Privacy Policy

1. Our Privacy Commitment & Minor Protection

Al-Ibiewi LMS (“the Platform”, operated by Al-Ibiewi Studio) is built to serve Islamic academies, teachers, parents, and students. Because our users include children studying the Noble Qur'an and Islamic sciences, safeguarding child data is our highest responsibility.

We align our data governance with the Nigeria Data Protection Act (NDPA), the Nigeria Data Protection Regulation (NDPR), and international principles of the Children's Online Privacy Protection Act (COPPA). We never monetize, broker, or sell student records under any circumstances.

2. Children's Data & Guardian Consent

Student accounts under the age of 18 are enrolled and supervised strictly through their registered academy and verified parent or guardian:

• We do not collect personal contact details directly from young children without parental/guardian or academy authorization.
• Parents retain full transparency into their child's attendance, teacher lesson notes, and Qur'anic recitation milestones via their dedicated Parent Portal.
• Parents may inspect, correct, or request the deletion of their child's academic records through their academy administration at any time.

3. Information We Collect

We collect only the minimum data necessary to deliver educational administration:

• Academy & Administrator Data: Academy name, subdomain slug, director name, institutional email address, phone number, and Paystack billing metadata.
• Teacher Data: Name, email address, availability hours, and teaching assignments.
• Student Academic Records: First and last name, age or grade level, assigned classes, attendance logs, and Qur'anic progress records (Surah, Ayah, revision notes, Tajweed evaluations).
• Parent/Guardian Data: Name, verified email address, phone number, and relationship to student.
• System Logs: IP address, browser user-agent, and login timestamps retained strictly for security auditing and rate-limiting.

4. How We Use Information

Data entrusted to Al-Ibiewi LMS is used solely for educational purposes:

• Operating the multi-tenant academy control center and classroom schedules.
• Delivering transactional class reminders and attendance notifications.
• Calculating monthly active-student SaaS billing via Paystack.
• Maintaining institutional security and defending against cross-tenant data access.

We do not serve third-party advertisements, behavioral tracking cookies, or commercial marketing trackers on any student or classroom surface. Signed-in dashboards and each academy's own public pages carry no advertising tracker.

5. Multi-Tenant Database Isolation

Al-Ibiewi LMS is engineered with strict cryptographic and database-level tenant isolation. Every query executed across student rosters, teacher schedules, and billing records is scoped strictly to the authenticated institution's unique identifier (tenant_id). No academy can view, search, or access another academy's data.

6. Third-Party Service Providers

We partner with vetted, industry-leading infrastructure providers to deliver reliable services:

• Paystack: Processes subscription payments under strict PCI-DSS Level 1 compliance.
• Resend: Dispatches transactional emails such as verification, password-reset, and administrative account notices. Class reminders are not sent by email.
• Google Meet / Microsoft Teams: Used optionally by academies for live video conferencing via standard secure links.
• Meta (Facebook) Pixel: Used only on our own public marketing pages (home, about, blog, tutorials, contact, legal pages and the school application page) to measure our advertising on Facebook and Instagram. It records page visits and that a school application was sent. It never receives an applicant's name, e-mail or phone number, and it never runs inside dashboards or on an academy's pages.

7. Data Retention & Right to Erasure

Academic records are retained for as long as an academy maintains an active subscription. Upon institutional termination or verified parental request, student records can be exported in structured format and permanently purged from active databases within thirty (30) days.