Privacy notice
Version 2026-10-18
Maktab is software that Islamic schools (“Maktabs”) use to run classes, record attendance and learning progress, set homework, manage fees and talk to families. This notice explains what personal data is handled, why, for how long, and the rights you have under the EU and UK General Data Protection Regulation (GDPR).
Who is responsible
- Your Maktab is the controller of the data about its students, parents, guardians and staff: it decides what is recorded and why. Questions about that data, or requests to see, correct or delete it, go to your Maktab first — you can send a request from your account in the app.
- the operator of Maktab runs the Maktab software and acts as processor for your Maktab, following its instructions under a data-processing agreement (see the terms). For sign-in, security logs and running the service itself, the operator of Maktab is the controller.
Contact: your Maktab, or the operator contact shown in the app
What data is handled
- Account: name, email address, optional phone number, password (stored only as a one-way hash), two-factor settings, language and email preferences.
- Students: name, optional date of birth and gender, classes, attendance, Qur’an and curriculum progress, assessment results, homework and teacher comments.
- Families: which parents and guardians are linked to which children, messages with the Maktab, and notifications.
- Fees: charges, payments and balances. Card details are entered on Stripe’s pages and are never stored by Maktab.
- Consents: whether a parent has agreed to optional uses the Maktab asks about (for example photos on its website), and when.
- Security: sign-in times, the device/browser and IP address of active sessions, and a record of important actions (audit log).
Why, and the legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Providing education and running the Maktab: classes, attendance, progress, homework, communication with families | Contract with the family, or the Maktab’s legitimate interests in educating its students |
| Fees, invoices and bookkeeping | Contract, and legal obligation to keep financial records |
| Keeping accounts secure, preventing misuse, audit trail | Legitimate interests |
| Optional uses the Maktab asks about (photos, publicity, etc.) | Consent — which can be withdrawn at any time in the app |
| Email notifications | Legitimate interests; you can switch them off in your account |
Religious affiliation may be inferred from attending a Maktab. This is handled by the Maktab as a religious, not-for-profit body for its members (art. 9(2)(d)) or with explicit consent, and is never shared outside the Maktab and its processors.
Children
Most students are children. Their accounts are created by their Maktab, parents and guardians see their children’s records, and consents for optional uses are given by a parent or guardian. Teacher notes, hints and internal flags are not shown to families.
Who receives the data
Data is visible only to the people in your Maktab who need it (administrators, the teachers of a class, linked parents). It is not sold or used for advertising. These service providers process data on our behalf:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database hosting | All application data | Region chosen for the project |
| Vercel | Application hosting and delivery | Requests, IP addresses in server logs | Global edge network |
| Resend | Sending email (invitations, password resets, notifications) | Name, email address, message content | United States |
| Sentry (or compatible) | Error monitoring, only if SENTRY_DSN is set | Error details; emails, phone numbers and secrets are removed first | Depends on the chosen service |
| Upstash | Rate limiting, only if configured | Hashed request keys and counters, IP addresses | Region chosen for the database |
| Stripe | Online fee payments, if a Maktab enables them | Payer name, email, payment details (held by Stripe) | United States / EU |
Where a provider is outside the EU/EEA or UK, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.
How long data is kept
- Student, family and staff records: for as long as the person is part of the Maktab, and afterwards for the period the Maktab sets. A Maktab can have former students anonymised automatically after a number of years.
- Financial records: as long as bookkeeping law requires (often 6–10 years); they are kept without the student’s name when a student is anonymised.
- Sign-in sessions: deleted when they expire. Password-reset links: 1 day after expiry. Unused invitations: 30 days after expiry.
- In-app notifications: 1 year. Audit and security records: 3 years. Closed privacy requests: 3 years.
Your rights
- Access and portability — download your data as a file from your account at any time.
- Correction — update your details, or ask your Maktab to correct records.
- Erasure — delete your own account from your account page, or ask your Maktab to erase a student’s data.
- Restriction and objection — ask your Maktab to limit or stop a use of your data.
- Withdraw consent — change any consent in the app as easily as you gave it.
Requests made in the app go to your Maktab, which must answer within 30 days (one month). You can also complain to a data protection supervisory authority.
Cookies
Maktab uses only cookies that are strictly necessary: one to keep you signed in and one to remember your language. There is no advertising or analytics tracking, and fonts are served from Maktab itself. See the cookie notice.
Security
Connections are encrypted, passwords are hashed, two-factor sign-in is available, access is limited by role and Maktab, and important actions are logged. If a personal-data breach occurs that risks your rights, the Maktab and the relevant authority are informed within 72 hours, and you are told directly when the risk is high.
Changes
When this notice changes in a way that matters, you will be asked to read it again the next time you sign in.