Privacy Policy

Welcome to Watazawwado Academy (accessible at watazawwado.academy). It is an online academy offering one-on-one lessons in the Quran, Tajweed, the Zad Path, Arabic and English.

The data controller is the operator of Watazawwado named in the Terms of Service (section “Contact us”), based in Poland. For any privacy question or request, write to privacy@watazawwado.academy. This policy explains what we collect, why, on which legal basis, how long we keep it and what your rights are.

We collect only the information necessary to provide an authentic, safe, and tailored educational experience:

• Account Credentials: Full name, email address, and encrypted passwords managed securely via Supabase Authentication.
• Google Account Profile (when using Log in with Google): When you choose to sign in using Google, we access basic, non-sensitive profile information provided by Google OAuth: your verified email address, full name, and profile picture avatar.
• Booking & Student Profile Information: Learner name and age, parent/guardian name and contact details (for children), learning goals, current level, timezone, preferred schedule, bookings, attendance and cancellations, teacher notes and placement test answers and results.
• Messages and AI chats: Messages in the on-site chat with the platform owner and your teacher, and what you type in the AI learning guide and learning-plan chat.
• Payment & Transaction Records: Payment method used on Stripe’s checkout (card, Apple Pay, Google Pay or PayPal), the amount, and the transaction reference. Card details are handled by Stripe (or PayPal if you choose it); we never see or store card numbers.

Your personal information is used exclusively for the following legitimate educational purposes:

Legal basis for each purpose

• Account, bookings, lessons, chat, placement test and learning records: performing our contract with you (GDPR Art. 6(1)(b)).
• Payment, invoice and tax records: our legal obligations (Art. 6(1)(c)).
• Security, fraud and abuse prevention, and handling complaints: our legitimate interests (Art. 6(1)(f)).
• The AI learning guide and learning-plan chat: providing the service you ask for (Art. 6(1)(b)). We send the AI only what the task needs (for example a first name, never your email or payment data).
• AI help for teachers: a teacher may use our AI assistant to prepare a lesson or to draft the short summary for the family from their own lesson notes. It receives the learner’s first name and those notes, never contact or payment data, and the teacher reviews every draft before the family sees anything. Legal basis: our legitimate interest in giving good, well-prepared lessons (Art. 6(1)(f)).
• Emails about your own lessons that you can switch off in your account (a monthly progress note, package renewal reminders, and a check-in after a few quiet weeks): our legitimate interest in supporting your learning (Art. 6(1)(f)). Each one has an off switch in your account settings.
• Marketing messages: we do not send any. If we ever do, we will ask for your consent first.

How long we keep data

• Account, learning records, bookings, chat and AI chats: while your account is open. After you delete it, we delete or anonymise them from our live systems within 30 days.
• Payment and invoice records: 5 years from the end of the year of the payment, as Polish tax law requires.
• Complaints and refund requests: up to 3 years after they are closed, in case of a later claim.
• Technical logs and backups: removed in the normal cycle of our providers, usually within 30 days.

We engage reliable, enterprise-grade cloud providers to operate the educational infrastructure safely:

• Supabase Inc. — Encrypted cloud database hosting, authentication, and secure access controls.
• Brevo (Sendinblue) — Transactional email delivery for booking confirmations, invoices, and lesson reminders via verified domain noreply@watazawwado.academy.
• Google Calendar & Zoom Video Communications — Scheduling lesson events and hosting secure virtual classroom sessions.
• Stripe & PayPal — Processing lesson and package payments. Card details go straight to them; we never see or store them.
• Google Gemini — Powers the learning assistant that reads the answers you type in the placement chat, to suggest a learning plan, and the teachers’ assistant described above (first name and lesson notes only).
• Have I Been Pwned — When you choose a password, your browser checks it against known data leaks. Only the first 5 characters of a one-way hash are sent; your password never leaves your device.
• WhatsApp (Meta) — Only when you choose to message us, for example for support, pay-later or refund requests.
• Vercel Inc. — Global edge application deployment, SSL/TLS encryption in transit, and anonymous visit counts on our public pages (Vercel Web Analytics, no cookies).

These providers process data on our behalf and only for the purposes above (Stripe and PayPal also act as independent controllers for their own legal duties, such as fraud checks). Some of them are based in the United States, so data may be transferred outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. Each provider’s privacy policy is on its own website.

Cookies and your language choice

We use only necessary cookies and browser storage: to keep you signed in and to remember the language you chose. If you are signed in and pick a language, we save it on your account so our emails reach you in that language (English by default). We do not use advertising or tracking cookies. To learn which of our posts and links bring families to us, your browser also keeps the campaign tags of the link you first arrived from (for example utm_source=youtube) and the name of the referring site; when you complete your account, we save them on it. Our public pages count visits anonymously, without cookies.

Watazawwado Academy frequently teaches young learners learning Quran recitation and Arabic. We take child privacy with utmost seriousness:

For a student under 18, a parent or legal guardian creates the account, books, pays and is our contracting party. We process the child’s data (name, age, level, lessons, teacher notes, placement results and chat) to deliver the lessons the parent ordered. Children under 16 should use the AI chats only with the parent’s knowledge; where the law asks for parental consent, the parent gives it for the child. We collect only what teaching needs, and parents can review, correct or delete their child’s data at any time.

Lessons are not recorded. Our rules for teachers working with children are in the Terms of Service, section “Children and safeguarding”.

Under applicable data protection regulations, you hold the following rights regarding your personal information:

• Right to access and review all personal data we hold about you.
• Right to rectify incorrect, incomplete, or outdated information.
• Right to complete deletion (the "Right to be Forgotten") of your account and records.
• Right to restrict processing, and to object to processing based on our legitimate interests.
• Right to data portability: a copy of the data you gave us, in a common machine-readable format.
• Right to withdraw any consent you gave, at any time, without affecting what was done before.
• Right to revoke Google OAuth access at any time via your Google Account Security Settings.
• Right to complain to a data protection authority, in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority where you live.

We do not make decisions about you by automated means alone that have legal or similarly significant effects. AI suggestions are always reviewed by a person.

To use any of these rights, write to privacy@watazawwado.academy. We answer without undue delay and at the latest within one month (extendable only where the GDPR allows), free of charge. When we delete data, we remove it from our live systems, except what the law requires us to keep (such as invoices); copies in backups disappear in the normal backup cycle. If we must keep something, we tell you why.