Privacy

Last updated: 12 October 2026

Who we are

This website is run by Abdulhameed Assaad, a sole-trader Quran and Arabic tutor based in Cairo, Egypt (“we”, “us”). We decide how and why your personal data is used, which makes us the “controller” of it. For any question about your data, use the Contact page on this website or reply to any email we have sent you, and write “Privacy” in your message.

What we collect

When you request an intro call or lessons:

your name, email address and timezone;
optionally, your WhatsApp number;
whether the lessons are for you, your child or more than one person, and the Arabic level you choose;
the times you pick, and anything you choose to write in the note;
for a child: the child’s first name and age, and nothing more.

When you use the Contact form: your name, email, optional WhatsApp number, timezone and message.

We also keep the status of each request (confirmed, declined, cancelled, late cancellation) and a copy of the emails we send you. Our server and its network keep short-lived technical logs (for example your IP address and the page requested) to keep the site secure.

We do not collect card or bank details (payments are made on PayPal’s own site), we do not create accounts for students, and we do not record lessons by default. Please do not put health or other sensitive information in the note unless it is really needed for the lessons.

Why we use it, and our legal basis

We use your details only to:

answer your request, arrange, confirm, remind you of and run the lessons you ask for (to take steps at your request and to perform our agreement with you);
reply to your messages (our legitimate interest in answering you, and steps at your request);
keep records of lessons, cancellations and payments, and handle any complaint or dispute (our legitimate interests, and legal obligations where they apply);
keep children safe, including recording any safeguarding concern (our legitimate interests and, where it applies, legal obligations).

Learning the Quran may reveal religious belief, which is a special category of data in some countries. We use it only to provide the lessons you ask for, and we ask for your explicit consent, which you give by submitting the booking or contact form. You can withdraw your consent at any time; we would then not be able to continue the lessons.

We do not send marketing or newsletters. We do not make automated decisions about you and we do not build profiles. We never sell your data.

Who receives your data

Only the tutor reads your details. We use these service providers (“processors”) who act on our instructions, under data-processing terms:

a transactional email provider, to deliver confirmations, reminders and replies to you;
the private server where this website runs, which we operate ourselves (no public analytics or advertising services are used).

Other services receive data only when you use them:

the video-call service for the lesson (such as Google Meet or Zoom) sees your connection details and your audio and video while the lesson takes place, and applies its own privacy policy;
WhatsApp (Meta), only if you click a WhatsApp link or ask us to contact you there;
PayPal, when you pay: PayPal tells us your name, email and the amount, and applies its own privacy policy.

We may disclose data to the authorities or advisers where the law requires it, or where it is necessary to protect a child.

Sending data across borders

We are in Egypt and our students are around the world, so your details necessarily travel between countries: from you to our server, to the tutor in Egypt, and through our email and video-call providers, which may handle data in the EU, the UK, the USA and elsewhere. Where the law of your country requires safeguards for such transfers, we rely on suitable ones, such as the standard contractual clauses (and the UK addendum) in our providers’ data-processing terms. You can ask us how your data is protected when it is transferred.

How long we keep it

We do not keep personal data for longer than we need it:

declined, expired and cancelled requests: 90 days after the decision;
an intro call that does not lead to lessons: 12 months after the call;
students and their requests, notes and messages: 24 months after the last lesson;
contact messages from people who do not become students: 12 months after our last message;
copies of emails we sent: 90 days;
technical server logs: up to 30 days;
payment records held by PayPal and in our accounts: for the period tax and accounting law requires; they hold no child details;
a safeguarding concern, if one ever arises: as long as necessary to protect children and to deal with any legal claim.

When the time is up we delete the data or make it anonymous. Backups, if any, are replaced within 35 days. You can ask us to delete your data sooner (see Your rights).

Children

This website is for adults and for parents and guardians. Children never register, sign in or send us messages through it. A parent or legal guardian gives us the child’s first name and age, and uses them only to arrange and teach the lessons. We do not knowingly collect personal data directly from a child under 13 (or under the age set by law in your country). If a child contacts us, we reply to the parent only; if you think a child has sent us their details themselves, tell us and we will delete them. By booking for a child you confirm you are the child’s parent or legal guardian and agree to our use of the details above; you can see, correct or delete the child’s details, and refuse any further use of them, at any time. Lessons are live and are not recorded unless you agree in advance. Our Safeguarding page explains how children are protected.

Cookies and tracking

We use no advertising, analytics or tracking cookies, and no third-party scripts, fonts or trackers; the fonts are served from our own server. Your browser keeps one setting for us, your light or dark theme choice, which stays on your device. A sign-in cookie exists only in the tutor’s private area; visitors do not receive it. This is why there is no cookie banner. Links to WhatsApp, PayPal and the video-call service lead to their own sites, which have their own rules.

Keeping it secure

Your data is kept on a private server under our control, sent over an encrypted (HTTPS) connection, and open only to the tutor, who signs in with a one-time link sent by email. Each request has a private link in your email: please do not share it, because anyone with the link can see or cancel that request. We collect as little as we can and delete it on a schedule. No system is perfectly secure; if a breach puts you at risk we will tell you and the authorities as the law requires.

Your rights

You may ask us to:

tell you what we hold about you and give you a copy;
correct anything that is wrong or incomplete;
delete your data (we will do so unless we must keep something to meet a legal duty or to protect a child);
restrict how we use it, or object to our using it;
give you the data you provided in a portable format;
stop relying on your consent, which you may withdraw at any time.

To use any of these, contact us as described above. We may ask you to reply from the email you booked with, so we know it is you. A parent or guardian can act for a child. We answer within 30 days, free of charge.

Your country

United Kingdom and European Union: the UK GDPR and EU GDPR apply to our handling of your data, with the legal bases above. Australia: we handle personal information in line with the Australian Privacy Principles, including access and correction. Canada: we follow the principles of PIPEDA (accountability, consent, limited collection, access and challenging compliance). United States: we do not sell or share personal information for advertising, and parents can review and delete their child’s information as described under Children. California and other states give residents rights to know, delete and correct, which we honour on request. Egypt: we handle personal data in line with Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and respect the rights it grants you.

Complaints

Please tell us first and we will try to put things right. You may also complain to the data-protection authority where you live: for example the Information Commissioner’s Office (ico.org.uk) in the UK, your national or state data-protection authority in the EU, the Office of the Australian Information Commissioner (oaic.gov.au), the Office of the Privacy Commissioner of Canada (priv.gc.ca), your state attorney general in the US, or the Personal Data Protection Centre in Egypt.

Changes to this page

If we change what we do with your data we will update this page and its date. If a change matters to you, for example a new provider handling your details, we will tell families with active requests or lessons by email.