Privacy notice
This notice explains what personal information QuranLearnOnline collects, why we collect it, how long we keep it, and the rights you have over it. It covers this website, the student and teacher portals, and the classes themselves. Most of our students are children, so we keep the amount of information we hold to the minimum needed to teach them.
Last reviewed: September 2026
Who is responsible for your information
QuranLearnOnline is the data controller for the information described here. If you have a question about your information, or want to make a request, contact us using the details at the bottom of this page and ask for the academy administrator.
What we collect, and why
| What we collect | Why | Our legal basis |
|---|---|---|
| Name, email and phone or WhatsApp number | To reply to your enquiry, arrange classes and send lesson notes | Your consent, and performing our agreement with you |
| Student age and current reading level | To assign the right teacher, course and level | Performing our agreement with you |
| Time zone and preferred class times | To schedule lessons in your local time | Performing our agreement with you |
| Attendance, lesson records and progress notes | To teach, to track progress and to report to parents | Performing our agreement with you |
| Fee records and invoice history | To bill correctly and meet accounting obligations | Legal obligation and our legitimate interest |
| Card payments | Handled entirely by Stripe. We never see or store card numbers | Performing our agreement with you |
| Account email and password | To give you access to the portal. Passwords are stored hashed, never in readable form | Performing our agreement with you |
We do not collect special category information such as health data, and we ask you not to send it. We do not buy contact lists, and we do not sell or rent your information to anyone.
Children’s information
- A parent or guardian books the classes and provides the child’s details; we do not ask children to register themselves.
- We hold a child’s first name, age, level, attendance and progress — not their address, school or any document.
- Parents may join any class, and may ask at any time for a copy of everything we hold about their child, or for it to be deleted.
- Teachers may not contact a student privately or on personal social media. See our safeguarding policy for the full rules.
Who we share information with
- The assigned teacher, who sees only what is needed to teach their own students.
- Stripe, which processes card payments and holds the payment details we never see.
- Our email provider, which delivers lesson notes, invitations and reset codes.
- No video platform. The class runs on the academy’s own servers, so the picture, the sound and the chat are not passed to Zoom, Google Meet or any other outside service.
- Authorities, where the law requires it, or where a child’s safety is at risk.
Our team and servers may be located outside your country, including in the UK, the EU, the USA and Pakistan. Where information leaves the UK or EEA, we rely on the safeguards our providers put in place, such as standard contractual clauses.
How long we keep it
- Enquiries that do not become enrolments: deleted within 12 months.
- Student records while enrolled, and for 24 months after the last class, so a returning family keeps their progress history.
- Fee and invoice records: 6 years, because tax law requires it.
- Class recordings: only made with written parental consent, and deleted within 90 days unless you ask us to keep them.
Your rights
- Ask for a copy of the information we hold about you or your child.
- Ask us to correct anything that is wrong.
- Ask us to delete it, where we are not required by law to keep it.
- Withdraw consent for marketing messages at any time.
- Object to processing, or ask us to restrict it.
- Complain to your data protection regulator — in the UK that is the Information Commissioner’s Office.
We respond to requests within 30 days and never charge for them. Email us, or ask in the portal, and we will confirm the request before acting on it.
Security
- Passwords are stored hashed; nobody at the academy can read them.
- The site is served over HTTPS, and the portals require a login.
- Access is limited by role: a teacher sees only their own students, and a student sees only their own records.
- Card details never reach our servers.
Cookies
We use a single cookie to keep you signed in to the portal, and your browser’s local storage to remember your language choice. We do not use advertising cookies. If we add analytics later, this notice will be updated first and you will be asked for consent where the law requires it.
Contact us about your information
See also our Safeguarding policy and our Fees and cancellation policies.