Privacy policy
Last updated 12 October 2026
Al-Daftar helps madrasahs share daily Quran lesson reports with parents. We take the privacy of children, parents and teachers seriously. This page explains what information we hold, why, who can see it and the choices you have.
Who we are
Al-Daftar ("we", "us") provides the online service at aldaftarapp.com. You can contact us about anything in this policy at isaadeel@outlook.com.
Our role and your madrasah's role
Each madrasah decides who to add to Al-Daftar and what to record about its students. For that information, the madrasah is the data controller and we process it on its behalf, only to provide the service. If you are a parent or teacher, your madrasah is your first point of contact for questions about your child's records.
We are the data controller for the information we need to run Al-Daftar as a business. That means madrasah administrators' contact and billing details, enquiries sent to us, and security records.
What we hold
| About | Information |
|---|---|
| Madrasahs | Name, address, number of student places, administrator contact details and subscription status. Card payments are handled by Stripe; we never see or store card numbers. |
| Teachers and administrators | Name, email address, classes taught and a password, which is stored only in scrambled (hashed) form. |
| Parents | Name, email address, which children they are linked to, replies to teachers' messages and confirmations that they have read a report. |
| Students | Name, class, attendance and daily lesson records (what was read for sabak, sabak para and dohr, the number of mistakes, an overall grade and any teacher note), and Quran memorisation progress. Students do not have accounts. |
| Messages | Messages between teachers and parents about a student. |
| Signing in | One-time sign-in codes (stored scrambled and expiring after 10 minutes) and, if you turn on Face ID or fingerprint sign-in, a security key created by your device. Your face or fingerprint never leaves your device and we never receive it. |
| Technical | A sign-in cookie, and basic request logs (such as IP address and browser) kept by our hosting provider for security and troubleshooting. |
How we use it
- To run Al-Daftar: showing reports, messages and progress to the right people.
- To send sign-in codes, staff invitations, password resets and important service emails.
- To bill madrasahs for their subscription.
- To keep the service secure, prevent misuse and help when you contact us.
We do not sell personal information, show adverts, send marketing to parents or children, or use children's information to build profiles. Our legal bases are performing our contract with each madrasah, our legitimate interest in running a secure and reliable service, and complying with the law (for example keeping financial records). Each madrasah is responsible for having a lawful basis for the student and parent information it adds, and for telling families it uses Al-Daftar.
Who can see it
Parents see only their own children. Teachers see the students in their classes. Madrasah administrators see their own madrasah. A small number of Al-Daftar staff can access accounts when needed to provide support or keep the service running.
We use these trusted providers to run Al-Daftar, each bound by contract to protect your information:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database (where the information is stored) | Ireland (EU) |
| Vercel | Website hosting | Ireland (EU), with a worldwide network for delivering pages |
| Resend | Sending emails such as sign-in codes | Ireland (EU) / United States |
| Stripe | Card payments from madrasahs | United Kingdom / EU / United States |
Some of these companies are based in the United States. Where information leaves the UK, it is protected by UK-approved safeguards such as the UK–US data bridge or standard contractual clauses. We may also share information if the law requires it.
How long we keep it
- We keep a madrasah's information for as long as it uses Al-Daftar.
- When a madrasah stops using Al-Daftar, we delete its students', parents' and teachers' information within 90 days, or sooner if it asks.
- Sign-in codes expire after 10 minutes. Billing records are kept for six years, as UK tax law requires.
Keeping it safe
Everything is sent over encrypted connections (HTTPS). Passwords and sign-in codes are stored scrambled. Access is limited by role, and the database can only be reached by our own servers.
Your rights
Under UK data protection law you can ask to see the information held about you or your child, ask for it to be corrected or deleted, object to or restrict how it is used, and ask for a copy to take elsewhere. For student and parent information, please ask your madrasah first; we will help them respond. You can also contact us at isaadeel@outlook.com.
If you are unhappy with how your information is handled, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Cookies
We use one essential cookie to keep you signed in, and a short-lived one while you set up Face ID or fingerprint sign-in. If you turn that on, your device also remembers it. We do not use analytics or advertising cookies, so there is nothing to opt in to.
Changes to this policy
If we make important changes, we will update the date at the top and let madrasahs know.