Privacy Policy

Who decides what is kept about a child depends on the kind of account:

• School, masjid and tutor accounts. The school, masjid or tutor decides what to record about its students and families. It is responsible for having the right to collect that information and for telling families about it. We keep and handle the information for them, to run the service they use. If you have a question about those records, ask the school first; we will help them answer it.
• Family accounts. When a parent or carer opens a family account, that adult holds the account and we handle the family’s information directly under this policy.
• Everyone else. If you contact us, book a demo or apply to a school through Nurdar, we handle the details you send under this policy.

• Account details. Name, email address, role and language, and a password that is stored only in a scrambled (hashed) form that cannot be read back.
• Children’s details. Name, date of birth, school year and gender. A child’s login uses a username and password set up by their parent, school or tutor; children do not need an email address.
• Health and care details. Medical notes, allergies, dietary needs and emergency contacts, but only if a parent or school chooses to enter them. Learning supports (such as read aloud or step-by-step questions) may also be set. We do not ask for or record diagnoses. Health information is sensitive information under Australian law, and we treat it with extra care.
• Learning records. Lessons, Quran progress and word marks, homework, attendance, practice answers and how long they took, points, stars, badges, certificates and teachers’ notes.
• Voice recordings and homework photos. Recordings of children reciting or reading (with measures such as pace and pauses) and photos of written homework. These are private to the child’s family and their teachers.
• Online classes. The name shown in the call and the time someone joined, for attendance. We do not record the video or sound of online classes.
• Payments and fees. Subscription billing details are collected by Stripe (such as card or bank details, billing name, address and ABN). Fee records a school keeps, such as invoices, payments and discounts, may show personal circumstances, for example a hardship, zakat or scholarship discount.
• Messages and enquiries. What you send through our contact form, demo bookings and school enrolment applications, and messages schools send to their families.
• Technical information. Sign-in attempts (the email, username or IP address used, so we can stop password guessing), error reports, a record of important actions in each account, and page visits counted with a code that changes daily so we never store your IP address for this.

We collect information from you directly; from the school, masjid or tutor that uses Nurdar; from parents about their children; from children as they use Nurdar (for example their practice answers and recordings); and automatically when the service is used. If a parent or school gives us information about someone else, they should make sure that person (or, for a child, their parent) knows about it.

We use personal information to:

• run Nurdar, so children can learn and teachers and parents can follow their progress;
• let schools take attendance, look after children’s care needs and keep fee records;
• keep accounts safe and stop misuse;
• handle subscriptions and payments;
• send emails the service needs, such as sign-up, invitations, password resets, absence notices and messages from a school;
• answer questions and give support; and
• find and fix problems, improve Nurdar and meet our legal duties.

We do not sell personal information. We do not show advertising, use advertising trackers, or use children’s information for marketing.

Nurdar is made for children’s learning, so we keep children’s privacy at the centre:

• A child’s account is set up and looked after by a parent, school or tutor. Accounts for adults need a person aged 18 or over.
• We rely on the parent, or the school with the parent’s agreement, to decide what is entered about a child.
• A child’s points from other places they learn are shown to a school only as far as the family’s sharing choice allows.
• Challenge boards show other children only the top few names.
• A parent can make a read-only weekly summary link to share with a teacher. It stops working two weeks after that week ends.
• Certificates can only be opened by the child, their parents and the staff who teach them.

• The school, masjid or tutor. Staff see what their role needs. For example, a teacher sees their own classes, and an accountant sees fees.
• Families. Parents see their own children. Children see their own work.
• The public. Masjid screens and enrolment pages are public, so schools should only put on them what they are happy for anyone to see.
• Our team. A small number of people who run Nurdar can open an account to give support or keep the service safe.

We use a small number of providers to run Nurdar. Each receives only what it needs for its part:

• Supabase keeps the database, recordings and photos, hosted in Sydney, Australia.
• Vercel hosts and runs the website (United States and a global network).
• Stripe handles subscription payments and school fee payments.
• Resend sends the emails Nurdar needs (United States).
• Jitsi, by 8x8 carries the video and sound of online classes, using the name shown in the call.
• Sentry receives error reports when switched on, set up so it does not collect personal details by default (United States).

Prayer times, the Quran text and read aloud all work inside Nurdar or your browser; no other service is used for them. We may also share information when the law requires it, to protect someone from serious harm, or with a buyer if Nurdar is sold, who must keep this policy’s promises.

Our main database and files are kept in Australia. Some of the providers above (Vercel, Stripe, Resend, 8x8 and Sentry) may handle information in other countries, mainly the United States. We choose providers with strong security and privacy commitments and take reasonable steps so they handle information in line with the Australian Privacy Principles.

Information is encrypted when it travels over the internet. Passwords are hashed. Recordings and photos are kept in private storage and opened through links that expire. Each school’s information is kept apart so one organisation cannot see another’s. Repeated wrong sign-ins are slowed down, and the database is backed up.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

• Voice recordings and homework photos: deleted automatically after 90 days, or sooner if they are deleted in Nurdar.
• Sign-in attempts: one day. Error reports: 30 days.
• Accounts and learning records: kept while the account is in use, so children keep their progress. If a plan ends, the account moves to the free plan and nothing is deleted.
• Closed accounts: when a school or family asks us to close their account, we delete its records and files, after giving them a chance to take a copy. Copies in backups are removed as the backups roll over.
• Enquiries and demo requests: kept while we need them to reply and follow up.

We use a sign-in cookie to keep you signed in (for 30 days, or 12 hours if you do not tick “Keep me signed in”) and a cookie that remembers your language. Your browser also keeps a few settings, such as whether the side menu is open and your best practice scores. We do not use advertising or third-party analytics cookies.

You can ask to see the personal information we hold about you or your child, ask us to correct it, or ask us to delete it or close your account. Email us at admin@webteches.com.au. It is free, and we will reply within 30 days. If the information is part of a school’s records, we may pass your request to the school and help them answer it.

If you are worried about how we have handled your information, email us at admin@webteches.com.au and we will reply within 30 days. If you are not happy with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We will update this policy when Nurdar changes how it handles information, and change the date at the top. If a change is important, we will tell account holders by email or in Nurdar before it takes effect. Our Terms of Service explain the rest of how Nurdar works.

For any privacy question or request, email admin@webteches.com.au.