1.Who we are
Allah is One is a Quran-learning service. Learners book live one-to-one lessons with teachers, join webinars, read the Quran and follow their progress. It is run by Alzo Foundation, a not-for-profit company registered in India under Section 8 of the Companies Act, 2013 (CIN U85420DL2026NPL467225).
This policy covers the Allah is One app and allahisone.com. Alzo Foundation decides how and why your personal data is used, which makes us the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
2.What we collect
Your account
- Email address. You sign in with a six-digit code we email you. We store the code only in hashed form, and it expires after 10 minutes.
- Name, username and date of birth. Your date of birth is used to apply the age rules in section 6. It is not shown on your profile.
- School of thought. At sign-up we ask which tradition within Islam you follow. This is information about your religious beliefs. We use it to help you find teachers who share your tradition, and you can change it at any time. For teachers it appears on their public profile.
- Optional profile details: a profile photo, a cover photo and a bio.
- Google sign-in (website only). If you choose it, Google gives us your name, email address and profile picture.
Learning
- Lesson requests and lessons: the teacher, subject, times, connected minutes, the rate and what you were charged.
- Quran progress: pages and ayahs read or approved by your teacher, bookmarks, your reading position, completed readings (khatm) and streaks.
- Notes your teacher sends you during a lesson.
- Ratings and reviews. A review you write about a teacher is public and shows your first name only. A teacher’s rating of a student is never shown publicly.
- Teachers you save, and requests to be told when a teacher is free.
Live video
- One-to-one lessons stream your camera and microphone to your teacher in real time. We do not record one-to-one lessons.
- Webinars are broadcast and recorded. The recording includes the host, the speakers and anyone invited on stage, and is kept so signed-in users can watch the replay. If you only watch, your camera and microphone are not used. We store webinar chat messages, questions, poll votes, raised hands and the stickers people send.
- The app asks for camera and microphone access only for lessons and webinars, and for photo library or camera access only when you choose a picture or document to upload.
Community
- Posts (text, photos and videos), comments, likes and the people you follow. These, and your profile, are visible to other signed-in users, except people you have blocked or who have blocked you.
- The people you block. Only you can see your list; the people on it aren’t told.
Payments, wallet and donations
- Your wallet and coin balances, and a ledger of every top-up, lesson charge, coin purchase, donation, payout and refund.
- When you pay, you enter your card, UPI or bank details in Razorpay’s checkout. Those details go to Razorpay, not to us. We receive the order and payment references and whether the payment succeeded.
- Donations: the amount, and whether it went to a learner you named or to the queue of learners waiting for a sponsored lesson. A donor sees only a partly hidden name for the learner they choose.
If you teach
- Your application: bio, headline, website, specialisations, languages, years of experience, who you teach, country, city, time zone, gender (optional), your per-minute rate, and either your certificates or Ijazah or a written account of where you learned.
- A government photo ID. Every applicant provides one so we can confirm who they are. Application documents are stored privately and are seen only by our review team.
- Payout details (adults only): your full name, email, phone number, PAN, bank account number, IFSC and account holder name. We send your name, contact details and bank details to RazorpayX, which creates your payout account and checks the bank account with a small test deposit. We keep RazorpayX’s reference numbers, the result of that check and your PAN, for tax records. We do not keep your bank account number.
Support
- Tickets you open: the subject, your messages, any files you attach, and the lesson or teacher it concerns.
Device and technical data
- For each sign-in: the IP address, a description of your browser or device (the user agent) and when it was last used. We also count wrong password attempts so we can lock an account that is under attack.
- A log of security and money actions on your account, with the IP address each came from.
- Server logs of requests and errors, kept for 14 days.
- Your device’s language and region setting, which we use to pick your wallet currency.
- If you allow notifications, the app registers with Expo’s push service. We do not currently store the push token this produces or send push notifications. Notifications appear inside the app.
What we don’t collect
We don’t collect your precise location, your contacts or advertising identifiers. The app and the website contain no advertising, analytics or crash-reporting tools. We don’t sell personal data and don’t use it for advertising.
3.How we use it
- To run your account and the service: sign-in, lessons, webinars, progress, the community and support.
- To match learners with teachers, including by language, specialisation and school of thought.
- To take payments, hold and settle lesson charges, pay teachers, process payouts and route donations, and to keep the accounting records the law requires.
- To keep people safe: we verify teachers before they can teach, review reports, moderate webinar chat, enforce our Terms of Use, and prevent fraud and account takeover.
- To send you sign-in codes and account and security emails.
- To comply with the law and answer lawful requests from authorities.
We rely on the consent you give when you create your account. Where the DPDP Act allows processing without consent, we also process data to meet legal obligations, such as tax and accounting rules, and to protect someone’s safety in an emergency.
4.Who can see your information
- Anyone, without signing in, can see the public profile of an approved teacher on allahisone.com: name, photo, bio, headline, website, experience, specialisations, languages, country, city, time zone, gender if given, rate, ratings, online status and school of thought. Public reviews of teachers are shown there too.
- Other signed-in users can see your name, username, photo, bio, posts, comments, followers and the people you follow, and your chat and questions in webinars you join.
- Your teacher sees your name, username and photo and the details of the lessons you book with them, including which child a lesson is for.
- A parent sees what section 6 describes for their linked children.
- Our team. Authorised staff can see account, lesson, payment, support and teacher application data to run the service, review teachers and answer support requests. Their access depends on their role and is logged.
- Authorities, when the law requires it or when it is needed to protect someone from serious harm.
- If the service is transferred to another organisation, your data would move with it under the protections in this policy, and we would tell you first.
5.Service providers
These providers process data for us, only for the purpose listed.
- Microsoft Azure
- Hosts our servers, database and uploaded files, in Azure’s Central India region.
- Agora
- Carries the audio and video of one-to-one lessons.
- LiveKit
- Carries the audio and video of webinars and produces webinar recordings.
- Cloudflare
- Stores webinar recordings and delivers them through short-lived signed links.
- Razorpay
- Payment checkout, refunds, teacher payouts and bank account checks (RazorpayX). Razorpay handles your payment details under its own privacy policy and India’s payment regulations.
- Resend
- Sends sign-in codes and account emails.
- Zoho
- Hosts our contact@alzofoundation.com inbox, so it receives what you email us.
- Sign-in with Google on the website. The website also loads its icon font from Google Fonts, so your browser connects to Google’s servers.
- Expo
- Delivers app updates and registers the app for push notifications.
- Apple
- Distributes the iOS app. Apple’s own privacy policy covers what the App Store collects.
Some of these providers process data outside India. The DPDP Act allows this except to countries the Government of India restricts, and we will follow any such restriction.
6.Children and parent accounts
- You must be at least 13 to create your own account. A child under 13 can use Allah is One only through an account created by a parent or guardian, who must be 18 or over.
- To add a child, the parent gives us the child’s name, an email address for the child and a password, and may add the child’s date of birth. The child’s account is linked to the parent’s.
- A parent can see their child’s lessons, Quran progress and spending, set daily or weekly spending limits or pause spending, reset the child’s password, and unlink the child.
- A child under 13 must always have a linked parent. If the last parent unlinks, the child’s account is suspended: nothing is deleted, but the child can’t sign in until a parent is linked again.
- If you are 13 to 17, please use Allah is One with your parent’s or guardian’s knowledge and permission.
- Users under 18 can’t teach, receive payouts, cash out coins or add children.
- A child’s profile, posts and comments are visible to other signed-in users in the same way as anyone else’s. Parents should go through the community features with their child.
- A parent can ask us to see, correct or delete their child’s data by writing to contact@alzofoundation.com from the email address on the parent account.
7.How long we keep data
- Account and profile data: while your account is open, and for 30 days after you ask to delete it (section 8).
- Sign-in codes expire after 10 minutes. Sign-in sessions last up to 7 days and end when you sign out.
- Server logs: 14 days.
- Lesson, payment, payout and donation records are kept after your account is deleted, with your name and contact details removed. We need them for accounting and audits, and Indian law requires financial records to be kept; a company must keep its books of account for at least eight years.
- Webinar recordings are kept for replay while the webinar remains on the service. A host can ask us to remove a recording.
- Teacher application documents are kept as a record of whom we verified to teach. If you want them erased after your account is deleted, write to us.
8.Deleting your account
Delete your account in the app under Settings → Delete account, or on the website under Settings → Privacy & data. You can also email contact@alzofoundation.com.
Straight away
You are signed out on every device and your account is switched off. Your profile, posts and comments are no longer shown to other users.
The 30-day grace period
If you sign in again within 30 days, the deletion is cancelled and your account is restored.
After 30 days
- Your name, email address, username, profile and cover photos, bio, date of birth, last sign-in IP address and school of thought are erased or replaced with placeholders. For teachers, the bio, headline, website and city are erased and the profile is removed from search.
- Your payout details (including your PAN), saved payment methods, notifications, sign-in codes and sign-in sessions are deleted.
What we keep
- Records of lessons, charges, ratings, donations, wallet transactions, payouts and support tickets, and our security log (which records IP addresses), stay attached to an account that no longer carries your name or contact details. Other people’s records depend on them, such as a teacher’s earnings or a learner’s lesson history, and the law requires us to keep financial records.
- Posts, comments, webinar chat messages and teacher application documents are hidden from everyone but not automatically erased. To have posts and photos erased, delete them before you delete your account, or ask us and we will erase them.
- Razorpay keeps its own records of payments and payouts, as payment regulations require.
When deletion has to wait
You can’t delete your account while a lesson or payout is in progress, while you have teacher earnings you could withdraw, or while you have linked children. The app tells you what to finish first. If you have a wallet balance, read the Terms of Use before you delete.
9.Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we hold about you, what we do with it and whom we have shared it with. On the website, Settings → Privacy & data → Download My Data gives you a copy of your profile, lessons, transactions, ratings and notifications.
- Correct or update your data. You can edit most of it in your profile; for the rest, write to us.
- Erase your data, by deleting your account (section 8) or by asking us. We erase everything we are not required by law to keep.
- Withdraw consent at any time, by deleting your account or writing to us. This doesn’t affect what we did before, and without consent we can’t keep providing the service.
- Nominate someone to exercise these rights for you if you die or become unable to.
- Raise a grievance with our Grievance Officer (section 13). If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
To use any of these rights, email contact@alzofoundation.com from the address on your account. We may ask you to confirm it is you. There is no charge. If you live outside India, your local law may give you further rights, and we will honour them where they apply.
10.Security
- Every connection to the app and the website is encrypted (HTTPS).
- Sign-in codes and session tokens are stored only as hashes, so a copy of our database can’t be used to sign in. The app keeps your sign-in in your device’s secure storage.
- Sign-in is rate-limited. A sign-in code stops working after a few wrong guesses, and repeated wrong passwords lock the account for a while.
- Teacher application documents are stored privately and shown only to authorised reviewers. Webinar recordings are served only through short-lived signed links.
- Staff access to admin tools depends on their role and is logged.
No system is completely secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the DPDP Act requires.
12.Changes to this policy
If we change this policy, we will update the effective date at the top. For significant changes we will tell you in the app or by email before they apply.
13.Contact and grievances
- contact@alzofoundation.com
- Grievance Officer
- Grievance Officer, Alzo Foundation · contact@alzofoundation.com. We acknowledge a grievance within 24 hours and resolve it within 15 days.
- In the app
- Settings → Help & support opens a support ticket.
More ways to reach us are on the contact page.