Cookie Policy
Last updated: 17 October 2026
This Cookie Policy explains how Ibdaa Ltd ("we", "us", "our") uses cookies and similar technologies on the tawaasal.com website, the customer portal, and the Tawaasal web application at tawaasal.app (including each school's own subdomain). It supplements, and should be read together with, our Privacy Policy.
The Tawaasal application is free of advertising and tracking. The web application sets only strictly necessary cookies: the sign-in tokens that keep you logged in and a token that protects forms against cross-site request forgery. Both are marked HttpOnly and expire with your session. It sets no analytics or advertising cookies, and keeps a small number of preferences (for example, whether you dismissed an install prompt) in your browser's local storage. The mobile applications for iOS and Android do not use cookies; they use local device storage to remember your sign-in and preferences, as described in the Privacy Policy.
The tawaasal.com marketing website also uses analytics and advertising technologies, but only if you agree to them. This policy describes them in detail.
1. What is a cookie?
A cookie is a small text file that a website places on your browser or device when you visit it. We also use similar technologies — local storage, session storage, and pixel tags or scripts that send information from your browser to a service provider. For simplicity, this policy calls all of them "cookies".
2. The choice you make on the banner
When you first visit tawaasal.com, nothing from our analytics or advertising providers loads. The banner asks for your choice, and you can accept all, reject all, or choose:
- Analytics — lets us measure how the website is used.
- Marketing — lets us measure whether our advertising works.
Strictly necessary cookies always run, because the website cannot work without them. You can change your choice at any time through the Manage Cookies link in the website footer. If you withdraw a choice after the related technology has already started on the page, the page reloads so that it stops completely.
3. Cookies we use
Strictly necessary (always on)
| Cookie or storage | Set by | Purpose | Duration |
|---|---|---|---|
| Session and sign-in tokens, CSRF token | Tawaasal | Keep you signed in to the portal and protect forms | Session |
| tawaasal_cookie_consent (local storage) | Tawaasal | Remembers your banner choice | Until you change it, or until we update this policy and ask again |
| Language and theme preferences (local storage) | Tawaasal | Remember choices you make on the site | Until you clear them |
| Sign-up progress (local storage) | Tawaasal | Lets you return to an unfinished sign-up form | 7 days |
| Support assistant session (local storage) | Tawaasal | Keeps your conversation with our website assistant | Until you clear it |
| _GRECAPTCHA | Google (reCAPTCHA) | Protects our forms (sign-up, contact, assistant, data-rights requests) from spam and abuse. reCAPTCHA reads information about your browser and interaction with the form and sends it to Google. It loads only on pages with a protected form. | 6 months |
| Payment-page cookies | Stripe or PayPal | Fraud prevention and a secure checkout, on their payment pages | Set by the provider |
| — (no cookie) | Tawaasal error monitoring (hosted by us) | If the website hits an error, the error details, page address, browser and IP address are sent to our own error-monitoring service so we can fix it | Deleted automatically after a limited period |
We also count, without any cookie or other storage, how often a few things happen on the site each day (for example, how often the cookie banner is shown). These counts are anonymous daily totals and identify no one.
Analytics (only with your consent)
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_<id> | Google Analytics 4 | Measure visits, pages viewed and actions on the site, such as starting a sign-up or submitting an order (with the order reference and value). Google receives your browser and device details and your IP address, from which it derives an approximate location. | Up to 2 years |
| — (no cookie) | Cloudflare Web Analytics, where enabled | Measure page performance and visit counts | — |
Marketing (only with your consent)
| Cookie or storage | Set by | Purpose | Duration |
|---|---|---|---|
| _gcl_au, _gcl_aw | Google Ads | Link a visit to the Google ad you clicked and record actions on our site, such as launching the demo, contacting us or placing an order (with the order reference and value) | 90 days |
| _fbp, _fbc | Meta Pixel (Facebook and Instagram) | Link a visit to the Meta ad you clicked and record actions on our site, such as launching the demo, contacting us or placing an order (with the order reference and value) | 90 days |
| Ad-click reference (local storage) | Tawaasal | Keeps the ad click id and campaign tags from the link you followed, so that a later order can be connected to the ad | Used for 90 days; deleted when you withdraw marketing consent |
| Partner referral (local storage) | Tawaasal | If you followed a partner's link, keeps the partner's code (and a visit reference) so the partner can be credited for a later order. Until you choose on the banner, the code is held only in the open page's memory — nothing is stored or sent. With marketing consent, we store it and tell our server about the visit. | 90 days, unless the partner programme sets another period; deleted when you withdraw marketing consent |
Marketing consent also lets us tell Google and Meta, from our server, about the orders you place — whether or not you came from one of their ads. We send the order reference, its value and currency, the time, the ad click id if we have one, and your email address in hashed form, so each of them can check whether the order followed one of its ads. Meta also receives its browser identifier (_fbp), your browser's user agent, your IP address and the page the order was placed from. See section 11 of our Privacy Policy. We never use these technologies inside the Tawaasal applications, and never with school, student or guardian data.
4. Managing your choices
- Click Manage Cookies in the website footer to change or withdraw your consent at any time.
- Changing your choice on the banner stops new collection in your browser. To also stop reports about orders you have already placed, email privacy@tawaasal.com or use our data-rights page: we erase the ad-click references and hashed email kept with your orders and stop any report not yet sent.
- You can block or delete cookies in your browser — see the help pages for Chrome, Safari, Firefox, or Edge.
- Google and Meta offer their own controls: Google Ad Settings and Meta's Ad Preferences.
Rejecting analytics or marketing does not affect your ability to use the website or the Service. Blocking strictly necessary cookies may stop parts of the website from working.
5. Changes to this policy
We may update this Cookie Policy from time to time; the "Last updated" date shows the latest revision. If we add a new kind of analytics or advertising technology, we will update this policy and ask for your consent again before it is used.
6. Contact us
Questions about this Cookie Policy can be sent to privacy@tawaasal.com.
Ibdaa Ltd, 128 City Road, London, EC1V 2NX, United Kingdom — Company number 11658668.