Privacy Policy | Firaasah Academia

1. Who we are

Firaasah Academia (“we”, “us”) is an online academy teaching Qur’anic studies, Arabic, Hadith and Seerah. We decide how and why your personal information is used, so we are its “controller”.

We are based in Pakistan and teach students in many countries. At the time of writing Pakistan does not have a general data-protection law in force, so we follow the standards of the UK and EU General Data Protection Regulation (GDPR) for every student, wherever they live, and we comply with Pakistan’s Prevention of Electronic Crimes Act 2016.

Questions about this policy or your information: firaasahh@gmail.com.

2. The short version

We collect what we need to answer your enquiry, run your classes and give you access to your courses.
You sign in with Google or with a one-time link we email you, so we never see or store a password.
Enrolment, orientation and contact requests are saved on our system, and the academy gets a short WhatsApp alert about each one once that is switched on. We don’t send automated emails.
We don’t sell your information, show adverts, or use analytics or advertising cookies.
Requests that don’t lead to an enrolment are deleted automatically after 12 months.
You can download your information or delete your account yourself from your profile page, or email firaasahh@gmail.com for anything else.

3. What we collect and why

When you sign in

Sign-in uses Firebase Authentication, either with your Google account or with a one-time sign-in link sent to your email. We receive and store your name, email address, your Google profile photo if you use Google, and a Firebase user ID, and we record when you last signed in. If you add them in your profile, we also store your phone number, country, a short bio, a photo you upload, your time zone and your preferred teaching language.

When you send an enrolment or orientation request

The form asks for the student’s first and last name, age, gender (enrolment only) and previous Qur’an or Islamic studies knowledge; a parent or guardian’s name when the student is under 18 or someone else is enrolling them; an email address, phone number and optional WhatsApp number; the course, preferred level and plan; whether you want group or one-on-one sessions and the class time you choose from the academy’s published times; your time zone, so times can be shown in your own time; learning goals, special requirements or notes; and how you heard about us. Orientation requests also ask what the student can already do, what they want to be able to do and how many hours a week they can study, and you choose one of the orientation times the academy has published.

We also record your two consents with the date and time and the version of these policies you accepted, the page you sent the form from, and a reference code. We use all of this to place the student in the right course and level, arrange a class time and agree the plan and payment with you.

When you send a contact message

Your name, email address, the topic you choose and your message, so that we can reply — and, if you give them, your time zone and current level, so a reply can suggest times and a starting point.

Courses and payments

We keep a record of each course you have access to (the plan, when access was granted, when it ends, and which member of the academy granted it) and of each payment you make: the amount, the method (for example JazzCash or Easypaisa), the date and any notes. Payment is arranged directly with the academy. We do not collect or store card details on this website.

We also record your progress through lessons so that you can see what you have completed.

Questions, comments and live chat

If you post a question in Ask a Question, a comment or rating on an article, or a message in a live session chat, we store it with your account. Questions are reviewed before they appear, and you choose whether a question is public and whether your name is shown with it (otherwise it appears as asked by “A student”). Article comments are shown with your name and profile photo. Live chat messages are shown with your name to others in the session.

Live sessions

Remind“Remind me” on a live session, we add you to that session’s reminder list and email you about 30 minutes before it starts. Opening a session page on its own adds you to nothing. You can remove a reminder on the session page, or turn all reminder emails off on your profile page.

Waiting lists

If you join a waiting list for a course that isn’t open yet, or ask to hear when new courses open, we store your email address, your name if you give it, what you’re waiting for, the page you signed up on and when you agreed to be emailed, so we can tell you once when it opens.

Security

Our server briefly uses your IP address to limit abuse, for example too many form submissions from one device. We don’t store it with your account or your requests. Our hosting providers may keep standard access logs.

4. Children

Children are welcome in our classes, but a parent or guardian must enrol them. For students under 18, the parent or guardian fills in the enrolment or orientation form, gives the consents, and is the person we contact about classes and payment.

To create an account you must be at least 13, or older if Google requires it in your country. If you believe a child under 13 has created an account, email firaasahh@gmail.com and we will delete it.

5. How we use your information

To answer enquiries, place students, arrange class times and agree plans and payment.
To give you access to your courses, lessons, recordings and live classes, and to show your progress.
To record attendance at your classes and show it to you and the academy.
To handle renewal requests you send from your dashboard, which reach the academy in the same way as enrolment requests.
To run Ask a Question, article comments and live chat, including moderating them.
To keep the website secure and prevent abuse.
To keep the financial records we are required to keep.

6. How your requests reach the academy

When you send an enrolment, orientation or contact request:

It is saved in our database and can be seen only by the academy’s administrators.
Once WhatsApp alerts are switched on, a short alert is sent to the academy’s own WhatsApp through Meta’s WhatsApp Business Platform, with Meta acting as our processor. It contains only the reference code, the student’s name and age, the course, the chosen class or orientation time and the phone number, or for contact messages your name, the topic and your contact details. Gender, goals, notes, guardian details and message text are not included.

The academy may then reply to you personally by email, phone or WhatsApp, as you agreed in the form. We do not send automated WhatsApp messages to students. If we ever offer WhatsApp confirmations, they will be optional and you will be able to turn them off. If you’d prefer not to be contacted on WhatsApp, tell us and we’ll use email or phone instead.

We don’t sell personal information. We use these service providers to run the academy, and they handle information on our behalf:

Google Firebase Authentication (Google): sign-in, including sending one-time sign-in links.
MongoDB Atlas (MongoDB, Inc.): our database.
Cloudinary: storing images and files, such as profile photos and course materials.
Vimeo: course videos and session recordings, played through Vimeo’s player.
YouTube (Google): some live sessions and recordings, played through YouTube’s player.
Jitsi Meet (meet.jit.si, operated by 8x8): live classes, including audio, video and your display name.
Meta’s WhatsApp Business Platform: alerts about new requests sent to the academy, once switched on.
Our hosting providers: running the website and server.

When you play an embedded video or join a live class, Vimeo, YouTube or Jitsi also handle your information under their own privacy policies. We may also disclose information if the law requires it, or to protect our students, our academy or others.

8. International transfers

Our providers may store or process information outside your country, including in the United States. Where the law requires it, we rely on the safeguards these providers offer, such as the European Commission’s standard contractual clauses.

9. How long we keep information

Requests that don’t lead to an enrolment: deleted automatically 12 months after we receive them.
Requests that lead to an enrolment: kept with the student’s record.
Your account, courses and progress: kept while your account is open, and deleted when you delete your account or ask us to, except the records below.
Payment records: kept for as long as accounting and tax law requires.
Attendance records: kept with your enrolment while your account is open, and deleted with it.
Messages sent to our WhatsApp notifications number: we keep only the message ID and the sender’s number, for 30 days, never the message itself.

10. Cookies and browser storage

We only store what the website needs to work. We don’t use analytics or advertising cookies, so there is no cookie banner. Our fonts are served from our own website, so loading a page doesn’t contact Google Fonts.

Name	Type	Purpose	How long
`token`	Cookie	Keeps you signed in	30 days, or until you sign out
`firaasah-auth`	Local storage	Remembers your name and role so pages load signed in	Your details are cleared when you sign out
Firebase sign-in data	Browser database (IndexedDB)	Your sign-in session, managed by Firebase	Removed when you sign out
`fa-recent-searches`	Local storage	Your last few searches, shown when you open search again	Until you clear them in the search box or your browser
`fa-enrol-v1`	Session storage	Saves your enrolment form progress in this tab	Deleted when you send the form or close the tab
`fa-orientation-v1`	Session storage	Saves your orientation form progress in this tab	Deleted when you send the form or close the tab
`fa-email-for-sign-in`	Local storage	Remembers the email you asked a sign-in link for, so the link can finish signing you in on this device	Deleted when you finish signing in

Embedded Vimeo and YouTube players and Jitsi live classes may set their own cookies when you use them.

11. Keeping information secure

Connections to the website are encrypted (HTTPS). Sign-in is handled by Firebase (Google), so there is no password for us to store or lose. Administrative areas are limited to academy administrators, and only people who need information to teach or support you can see it. No system is completely secure. If a breach affects your information, we will tell you and the relevant authorities where the law requires.

12. Our legal reasons for using information

To take steps you ask for before an agreement, and to perform our agreement with you: answering requests, arranging classes, giving course access and keeping attendance records.
Consent: being contacted about your request, and waiting lists. You can withdraw consent at any time, which doesn’t affect anything we did before.
Legitimate interests: keeping the website secure, preventing abuse, and running and moderating community features. We balance these against your rights.
Legal obligation: keeping financial records.

13. Your rights

You can ask us to:

give you a copy of your information, including in a portable format;
correct information that is wrong or incomplete;
delete your information, apart from what we must keep by law;
restrict how we use it, or object to how we use it;
stop contacting you about a request.

On your profile page you can update your details, download a copy of your information, and delete your account. Deleting your account removes your profile, course access and progress, questions, comments, ratings, live chat messages, requests and waiting lists; records of payments are kept as described above. To confirm it’s you, deletion asks you to sign in again.

For anything else, email firaasahh@gmail.com from the email address on your account or request. We may ask you to confirm your identity, and we reply within one month.

If you’re unhappy with how we handle your information, please tell us first so we can put it right. You can also complain to the data-protection authority where you live, such as the Information Commissioner’s Office in the UK.

14. Changes to this policy

We update this policy when our website or the way we handle information changes, and we change the “Last updated” date above. If a change significantly affects how we use your information, we will show a notice on the website.

15. Contact us

Email firaasahh@gmail.com with any question about this policy or your information. Our Terms of Service explain the agreement between you and Firaasah Academia.