- info@alfatih.online
This Privacy Policy explains how ALFATIH LLC (“ALFATIH”, “we”, “us”, “our”) collects, uses, stores, shares and protects personal information when you visit alfatih.online, request a trial lesson, enrol in a course, or contact us. We provide one-to-one online Quran and Arabic tuition to students worldwide, and we take the confidentiality of our students — many of whom are children — seriously.
If you do not agree with this Policy, please do not use our website or services.
1. Who we are
ALFATIH LLC is a limited liability company registered in the State of Wyoming, United States, trading as ALFATIH. Our registered address is 30 N Gould St Ste R, Sheridan, WY 82801, United States.
For any question about this Policy or about your personal data, contact us at info@alfatih.online. We aim to respond to all privacy enquiries within 30 days.
2. Information we collect
2.1 Information you give us
- Identity and contact data — the student’s first name and, where the student is a child, the parent’s or guardian’s name; email address; telephone or WhatsApp number; country and time zone.
- Enrolment data — the student’s age or age band, current level of Quran or Arabic study, preferred teacher gender, preferred lesson days and times, and the language you wish to be taught in.
- Payment data — the billing name, billing country and the record of what you paid, when, and for which lessons. We do not collect or store full card numbers, CVV codes or bank credentials. Card and PayPal payments are processed directly by our payment providers; we receive only a confirmation and a truncated reference such as the last four digits and the card brand.
- Correspondence — messages you send us by email, contact form, WhatsApp or social media, and our replies.
2.2 Information we collect automatically
- Technical data — IP address, browser type and version, operating system, device type, language setting, and referring URL.
- Usage data — pages viewed, time spent, and links clicked on our website.
- Cookie data — as described in our Cookie Policy.
2.3 Analytics and advertising technologies
We use Google Analytics to understand how visitors use our website — which pages are read, where visitors arrive from, and where they leave. The data is aggregated and we do not use it to identify individual visitors or to target advertising. Google acts as an independent controller of the data it collects; see Google’s own privacy policy for details.
We do not use the Meta (Facebook) Pixel, and we do not run any other advertising or retargeting pixel on this website. We do not build advertising profiles of our students and we do not share student data with advertising networks. If this ever changes, we will update this Policy and request your consent before any such technology is enabled.
Cookie-level detail, including cookie names and durations, is set out in our Cookie Policy.
2.4 Information we deliberately do not collect
We do not ask for and do not want your national identification number, passport number, social security number, full payment card number, or account passwords for any third-party service. Please never send these to us. We do not collect biometric data, and we do not build advertising profiles of our students.
3. Lesson recordings
Lessons are delivered live over third-party video platforms such as Zoom, Google Meet, Skype or WhatsApp. We do not record lessons by default. A lesson is recorded only where you (or, for a child student, the parent or guardian) have asked for a recording or given written consent, for example so the student can revise. Where a recording is made at your request, it is shared only with you and the assigned teacher, and it is deleted within 90 days unless you ask us to keep it for longer. You may withdraw consent to recording at any time by emailing info@alfatih.online.
4. Children’s privacy
A significant proportion of our students are under 18, and many are under 13. We do not knowingly allow a child to enrol independently.
- Enrolment, scheduling and payment must be completed by a parent or legal guardian, who provides the contact details on the child’s behalf.
- We collect the minimum information needed to teach the child: a first name, an age or age band, and the study level. We do not ask children for an address, a phone number, a photograph or any financial information.
- We do not send marketing communications to children.
- A parent or guardian may review, correct or request deletion of their child’s information at any time by emailing info@alfatih.online.
We handle children’s data consistently with the principles of the U.S. Children’s Online Privacy Protection Act (COPPA) and, for children in the European Economic Area and the United Kingdom, with Article 8 of the GDPR. If we learn that we have collected personal information directly from a child without parental consent, we will delete it promptly.
5. How we use your information and our legal bases
| Purpose | Data used | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Arranging and delivering lessons; matching a student with a suitable teacher | Identity, contact, enrolment | Performance of a contract |
| Scheduling, reminders and lesson-related messages | Contact, enrolment | Performance of a contract |
| Taking payment, issuing invoices and processing refunds | Payment, identity | Performance of a contract |
| Keeping accounting and tax records | Payment, identity | Legal obligation |
| Responding to enquiries and providing support | Contact, correspondence | Legitimate interests |
| Keeping the website secure and preventing fraud or abuse | Technical, usage | Legitimate interests |
| Improving our courses and website | Usage, feedback | Legitimate interests / consent for non-essential cookies |
| Sending news or offers about our courses | Contact | Consent (withdrawable at any time) |
6. Who we share your information with
We do not sell your personal information, and we have never done so. We do not rent or trade student data, and we do not share it with advertising networks or data brokers.
We share information only with the following categories of recipient, and only as far as necessary:
- Our teachers — the assigned teacher receives the student’s first name, age band, level, time zone and lesson schedule. Every teacher is bound by a written confidentiality obligation and may not use student information for any purpose other than teaching.
- Payment providers — PayPal, our card-payment processor, and our bank, in order to take payment and issue refunds. These providers act as independent controllers of the payment data they collect and apply their own privacy policies.
- Technology providers — our website host, email provider, and the video-conferencing platform used for your lessons. These act as processors on our instructions.
- Professional advisers — accountants, auditors and lawyers, where required.
- Authorities — where we are legally required to disclose information, for example in response to a valid court order, or to establish or defend legal claims. We will notify you of such a request unless we are legally prohibited from doing so.
7. International transfers
We are based in the United States and our teachers are located in a number of countries, including Egypt. This means your personal information may be transferred to and processed in countries outside your own, including countries that may not provide the same level of data protection as your home jurisdiction.
Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with contractual confidentiality obligations on every teacher and supplier who handles student data.
8. How long we keep your information
| Category | Retention period |
|---|---|
| Enquiries that do not lead to enrolment | 12 months from last contact |
| Student and parent account records | Duration of enrolment plus 24 months |
| Payment and invoice records | 7 years, to meet U.S. tax and accounting obligations |
| Lesson recordings made at your request | 90 days, unless you ask us to keep them longer |
| Marketing consents and opt-outs | Until withdrawn, plus a permanent suppression record so we do not contact you again in error |
| Website server logs | 12 months |
When a retention period ends we delete the data or irreversibly anonymise it.
9. How we protect your information
- Our website is served over HTTPS with a valid TLS certificate.
- Access to student records is restricted to staff who need it, and teachers see only the students assigned to them.
- Administrative accounts require strong, unique passwords, and we use multi-factor authentication where the platform supports it.
- Payment card data never touches our servers; it is handled entirely by PCI-DSS compliant payment providers.
- We review access rights and remove accounts for teachers and staff who leave.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and notify affected individuals without undue delay.
10. Your rights
Depending on where you live, you have some or all of the following rights:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where we no longer need it.
- Restriction — ask us to limit how we use your data while a concern is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on our legitimate interests, and object to direct marketing at any time.
- Withdraw consent — where we rely on consent, withdraw it at any time without affecting processing already carried out.
- Complain — lodge a complaint with your local data protection authority. In the EEA this is your national supervisory authority; in the UK it is the Information Commissioner’s Office (ico.org.uk).
Residents of California additionally have the right under the CCPA/CPRA to know what personal information we collect and for what purpose, to request deletion or correction, to opt out of the “sale” or “sharing” of personal information (we do neither), and not to be discriminated against for exercising these rights.
To exercise any right, email info@alfatih.online with the subject line “Data Rights Request”. We will verify your identity before acting, respond within 30 days (or 45 days for CCPA requests, extendable where permitted), and will not charge a fee unless a request is manifestly unfounded or excessive.
11. Marketing communications
We send course news and offers only to people who have asked to receive them. Every marketing email contains a working unsubscribe link, and you can also opt out at any time by emailing info@alfatih.online. Opting out of marketing does not stop essential service messages such as lesson reminders, schedule changes and payment receipts.
12. Third-party links
Our website and our social media pages may link to third-party sites, including Facebook and the video platforms used for lessons. We are not responsible for the privacy practices of those sites, and we encourage you to read their policies before providing them with personal information.
13. Changes to this Policy
We may update this Policy to reflect changes in our services or in the law. The “last updated” date at the top always shows the current version. If we make a material change, we will notify enrolled students and parents by email at least 14 days before it takes effect. Continuing to use our services after the change takes effect means you accept the updated Policy.
14. Contact us
ALFATIH LLC
30 N Gould St Ste R
Sheridan, WY 82801
United States
Email: info@alfatih.online