Your data, handled responsibly

1. Scope & Who We Are

AinTaleem (“AinTaleem”, “we”, “us”) provides a School ERP platform — a web dashboard and the AinTaleem mobile app — used by schools (“Institutions”) to manage admissions, attendance, fees, exams, homework, timetables, and communication with students, parents, and staff.

Each Institution operates its own isolated tenant on AinTaleem: student, staff, and financial records for one school are stored separately from every other school on the platform and are not shared between Institutions.

For most of the personal data described below, the Institution is the data controller (they decide what is recorded and who can see it), and AinTaleem acts as the data processor that stores and processes it on the Institution's behalf. Questions about a specific student's or staff member's data should generally start with that student's or employee's school; we support Institutions in responding to those requests.

2. Information We Collect

What is collected depends on the person's role and the modules an Institution has enabled.

• Account & profile data — name, email, phone number, role (School Admin, Teacher, Student, Parent/Guardian, or other staff), campus/class assignment, and login credentials.
• Academic records — enrollment and class/section history, attendance status, exam results and grades, homework and diary entries, and timetable data.
• Attendance & biometric data — check-in/check-out timestamps, and, where an Institution has enabled a biometric device on campus, a biometric identifier used solely to match a device scan to a student or staff record. See Section 3 for details.
• Financial data — fee vouchers, amounts due and paid, payment status, and transaction references. Card and bank details, where collected, are handled directly by our third-party payment processors — AinTaleem does not store full card numbers.
• Communications — messages sent through the platform (announcements, complaints, teacher reviews), and delivery status of notifications sent via push notification or WhatsApp.
• Device & usage data — device push notification tokens, app version, general diagnostic and crash logs, and IP address for security and abuse prevention.

Biometric attendance is an optional feature an Institution may choose to enable using its own on-campus fingerprint devices. When enabled:

• The device stores and matches the fingerprint locally; AinTaleem receives only a numeric device user ID and a scan timestamp — not a fingerprint image.
• That numeric ID is used exclusively to mark attendance and calculate present/late/absent status for the day.
• Institutions may disable biometric attendance at any time, reverting fully to manual attendance marking.

Because biometric identifiers are treated as sensitive data under most privacy laws, we recommend Institutions obtain appropriate consent from students, parents, or staff before enabling this feature, per their local requirements.

4. How We Use Information

• To operate core features: attendance, fee tracking, exams, homework, timetables, and messaging.
• To send push notifications and WhatsApp messages an Institution configures (e.g. absence alerts, fee reminders, homework updates).
• To authenticate users and enforce role-based access within each Institution's tenant.
• To generate reports and analytics for school administrators (e.g. attendance rates, fee collection, class-wise performance).
• To maintain platform security, prevent abuse, and troubleshoot technical issues.
• To comply with legal obligations and respond to lawful requests.

AinTaleem is built to be used by schools on behalf of students, including children under 13. Student accounts and data are created and managed by the Institution (and, for younger students, typically accessed through a parent/guardian account) — not signed up directly by a child.

We rely on the Institution to obtain any consent required from parents or guardians under applicable law (such as COPPA, GDPR-K, or local equivalents) before enrolling a student on the platform. A parent or guardian who wants to review, correct, or request deletion of their child's data should contact their child's school directly, or reach us at privacy@aintaleem.com and we will coordinate with the Institution.

6. Sharing & Third Parties

We do not sell personal data. We share data only with:

• The Institution itself — staff with appropriate role permissions within that school's tenant.
• Infrastructure providers — our database hosting and cloud infrastructure providers, who store data on our behalf under contractual confidentiality obligations.
• Firebase Cloud Messaging (Google) — to deliver push notifications to the mobile app.
• WhatsApp Business API (Meta) — where an Institution enables WhatsApp notifications, message content and the recipient's phone number are shared with Meta's platform to deliver that message.
• Payment processors — to process fee payments where online payment is enabled.
• Legal & safety — where required to comply with law, or to protect the rights, property, or safety of AinTaleem, Institutions, or users.

Each Institution's data is stored in its own isolated database, separate from every other school on AinTaleem. Access to the platform requires authentication, and administrative actions are scoped to a user's assigned role and school.

No system is completely immune to risk, and we continually work to improve our security practices. If you believe you've found a vulnerability, please report it to security@aintaleem.com.

8. Data Retention

We retain data for as long as an Institution maintains an active account, plus a reasonable period afterward to allow for account recovery, satisfy legal or academic record-keeping obligations, and resolve disputes. An Institution may request deletion of its data (subject to any legal retention requirements) by contacting us at privacy@aintaleem.com.

9. Your Rights & Choices

Depending on your location and role, you may have rights to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. Because most student, parent, and staff data is entered and controlled by the Institution, the fastest way to exercise these rights is usually through your school's admin office. You're also welcome to contact us directly and we'll route your request appropriately.

You can control push notification permissions from your device settings at any time, and can ask your Institution to disable WhatsApp notifications for your account.

AinTaleem is used by schools in multiple countries. Data may be processed in a country other than the one where you or your Institution are located, including by the infrastructure and messaging providers listed in Section 6. Where required by law, we rely on appropriate safeguards for such transfers.

11. Cookies (Website)

Our marketing website (aintaleem.com) uses cookies and similar technologies for essential site functionality and to understand how visitors use the site. The AinTaleem mobile app and school portal do not use advertising cookies. You can control cookies through your browser settings.

12. Changes to This Policy

We may update this policy as our platform evolves or to reflect legal or regulatory changes. We'll update the “Last updated” date above, and for material changes, we'll take reasonable steps to notify Institution administrators.

Questions about this policy or how your data is handled can be sent to:

privacy@aintaleem.com

Or via our contact page.