Draft: legal review required before launch. This text is a placeholder and is not legal advice.
Privacy policy
This policy explains what personal data Itqan collects, why, who we share it with and the choices you have. It covers the Itqan learning platform and the Weekly Challenge.
Who we are
Itqan is operated by Zaynora Labs. For privacy questions or to exercise your rights, contact our grievance officer at zaynoralabs@gmail.com.
What we collect
Account data (name, email, password hash, language). Workspace content you upload (documents, videos, course text). Learning records (enrollments, lesson completions, quiz scores, certificates, live-class attendance). Payment records (amount, status and the provider's payment ID; we never see or store card numbers). For the Weekly Challenge: a child's first name, class, board, test answers and results, entered by a parent or a partner school. Technical data needed to keep the service secure, such as IP addresses used for rate limiting.
Why we use it
To provide the service you asked for, keep accounts secure, send transactional emails (verification, password reset, invitations, results), process payments and meet legal obligations. We do not sell personal data, show ads or build marketing profiles, and we never track or profile children.
Children's data
Children do not have accounts. A parent or legal guardian adds a child and gives verifiable consent, or a partner school confirms it holds that consent before importing students. Parents can download or delete their children's data at any time from the child's page or the account page.
Service providers
We use processors only to run the service: hosting and database, email delivery (SMTP provider), file and video storage (Cloudflare Stream / R2 or AWS S3, when enabled), payments (Razorpay and Stripe), speech-to-text (Deepgram, when enabled), video classrooms (Jitsi / 8x8 JaaS, when enabled) and Anthropic (Claude) to generate course content and questions from material you choose to submit. Each receives only the data it needs.
How long we keep it
For as long as your account exists. When you delete your account or a child's profile, the related records are deleted from the live database immediately and from backups within 14 days. Payment records may be retained where tax law requires.
Your rights
You can access, download, correct and delete your data from the account page, withdraw consent at any time, and raise a grievance with our grievance officer. Where applicable you may also complain to the Data Protection Board of India or your local data protection authority.
Security
Passwords are hashed, sessions are encrypted, sensitive links use one-time hashed tokens, sign-in attempts are rate limited, and traffic is served over HTTPS.