Ustaz Privacy Policy
Last updated:
Who we are
Ustaz is run by USTAZ LTD, a company registered in England and Wales (company number 17524861). Registered office: Flat 41 Lawson House, White City Estate, London W12 7PZ. USTAZ LTD decides how your data is used (it is the "controller"). Ustaz sells live one-to-one online Arabic lessons.
In this policy, "we" means USTAZ LTD. For any privacy question, request or complaint, email [email protected].
Accounts are only for people aged 18 or over.
What we collect
We collect only what the lessons, payments and safety need. Most of it comes from you. Parents give child nicknames and age bands, teachers write lesson cards, the other person in a lesson writes messages and reports, and sanctions checks use official sanctions lists. Your email and a password are needed to create an account, and booking and payment details to arrange a paid lesson. A phone number, photo and intro video are optional.
| Kind | What |
|---|---|
| Account | Email, password (stored only as a one-way hash), whether you are a student or teacher, whether you confirmed your email address, your phone number if you ask to verify it, and whether it is verified, and the date you confirmed you are 18 or over |
| Email links | When you ask to reset your password or confirm your email address, we email you a single-use link. We keep only a scrambled copy of it. A reset link works for 30 minutes, an email link for 24 hours |
| Student profile | Display name, language, currency, time zone, low-data setting |
| Children (only if a parent adds them) | For each child a parent adds: a nickname (up to 20 letters) and an age band (4-6, 7-9, 10-12 or 13-17), and which booked lessons are for that child. No birthday, photo, email, password or school, and nothing about how a child plays on the kids pages |
| Teacher profile | Names in Arabic and English, headline, bio, goals, a broad location you choose (never a city or a map), time zone, subjects, qualifications you list, an optional photo (we strip its hidden data), an optional intro video link, your teaching hours |
| Lessons | Bookings, times, status, cancellations, reschedules, star ratings (no written reviews), and problem reports about a lesson (the reason, your note of up to 500 characters, and the teacher's one reply) |
| My Arabic journey (lesson cards) | What the teacher writes after a lesson: the book, unit and page, up to 10 words (in Arabic, with meaning and how to say them), what went well, what to work on, and up to 3 tasks, plus which tasks you ticked. Your weeks in a row and lesson totals are worked out from your lessons. No card is made for a lesson booked for a child |
| Lesson slides (teachers) | Page pictures of the slides a teacher uploads to show in a lesson, and their title. The pictures are made in the teacher's browser; the original PDF or images are not uploaded |
| Payments | Amount, currency, status and Stripe reference numbers. You type card details and the payment email on Stripe's page; we never see or store card numbers |
| Teacher payouts | Payout method name and a masked account (at most the last 4 digits), payout history, and a sanctions check record made by a person |
| Messages | Messages between you and a teacher or student, reports of messages, and lesson notices |
| Live lessons | Your voice, and your video if you turn it on, passed live to the other person. Not recorded, except for lesson notes |
| Lesson notes (only if both people agree) | The two microphones' audio, the transcript, the teacher's notes and their earlier versions, and a Quran comparison report |
| Security and device | IP address and device or browser type when you sign in, failed sign-in counts, a scrambled IP on consent records, one sign-in cookie on the website, and your language and theme settings |
| iPhone pilot (TestFlight) | If you test the iPhone app through Apple's TestFlight, Apple may share crash reports, basic usage information and any feedback you send with us, under Apple's terms |
We do not request your GPS location, and we do not collect your contacts, advertising IDs or tracking data. Our service providers receive your IP address and may work out an approximate country or region from it for security, routing or statistics; this is not precise tracking. We use no visit analytics and no advertising tools, on ustaz.io or in the app.
How we use it, and why we are allowed to
We use your data to run your lessons, pay teachers and keep Ustaz safe. We never sell it, show ads or send marketing. The only text message we send is a code to check your phone number. We send password-reset and email-confirmation links, reply when you write to us, and may email you important information about your account, our terms or this policy.
| What we do | Legal reason |
|---|---|
| Run your account: booking, paying, messaging, joining lessons | Our agreement with you (contract) |
| Show your lesson cards and progress (My Arabic journey) | Contract |
| Email you a password-reset or email-confirmation link when you ask | Contract, and our legitimate interest in keeping accounts safe |
| Show a teacher's public profile in search | Contract: the teacher chooses to publish it |
| Children's nicknames, age bands and live lesson voice and video | Our legitimate interest, and the parent's, in arranging and teaching the child's lessons safely |
| Pay teachers and keep payment, refund and payout records | Contract, and our legal duties on tax and money |
| Keep sign-in safe, limit abuse, handle message reports | Our legitimate interest in a safe service |
| Check teachers against sanctions lists before payouts | Legal duty |
| Make lesson notes | Your explicit consent, and the other person's, because notes can include sensitive information such as religious beliefs. You can withdraw it at any time, and lessons work without notes |
Lesson recordings and notes are never used to settle disputes, and never used to train any software.
Lesson notes
Lesson notes are off unless both people say yes, and either person can stop and delete them at any time. No outside transcription or AI company ever receives the audio or the notes.
When they run. Both people must switch on "I want lesson notes" and confirm they are 18 or over. Both must say yes for that lesson, and the student confirms no child will take part. A notice shows in the lesson, and notes start only after both press OK. Either person can press Stop notes, which deletes the recording.
What is captured. A silent listener joins the lesson and records only the two people's microphones: no video and no screen.
Where it is processed. Lesson notes are made on our own encrypted server outside the UK, not by any cloud or AI company. Speech-recognition software on that server turns the audio into written notes, and the audio and notes are kept in an encrypted folder there. When you open your notes, the text passes through our API and Cloudflare for a few seconds and is not stored there.
Who can read them. The teacher can read, edit, approve and delete them. The student can read them after the teacher approves. Ustaz admins cannot open them in the app. The notes server also keeps the transcript and earlier versions of the notes, under the same deletion rules.
How long they are kept.
- Audio: deleted when the teacher approves the notes, or 14 days after the lesson at the latest.
- Notes not yet approved: deleted 30 days after the lesson.
- Approved notes: deleted 365 days after the lesson.
- Either person can delete the notes at any time. That deletes them for both.
No backup. Notes are kept in one place only. If that server fails, notes can be lost.
Quran. The server compares the transcript with the Quran text and keeps a comparison report with the notes (matched verse references and word differences), under the same deletion rules. Our main database receives only summary counts. The comparison is automatic; it is not a pronunciation or tajweed grade.
Who we share it with
We share data only with the services that run Ustaz, each getting only what its job needs, and with the other person in your lessons.
| Service | What it gets | Where |
|---|---|---|
| Microsoft Azure | Hosts our API and processes every request sent to it. Live audio and video go through LiveKit, and slide pictures go straight to Cloudflare storage | United Kingdom (UK South) |
| Neon | Our database: accounts, profiles, bookings, messages, money records. Not lesson notes | United Kingdom (London) |
| Cloudflare | Hosts the website and ustaz.io and passes every app request to our API, so it sees your IP address. Also stores teachers' lesson slides (page pictures) in its R2 storage | Worldwide network; slides stored in the EU |
| Stripe | The payment page: amount, currency and a booking number. You give your card and email to Stripe directly. Stripe also uses payment data for its own fraud checks and legal duties | Stripe's companies in Ireland and the UK; also the United States and other countries |
| Twilio | Your phone number and the verification code it texts you | United States |
| LiveKit | Carries live lesson voice and video between you, and receives room and user numbers, display names and technical connection data. It does not record lessons; it keeps some technical records under its data-protection terms | Worldwide network (the servers nearest to you) |
| Google Workspace | Our email inbox, when you write to us | United States and other countries |
| Resend | Sends our password-reset and email-confirmation emails: your email address and the link | Sent from Ireland (EU); records kept in the United States for 30 days |
Other people on Ustaz. Anyone can see a teacher's public profile. The other person in a booking sees your display name, your messages and the lesson details. For a lesson report, the teacher sees the reason but not your note; Ustaz reviewers see your note and the teacher's reply, and you see that reply.
The law. We share data if the law requires it, and only what it requires.
How long we keep it
We keep your data while your account is open. When you delete your account, after the waiting and settlement steps described under Your rights, we erase your account and profile details and clear your message text and the lesson-report note or reply you wrote. We keep transaction and compliance records, booking and security records, and consent records under the rules below. Lesson cards written by a teacher stay with the student until the student's account is erased. Some kept records can still identify you, so we limit who can see them.
| Data | How long |
|---|---|
| Account and profile | Until you delete your account |
| Teacher photo | Until you replace or remove it, or delete your account |
| Child profiles (nickname and age band) | Until the parent removes the child or starts closing their account; then removed at once, even while payments are still being settled |
| Lesson slides | 12 months after the teacher last uses them. Deleted sooner when the teacher deletes them or closes their account |
| Messages you sent | Until you delete your account. The other person then sees "Message deleted" |
| Problem reports about a lesson | The words are erased when you delete your account. The outcome (refund or teacher paid) stays with the money records |
| Lesson notes | See Lesson notes above: audio at most 14 days, approved notes 365 days |
| Lesson cards (My Arabic journey) | Until the student deletes their account. The teacher can change a card for 7 days after the lesson |
| Consent records | 24 months after your latest scheduled lesson end, or after your latest notes choice if you had no bookings. If your account is erased, the earlier of that date and the erasure date starts the 24 months. The scrambled IP goes after 90 days |
| Sign-in security log (IP, device type) | 90 days |
| Phone verification codes | 30 days |
| Email links (scrambled copy) | Until you delete your account. A link stops working after 30 minutes (reset) or 24 hours (email check), or once used |
| Accounting records (payments, refunds, payouts) and sanctions checks | 6 years after the end of the financial year they belong to, or longer if the law or an open claim needs it |
| Emails to [email protected] | 2 years after the last message, unless needed for a legal claim |
| Server logs (no lesson content) | Not saved to a log store; our host keeps only a short recent buffer for fixing faults |
Your rights
You can see, correct, download or delete your data, and we normally answer within one month. If the law allows more time for a complex request, we tell you why within that first month. Email [email protected] for anything the app does not do itself.
- Delete your account in the app: Account, then Delete account. The app may first ask you to settle a lesson that is under way or disrupted, a paid lesson 24 hours or less away, or (for teachers) a finished lesson not yet marked complete. Once accepted, sign-in stops at once, future lessons are cancelled under the normal refund rules, your child profiles and email links are deleted, and your lesson notes are deleted by background clean-up. After a waiting period of at least 30 minutes, and once payments, refunds and required clean-up are settled, we erase your account and profile details and clear your message and report text. The records described under How long we keep it remain. You can also email us to ask for erasure.
- See or get a copy of your data.
- Correct anything wrong. Most of it you can edit in your profile.
- Stop lesson notes at any time: switch off "I want lesson notes", or press Stop notes in a lesson.
- Object or ask us to limit how we use your data.
- Complain to a regulator. In the UK that is the Information Commissioner's Office; in the EU, your country's data protection authority. We would like the chance to fix it first.
Children, security, transfers and cookies
Children. Only adults can have an account. A parent can add their children to their own account, with a nickname and an age band only. A teacher sees that nickname and age band only on lessons booked for that child. The kids pages ask who is playing, but store and send nothing about play. For children's lessons the parent stays with the child for the whole lesson. The child's voice or image passes live to the teacher and is never recorded. Lesson notes are not allowed when a child takes part, and no lesson card (My Arabic journey) is made for a child's lesson. A parent can remove a child at any time, and closing the parent's account removes all its children at once. We do not ask a child to create an account or give us any details; if we learn a child made their own account, we delete it.
Security. Web and app traffic uses HTTPS, and live audio and video are encrypted on the way (WebRTC security). Passwords are stored only as a one-way hash, sign-in tokens last 15 minutes, and an account locks for 15 minutes after 5 wrong passwords. Card numbers never reach our systems. Lesson notes sit in an encrypted folder. No system is perfectly safe; if a breach puts you at risk, we will tell you.
Data abroad. Our API and database are in the United Kingdom, and lesson slides are stored in the EU. Lesson notes are made on our own encrypted server outside the UK. Stripe, Twilio, LiveKit, Google and Resend are US companies and may handle data in the United States and other countries. Depending on the service, these transfers rely on the UK Extension to the EU-US Data Privacy Framework or on standard contract clauses with the UK Addendum. Email [email protected] to ask which safeguard a service uses and for a copy.
Cookies and storage. The website sets one cookie, which keeps you signed in for up to 30 days and is sent only to our sign-in service. Your browser also stores your language, theme and basic session details (never your password). On phones, sign-in details are kept in the phone's secure storage. We use no analytics or advertising cookies.
Changes. If we change this policy we will update the date at the top, and tell you by email or in the app before any big change applies.