Draft for review. Items highlighted like [THIS] still need to be confirmed by the academy. Remove this box once every highlighted item has been completed or deleted.
Effective date: [DATE — CONFIRM] · Last updated: [DATE — CONFIRM]
1About this policy
This Privacy Policy explains what information Ihsan Learning Academy (“Ihsan”, “the academy”, “we”, “us”) collects through this website, how we use it, who else may handle it, and the choices you and your family have. It applies to our public website, the registration and enrollment forms, and the account and student portals.
The academy is operated by [LEGAL ENTITY NAME AND TYPE — CONFIRM], located in [CITY, STATE/PROVINCE, COUNTRY — CONFIRM].
Our students include children and adults. If you are a parent or guardian registering a child, please read the sections on children’s privacy and parental rights.
2Information we collect
When you create an account
- Whether you are a parent or guardian, or an adult student
- Your full name and email address
- Your phone number (optional)
- Your password. Passwords are handled by our authentication service (Supabase Authentication), which stores them in hashed form. We cannot read your password.
When you submit an enrollment application
- Whether an adult is registering themselves or a parent or guardian is registering a child
- The student’s full name and, if you choose to give it, age or grade
- The parent or guardian’s full name (when registering a child)
- Email address and phone number (optional)
- The program you choose and whether you select optional learning extras
- The application’s status and any review note added by academy staff when the application is reviewed
Student and account records
- Student profiles linked to a parent or adult student account (name, age or grade, and whether the student is a child)
- Enrollment records (program, status, whether extras were selected, and the monthly total)
- Lesson progress (which lessons are marked completed, and when)
- The role assigned to an account (for example parent, student, teacher or administrator), which decides what that account can see in the portal
Messages you send us
The “Join Now” form and the “Send a quick message” form on the home page do not send your details to our database. They prepare a message that opens in WhatsApp, and nothing is sent until you choose to send it. Messages you send on WhatsApp are handled by WhatsApp under its own terms and privacy policy, and we receive them on the academy’s WhatsApp number.
Information stored in your browser
Your browser stores a login session so that you stay signed in, and small preferences such as display options and saved bookmarks. See Cookies and local storage.
Information we do not collect through this site today
The site does not currently process payments and does not collect payment card numbers. If online payments are added, we will update this policy and name the payment provider first. [CONFIRM — update if you begin collecting any other information, such as photos, date of birth, address, or lesson recordings]
3How we use information
We use the information above to:
- Create and manage accounts and let you log in, reset a password, and confirm your email address
- Review enrollment applications, place students in programs, and email you about the outcome
- Run classes, record progress, and show families and teachers the information they need in the portals
- Contact you about your enrollment, schedules, fees, and academy updates that relate to your account
- Answer your questions and requests
- Keep the site and accounts secure, prevent misuse, and fix problems
- Meet legal and record-keeping obligations
[CONFIRM — also state here if you ever use contact details for newsletters or marketing, and how people can opt out. If you do not, you can say: “We do not use your information for advertising.”]
4Supabase and other third-party services
We use the following services to run the site. They may process information on our behalf, and each has its own privacy practices.
- Supabase provides our authentication (accounts, passwords, sessions) and our database, where profiles, student records, applications, enrollments and lesson progress are stored. Data is hosted in [SUPABASE HOSTING REGION — CONFIRM IN YOUR SUPABASE PROJECT SETTINGS]. See Supabase’s privacy policy.
- Email delivery. Account confirmation and password-reset emails are sent through [CONFIRM: Supabase’s built-in email service or your own email provider].
- jsDelivr (a content delivery network) delivers the Supabase code library to your browser, so your IP address is visible to it when the library loads.
- Google Fonts supplies the typefaces used on this site, so your IP address is visible to Google when the fonts load.
- WhatsApp is used only when you choose to message us from a button or form on the site.
- Online class platform: [CONFIRM: name of the video-class tool you use, or delete this line].
- Payment provider: none is connected today. [Add provider name and what it receives once payments are connected]
[CONFIRM before publishing: “We do not sell personal information.”] We may also disclose information when the law requires it, or to protect the safety of our students, our staff or the public.
5Children’s privacy
Many of our students are children. We ask that a child’s registration is made by a parent or guardian, and we collect only the information needed to enroll the child, run their classes and track their progress.
A “child” for the purposes of this policy means a person under [18 / AGE OF MAJORITY WHERE YOU OPERATE — CONFIRM].
We do not knowingly ask children to create their own account or application without a parent or guardian. If you believe a child has given us personal information without a parent’s or guardian’s permission, please contact us and we will review and, where appropriate, delete it.
We do not use children’s information for advertising.
Legal compliance. This policy describes our practices. It is not a statement that the academy or this website meets the requirements of any particular children’s privacy or education-records law. [LEGAL REVIEW NEEDED: confirm with a qualified adviser which laws apply to you before adding any compliance statement]
6Parental rights
If you are the parent or guardian of a child enrolled with the academy, you may contact us to:
- Ask what information we hold about your child
- Ask us to correct information that is wrong or out of date
- Ask us to delete your child’s information and close their account
- Ask us to stop collecting or using your child’s information
We will verify that the request comes from the child’s parent or guardian before acting on it. Deleting some information may mean we can no longer provide classes. See Access, correction and deletion requests for how to ask.
7How we protect information
Accounts are protected by a password, and passwords are stored in hashed form by our authentication service. Connections to Supabase use HTTPS. The portals are designed so that what an account can see depends on its role, for example so that a family sees their own students and not other families’ records.
No website or online service can be guaranteed completely secure. Please choose a strong, unique password, do not share it, and tell us right away if you think your account has been misused.
[CONFIRM: that your Supabase access rules really enforce the role-based access described above, and that the whole site is served over HTTPS. Add only safeguards you have actually set up.]
8How long we keep information
We keep information for as long as an account or enrollment is active and for a reasonable period afterwards for record-keeping, resolving disputes and meeting legal duties.
- Account and student records: [RETENTION PERIOD — CONFIRM]
- Applications that are not approved: [RETENTION PERIOD — CONFIRM]
- Financial and fee records: [RETENTION PERIOD — CONFIRM]
When we no longer need information, we delete it or remove the details that identify a person.
9Access, correction and deletion requests
You can ask us to see, correct or delete your information, or your child’s, by contacting us using the details below. Please include the name and email address on the account so we can find it, and tell us what you would like us to do.
We will reply within [RESPONSE TIME, e.g. a number of days — CONFIRM]. We may need to confirm your identity first. In some cases we may need to keep certain records, for example where the law requires it, and we will explain this if it applies.
You can also unsubscribe from academy messages by asking us to stop sending them.
10Cookies and local storage
This site uses your browser’s local storage, not advertising cookies. It stores your login session (so you stay signed in), and simple preferences such as the dashboard view and saved bookmarks. You can clear this at any time in your browser settings, which will sign you out.
The site does not currently load analytics or advertising trackers. [CONFIRM before publishing, and update this line if you add analytics]
11Where information is processed
Information entered on the site is stored with Supabase in the region noted above, and may be accessed by academy staff wherever they work. If you use the site from outside that region, your information will be transferred there. [CONFIRM and add anything required for your region]
12Changes to this policy
We may update this policy from time to time. When we make a significant change we will update the date at the top of this page and, where appropriate, tell account holders. Using the site after an update means you have seen the new version.
13Contact us
For any privacy question or request, including those described above, contact: