do not track you across other websites or apps. We do not use analytics or advertising cookies (see Cookies and storage). We do not make decisions about you by automated means that have legal or similarly significant effects; hifz suggestions such as the next sabaq are prompts for the teacher, who decides.
Why we use it, and our lawful basis
When we act for an academy, the academy relies on its own lawful basis, usually its contract with the student or parent, or its legitimate interest in teaching and keeping records. For the processing we control:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in, showing you your lessons and records | Contract with you or with your academy (UK GDPR Article 6(1)(b)), or legitimate interests where the account is created for a child by the academy (6(1)(f)) |
| Keeping the service secure: session records, rate limits, audit records, investigating misuse | Legitimate interests in protecting users and the service (6(1)(f)) |
| Sending lesson reminders and parent summaries, which you can turn off at any time | Legitimate interests, and the contract with the academy (6(1)(b), 6(1)(f)) |
| Billing academies and keeping accounting records [(not in this version: the academy is exempt from billing)] | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Answering your requests and complaints | Legitimate interests and legal obligation (6(1)(c), 6(1)(f)) |
Children
Many people who use Fatiyyah Academy are children. We designed the service to follow the ICO's Age Appropriate Design Code:
- Children sign in with a username and PIN given by their academy; they do not need an email address.
- Children's profiles are not public, and other families cannot see a child's records. In a group lesson [(only if the academy turns live lessons on; they are off by default in this version)], the students see the lesson's shared page.
- Settings are private by default. There is no advertising, no in-app purchase, no location tracking and no social sharing.
- Parents can see their child's progress and homework [(homework only if the academy turns it on; it is off by default in this version)]. [Parents hear their child's recitation recordings only if the academy turns that on, and it is off by default. Lesson recordings are of live lessons, which are not used in this version of the app. Parents can agree to their child being recorded, and withdraw that at any time.]
- Children's sessions on shared devices end sooner (after 14 days without use) than adults'.
Who we share it with
- Your academy and the people in it who need it: teachers see the students they teach, parents see their own children, administrators see their academy. [Recitation recordings and voice notes are heard only by the child, the child's teachers (including a teacher covering for one of them) and the academy's administrators. Parents do not hear them unless the academy chooses to allow it, and other families never do.] [Check-ins and daily reports are seen by the student, their parents, the child's teachers and the academy's administrators. A parent's signature is seen by the child's parents, teachers and administrators; the student sees only that the report was signed.]
- Our service providers ("sub-processors"), who host and run parts of the service for us under contracts that require them to protect the information and use it only on our instructions. The current list, with what each does and where, is on the sub-processors page.
- Our safeguarding team, for concerns about someone's safety raised with "Report a concern". They are told as well as the academy, in case the concern is about the people running the academy.
- Authorities, only when the law requires it or a child is at risk, and after checking that the request is lawful.
Where it is kept
We host Fatiyyah Academy in the United Kingdom and the European Economic Area. Some providers may process information elsewhere, for example our payment provider. [In this version, the providers on the sub-processors page process information in the United Kingdom and the European Economic Area (question for the owner: this holds once OVH confirms where it keeps its daily backup of the server), and the payment provider, Stripe, is not used, because the academy is exempt from billing.] When information leaves the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, with the safeguards they require.
How long we keep it
| Information | How long |
|---|---|
| Accounts | While the account is open. When an account is deleted, its personal details are removed straight away and its records are anonymised |
| Learning records (marks, recitation, homework [if the academy turns it on], hifz plans) | While the student is enrolled, unless the academy deletes them sooner. An academy or parent can ask for a student's records to be erased |
| [Check-ins, behaviour ratings, and parents' acknowledgements with their signatures] | [While the student is enrolled, like the learning records. Erasing a student's records deletes them, signatures included, and a parent who removes or replaces an acknowledgement deletes its signature at once. That a parent acknowledged a day's report, and whether they signed, also stays in the audit records] |
| Detailed lesson logs and attendance events [(of live lessons, which are not used in this version; not check-ins)] | 2 years, then deleted. Summaries of progress stay with the learning records |
| Lesson recordings | The period the academy sets: 30, 90 (the default), 180 or 365 days |
| [Recitation recordings and voice notes] | [The period the academy sets, counted from when the recitation was sent: 30, 90 (the default), 180 or 365 days. Sooner if someone deletes them, and longer only while a safeguarding concern holds them (below). The grade, marks and written feedback stay with the learning records] |
| Messages we sent | 90 days |
| A phone's notification token | Until you sign out of the app on that phone, its sign-in expires, or Apple or Google tell us the app is no longer on it |
| Audit records of important actions | 6 years, for security and legal claims |
| Concerns | Until the academy deletes them. They may be safeguarding records, which academies are often required to keep for many years |
| Backups | Up to [35] days, after which deleted information is gone from backups too |
| [OVH's backup of the whole server] | [OVH, which hosts our server, takes one automated backup of the whole server each day and keeps one copy. Where it is kept and for how long are to be confirmed with OVH (question for the owner)] |
When a recording is deleted, it disappears from the app straight away and is removed from our storage within 30 minutes, unless it has to be kept for a safeguarding concern.
Where safeguarding requires it, information may be kept for longer than shown here, even after it has been deleted or an account erased, for example while a concern about someone's safety is looked into. It is then kept only for that purpose and deleted when it is no longer needed.
Your rights
You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Many of these you can do yourself in the app: On your Account page, under Your data, Download my data gives you a copy and Delete my account removes your account. Parents can download their children's records and stop recordings from the child's progress page.
For learning records, your academy decides as controller, so we will usually pass your request to it and help it respond. You can also contact us directly at privacy@fatiyyah.academy. We reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can complain to your local data protection authority.
Security
Connections are encrypted. Passwords and PINs are stored only as one-way hashes. Academy administrators must use two-step sign-in. Each academy's records are separated from every other academy's in the database itself, not only in the application. Recordings are stored privately and played back through links that expire. We record important actions and review access.
Changes
We will update this notice when the service or the law changes, and tell academies and account holders about significant changes before they take effect.