Talaqqi Lillah Privacy Policy (draft)
Draft. The academy and its lawyer are still reviewing this text. The version you accept in the app is the one that applies.
Version: TODO(spec) · Effective: TODO(spec)
Who we are
Talaqqi Lillah is a free, volunteer-run Quran tutoring academy based in Lagos, Nigeria. In this policy, "we" means the academy: TODO(spec), the legal name and address of the organisation that runs Talaqqi Lillah. Privacy contact: TODO(spec) (an email address on the academy's own domain).
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Phone number (stored encrypted) | Your account and login; contact for confirmed classes | Contract |
| PIN or password (stored only as a one-way hash) | Signing in | Contract |
| Name, screen name, gender, date of birth (encrypted), city, about me, photo | Your profile; same-gender matching; under-18 safeguards | Contract; legitimate interests (safeguarding) |
| Guardian name, phone and email (encrypted), for under-18s | Guardian consent and class updates | Consent (the guardian's); legal obligation |
| Optional email and Telegram account | Codes, recovery and notifications | Consent |
| Bookings, attendance and session records | Running classes and progress | Contract |
| Voice recordings of test answers and samples | Review by your tutor or the academy | Contract |
| Tutor verification documents (ID, selfie, qualifications, reference) | Verifying tutors, especially for under-18s | Legitimate interests (safeguarding); consent |
| Reports, blocks and moderation records | Keeping the community safe | Legitimate interests; legal obligation |
| Device, app version, time zone, language, country of login, security events (with pseudonymous IP) | Security and preventing abuse | Legitimate interests |
| Optional anonymous usage data and crash reports | Improving the app (off by default for under-18s) | Consent |
We don't sell your data or use it for advertising. Crash reports never include personal data or audio.
Who sees it
- Your tutor or student, for a confirmed class only, until it ends: your screen name and photo, your phone number (for Call and WhatsApp), your Telegram username if you added one, and the meeting link or address. Nobody else sees your contact details.
- Academy admins, each only for their role. Viewing sensitive details (phone, date of birth, guardian details, ID documents) needs a reason and is recorded in an audit log. ID documents are watermarked with the viewer's name.
- Service providers: our hosting, email delivery and Telegram, only as needed to run the service.
- Hosting:
TODO(spec), the provider and the region of the academy's servers. - Transfers:
TODO(spec), how data is protected when it's sent outside Nigeria, the EU or the UK.
- Hosting:
How long we keep it
| Data | How long |
|---|---|
| ID documents and selfies | Deleted 30 days after the verification decision |
| Qualification documents | Kept while the badge is valid, deleted 30 days after it ends |
| Voice recordings of test answers | Deleted 365 days after review; the result stays |
| Data downloads | Deleted after 7 days |
| Your account | Until you delete it, as described below |
| Audit and security records | As needed to protect the service and meet legal obligations: TODO(spec) |
Your rights
You can see and correct your profile in the app, at any time.
- Download your data: Settings → Privacy → Download my data. You confirm with your PIN. The file is kept for 7 days; each download link the app opens works for 5 minutes, so you can come back for it.
- Delete your account: Settings → Privacy → Delete my account. Your account is deleted 14 days after you confirm, and logging in before then cancels it.
- After deletion, your personal data and recordings are erased.
- Upcoming classes are cancelled.
- Past classes and tests stay in our records as "Deleted user".
- Object, restrict or complain: contact us at the privacy contact above. You may also complain to the Nigeria Data Protection Commission or your local data protection authority.
Children
Under-18s need a parent or guardian's consent at sign-up. Their guardian can be emailed about class bookings. Under-18s can only book tutors whose identity the academy has verified. Analytics is off by default for them.
Security
The service uses encryption in transit and at rest, plus encryption of sensitive fields. Sign-in uses one-way PIN hashing, admin access requires two-factor authentication, sensitive actions are audit-logged, and abuse is actively monitored.
Changes
When this policy changes, the apps ask you to read and accept the new version before you continue.