Privacy Policy - Hifd Mateen

1. Who we are and who is responsible for what

Hifd Mateen (also called Mateen) is available at https://hifdmateen.com and as the Android app Hifd Mateen (package com.mateen.school). It is operated by Hifd Mateen. You can reach us at support@hifdmateen.com.

Hifd Mateen serves many schools on one platform, so responsibility depends on the kind of data:

• Each school (a "tenant") that uses Hifd Mateen decides which data about its students, parents or guardians and staff is recorded, why and for how long. For that data the school is the data controller. Hifd Mateen provides the platform and acts as the school's processor: we store and process this data only to run the service for that school.
• Hifd Mateen is the data controller for data of website visitors, for school sign-up requests ("Register now"), for donation requests ("Donate Now"), for messages sent through the contact form, for suggestions and feedback sent from inside the app, and for the technical and security data we need to run the platform.

If you are a student, parent or teacher, please direct questions about your records at school to your school first.

2. Data we collect

Data recorded by schools about their users. The school decides what to enter; several items are optional:

• Identity and contact: first and last name, email address, phone or WhatsApp number, date of birth, gender, optional profile photo, spoken languages, preferred language, student level, and notes written by staff.
• Account and role: role (for example administrator, teacher, student or parent), group or class membership, whether the account is active, and when you accepted the terms of use (date, version, language).
• Attendance and leave: attendance records, leave requests and school holidays.
• Quran learning records: study plans, memorisation (hifd) and revision records, mistakes with notes, exams (sessions, questions, mistakes, grades), tasks for the next session, progress and reports.
• Tuition fees: fee records and the receipt files (images or documents) uploaded for them.
• Communication: announcements and notification records, and your preferences such as language and theme.

Data we collect when you use Hifd Mateen:

• Sign-in and security: your email address; your password, which is stored only as a hash (ASP.NET Core Identity); failed-sign-in counters and lockout status; session (refresh token) records with the IP address and device name of the sign-in; and one-time links or codes for invitations, password reset and email change, which expire.
• Push notifications (Android app): a Firebase Cloud Messaging device token, with the platform, device name and your language, so the app can receive notifications.
• Emails sent by the platform (invitations, password resets, decisions on registrations): we keep a log with the recipient, subject, content and delivery status.
• Server logs: our applications write logs (time, requested address, events and error messages, which can include an email address). Application log files are rotated and kept for 14 days. Our hosting infrastructure may also record IP addresses in its own access logs.
• Website: the cookies and browser storage described in the Cookies section, including your browser's time zone.

Data you send to us directly:

• School sign-up ("Register now"): school name, administrator name, email, phone or WhatsApp number, country and an optional address. The administrator password in a pending request is stored encrypted until the request is reviewed.
• Donation request ("Donate Now"): name, email, country, amount, currency and an optional message. No payment details are collected.
• Contact form on the home page: first and last name, country, phone number, email and your message.
• Suggestions and feedback from the app: your name, email, role and school, the title and text (up to 500 characters), optional images, and our reply.

Help assistant (website): the questions you type into the "Mateen" help assistant, together with the last few messages of the conversation and excerpts from the user manual, are sent to an AI provider (Google Gemini) to write an answer. We do not add your name, email, school or any records to what is sent, but everything you type is sent, so please do not enter personal data. The text of the question is also written to our application log. If the primary provider is unavailable we may use Anthropic (Claude) as a backup provider.

3. How we use data and our legal bases

We use data to:

• provide and run the service: accounts, records, attendance, plans, exams, reports and announcements;
• sign you in, keep accounts and sessions secure, and prevent abuse (for example rate limits and lockouts);
• send notifications and emails you need: invitations, password resets, announcements and decisions on registrations;
• answer sign-up requests, contact messages, donation requests and feedback, and give support;
• maintain and fix the platform and meet our legal obligations.

We do not use personal data for advertising, we do not build advertising profiles, and we do not make automated decisions that have legal effects on you.

Legal bases (GDPR). For data a school records about its students and staff, the school determines the legal basis (for example its agreement with the family, a legitimate interest, or consent). For data we control ourselves we rely on: performing a contract or taking steps before one (accounts and school sign-ups); legitimate interests (security, running and improving the platform, answering messages and donation requests); consent where we ask for it (for example the push-notification permission on your device or an optional profile photo); and legal obligations. Hifd Mateen is offered in Dutch, English and Arabic, and we apply EU data-protection principles to all users.

4. Sharing and service providers

We do not sell personal data and we do not show advertising. Data is shared only as follows:

• Within your school: authorised users of the same school see data according to their role and permissions (for example administrators, teachers and the student or parent concerned). Data of one school is not visible to another school.
• Hifd Mateen administrators: authorised people who operate the platform can access central data (school sign-ups, donation requests, contact messages, suggestions, the user directory and email logs) to handle requests and give support.
• Our hosting provider: the servers and databases that run the website, the app's service and stored files.
• An email delivery provider: sends the emails of the platform (SMTP).
• Google Firebase Cloud Messaging: delivers push notifications to the Android app (device token and notification content).
• Google Gemini (and, as backup, Anthropic): answers questions asked in the help assistant (see Data we collect).
• Quran text sources: when an administrator imports Quran text, our servers request ayah text and page-layout data from public Quran services such as quran.com. These requests contain no personal data.
• Authorities, when we are legally required to disclose data.

The website and the app contain no analytics, advertising or crash-reporting SDK. Donation requests are only recorded; this platform does not process payments or store card details, and we contact the donor by email.

5. Children

Quran schools teach children. Student accounts are created by the school, or by a parent or guardian, and not by children themselves; there is no way for a child to sign up alone. We do not knowingly collect personal data from children outside a school context, and we do not use children's data for advertising.

The school is responsible for obtaining any parental or guardian consent that its own use of student data requires. A parent or guardian can ask the school, or us, to access, correct or delete a child's data (see Account and data deletion). If you believe a child's data was given to us without the required consent, contact us at support@hifdmateen.com and we will act on it.

6. Security

We protect data with measures that exist in the software:

• Encrypted connections: the website and the service use HTTPS (TLS).
• Passwords are stored only as hashes, must have at least 8 characters including upper-case letters, lower-case letters and a digit, and an account is locked for 15 minutes after 5 failed sign-ins.
• Access tokens are signed and expire; refresh tokens are stored only as hashes, are replaced each time they are used (rotation) and can be revoked.
• Role-based access: every action is checked against the user's role and permissions.
• Separate database per school: each school's data is kept in its own database.
• Every request to the service must carry a client key issued to our website and app.
• Rate limits on public forms and sensitive endpoints (sign-up, password reset, invitations, donations).

No system is completely secure. If you suspect misuse of your account, contact your school administrator or us.

7. Data retention

How the software handles retention:

• Schools can deactivate accounts and delete records; deleted records are flagged as deleted and hidden from users. Deactivated users keep their history for the school.
• Data of a school is kept while the school's account is active.
• Application log files are rotated and kept for 14 days.
• Sessions (refresh tokens), invitations and codes expire.

The software does not define other fixed retention periods. As our policy commitment, we keep personal data only as long as the account or school is active and as long as the school or the law requires, and we delete or anonymise it on a verified request within 30 days (see the next section).

8. Account and data deletion

You can ask for your account and personal data to be deleted at any time. Uninstalling the app does not delete your account.

How to ask:

• Ask your school administrator. The school controls the accounts of its students and staff and can deactivate or delete them.
• Or send an email to support@hifdmateen.com from the address registered to the account, with the subject "Account deletion request". Include your name, your school, your role and, for a child's account, the name of the parent or guardian making the request. We may ask you to confirm your identity, or confirm with the school, before we delete anything.

We confirm receipt promptly and complete the request within 30 days.

What is deleted: your profile (name, email, phone or WhatsApp number, date of birth, gender, photo, notes), your sign-in sessions and password, push-notification device tokens, notification records and preferences. Your learning, attendance and other records are deleted, or anonymised so that they no longer identify you.

What may be kept: records the school must keep under its own legal duties (for example fee and financial records), data needed to protect other users' records (kept in anonymised form), records of sent emails and security logs for a limited time, and backups, which are replaced in the normal backup cycle. Messages you sent through the contact, donation or sign-up forms can be deleted on request in the same way.

9. Your rights

Under the GDPR and similar laws you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent.

To use these rights, contact your school or us at support@hifdmateen.com. For data a school controls, we pass the request to the school and help it respond. You also have the right to complain to a supervisory authority, for example the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or the authority in your own country.

10. International transfers

Some of our providers, in particular Google (Firebase Cloud Messaging and Gemini) and, if used, Anthropic, may process data in countries outside the European Economic Area, including the United States. Where this happens we rely on safeguards such as the European Commission's standard contractual clauses or an adequacy decision such as the EU-US Data Privacy Framework, and we limit what is sent.

11. Cookies and similar technologies on the website

The website uses only strictly necessary cookies and browser storage. We do not use advertising, tracking or analytics cookies, no third-party cookies, and no third-party fonts or trackers, so there is no cookie banner.

• Sign-in cookie: keeps you signed in; expires after about 4 hours.
• Security (anti-forgery) cookie: protects forms against forgery.
• Language cookie (.AspNetCore.Culture): remembers your language.
• Theme cookie (mateen-theme) and browser storage: remember light or dark mode.
• Time-zone cookie (mateen-tz): your browser's time zone, so times are shown correctly; kept for 1 year.
• Browser storage on your device only: the position of the help button and which announcements or leave notices you have already seen.

You can delete these in your browser settings; the website still works but will forget your choices and may sign you out.

12. Changes to this policy

We may update this policy, for example when the service or the law changes. The current version is always on this page, with its "Last updated" date at the top. For material changes we will make reasonable efforts to inform schools and users, for example in the app or on the website.

13. Contact

Questions, requests or complaints about privacy: support@hifdmateen.com.

Your school administrator is also a point of contact for data your school manages, and you can use the feedback form in the app or the contact form on the home page.

Operated by Hifd Mateen. Privacy contact: support@hifdmateen.com.