Who controls the data
[Owner company name], registered in the Sultanate of Oman, is the controller of the personal data that Irsaa Educational Platform collects. For questions about your data: [privacy email].
What we collect
- Parents: first and last name, relation to the children (father, mother or guardian), email, a mobile number if you add one, and when you gave each consent.
- Children: first name, boy or girl, grade, the companion they chose, their username, and their learning progress. We never ask for a child's surname, school or photo.
- Teachers: name, gender, email, the subjects and grades they teach, and their verification status.
- Use data the service needs: the kind of device and browser used to sign in (such as "a Windows computer"), and sign-in times.
- We never store sign-in codes or passwords themselves, only a one-way encrypted form of them.
Why we use it
- To provide the service: accounts, lessons, saved progress and parents' reports.
- To contact you: verification codes, your children's sign-in details and account notices.
- To protect accounts: for example, telling you when a child signs in on a new device.
- For payment and invoices when you buy a pass.
Legal basis
We process children's data on the explicit consent of their guardian under Oman's Personal Data Protection Law (Royal Decree 6/2022). Each consent is recorded with its time, and can be withdrawn at any time.
Where the data is stored and who processes it
The data is stored outside the Sultanate of Oman with providers we contract with, which is why we ask for your consent to that separately:
- Servers and database: Hetzner, in [Germany or Finland].
- Files and book page images: Cloudflare.
- Sending email: [email provider].
- The AI helper: Anthropic, in the United States. Only the question and the book page are sent to it, never a child's name.
- Payment: Thawani, in the Sultanate of Oman. We do not store card details.
How long we keep it
We keep the data while the account is open. When an account is closed we delete the children's data within [period], and keep payment records for as long as the law requires. [Retention of backups: to be set.]
Your rights
A parent can see their own and their children's data, correct it, ask for it to be deleted, withdraw consent, and ask for a copy. To use these rights, write to [privacy email]. You may also complain to [the authority responsible for personal data protection in Oman].
Children
- No data about a child is entered before their guardian's consent.
- The weekly league is optional, uses nicknames only, starts from grade 5, and is switched on only with a parent's consent.
- No child's name is shown to other children.
Security
We protect the data with encryption in transit, by storing sign-in codes in an encrypted form, by keeping each school's data apart from every other's, and with backups that are restored regularly to test them.
Changes to this notice
We will tell you about any significant change before it takes effect, and ask for your agreement again where needed.