Privacy policy

The data controller is the Al-Isbaah Institute ([legal form and office — to be completed]). Contact for any data request: [email protected].

• Identity: first and last name, sex (to apply single-gender teaching), date of birth for children, language and country.
• Contact details: e-mail address (verified by a code at registration), phone, time zone.
• Parent account and link with the enrolled child(ren).
• Educational file: sessions, time slots, attendance, lesson reports written by the teacher, homework and submitted papers, marks and exams, certificates.
• Payments: amount, method, status and reminder history. Card numbers are never stored by the institute — they are processed directly by Stripe or PayPal.
• Exchanges: support messages, information messages, notifications, reviews.
• Technical data: connection and action log in the online space, device and country (derived by the host; the IP address is not stored), log of e-mails sent, and — with your consent — pages viewed for the public site's audience measurement.

• Performance of the contract: registration, lesson organisation, educational follow-up, exams, certificates, invoicing and payment, support.
• Legal obligation: retention of accounting records and invoices.
• Legitimate interest: security, prevention of fraud and unpaid fees, improvement of the platform, lesson reminders.
• Consent: audience measurement of public-site visitors (cookie banner); you may withdraw it at any time.

Within the institute: the office and the teaching team, under the single-gender rule (the men's and women's offices only see the files that concern them) and only for their duties. A teacher only sees their own students.

Our technical processors, bound by confidentiality: Vercel (hosting), Supabase (database and files), Stripe, PayPal and Wise (payments), Brevo, Amazon SES and Resend (e-mail). Your data is never sold or shared for commercial purposes.

Some providers are established in the United States (Vercel, Resend, Amazon Web Services). These transfers are governed by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

Data is kept as long as necessary for each purpose, then deleted automatically:

• Account and educational file: during enrolment, then 12 months after the last session; the account is then deleted (notified 3 days before)
• Payments, invoices and receipts: 10 years (accounting obligation)
• Support messages: 3 years after the thread is closed
• Log of e-mails sent: 12 months
• In-app notifications: 12 months
• Activity log: 24 months
• Website audience measurement: 13 months
• Online presence heartbeats: 90 days
• E-mail verification codes and unfinished registration drafts: 7 days

Technical logs are purged every night according to these periods.

Under the GDPR you have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent at any time, and the right to set instructions for your data after death. To exercise them, write to [email protected] from your account address or from your profile page; we answer within one month. You may also lodge a complaint with the CNIL (cnil.fr).

A child is enrolled by a parent or legal guardian, who holds a parent account giving access to the child's space. The child's data is used only to organise and follow their lessons.

Exchanges are encrypted (HTTPS). Access is controlled by role and by security rules enforced directly in the database; passwords are stored hashed; sensitive actions are logged; the database is backed up daily.

• Strictly necessary: the sign-in session and display preferences (language, remembered choices). No consent required.
• Internal audience measurement of the public site: a random identifier is stored in your browser if you accept the cookie banner. No IP address or page content is sent, and no third-party tracker is used. Your choice is remembered for six months.
• To change your mind: clear this site's data in your browser; the banner will be shown again.