Privacy Policy

Last updated: 17 October 2026

Ibdaa Ltd ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal data when you use the Tawaasal platform — including the tawaasal.com website, the customer portal, the Tawaasal web application at tawaasal.app, including each school's own subdomain, and the Tawaasal mobile applications for iOS and Android (together, "the Service").

1. Data Controller

The way personal data is controlled depends on which part of the Service you are using.

This Privacy Policy describes both sets of processing activities. Where we act as a processor on behalf of a school, you may also wish to consult that school's own privacy notice.

2. Data We Collect

Account Data (website and portal)

Billing Data (portal)

Mobile App Data

Usage Data

Website analytics and advertising data (tawaasal.com only, with your consent)

If you agree on the cookie banner, our marketing website collects: - With analytics consent: the pages you view and actions you take on the website (for example, starting a sign-up or submitting an order, with its reference and value), your browser and device details, and your IP address, from which Google derives an approximate location. - With marketing consent: the ad click identifier and campaign tags from the link that brought you to us (from Google or Meta ads), and the advertising cookies described in our Cookie Policy. When you place an order, we keep these with the order, together with a hashed form of your email address and, for Meta, its browser identifier, your browser's user agent, your IP address and the page the order was placed from, so that the order can be reported to Google and Meta. - Error reports: if the website hits an error, the error details, page address, browser and IP address go to our own error-monitoring service (hosted by us) so we can fix it.

None of this is collected inside the Tawaasal applications or from school tenant data.

Consent Records

Marketing Email Data (optional)

If you opt in to our product update or company news emails — via the website, at checkout, or in the customer portal — we collect your email address, preferred language, and per-topic subscription choices. Subscribing is always optional, is never pre-selected, and is separate from the transactional emails we send about your account and orders.

School Tenant Data (where Ibdaa acts as processor)

Within each school's Tawaasal environment, the school instructs us to process personal data including, depending on configuration: student records (names, dates of birth, contact details, enrolment information), guardian records, teacher and staff records, attendance and behaviour records, grades and assessment data, homework and submissions, calendar and timetable data, messages and announcements, photographs and files uploaded by users, and audit and access logs. Where a school enables AI connectors, this also includes records of which AI assistants its users have connected and what those assistants asked (as record identifiers and outcomes, never the text of a question).

The categories, retention, and sharing of school tenant data are defined by the Data Processing Agreement between Ibdaa Ltd and the school. The school is the controller for this data and is responsible for the lawful basis on which it is collected.

3. How We Use Your Data

We use data we control to:

We process school tenant data only on the documented instructions of the school, as set out in the Data Processing Agreement.

4. Legal Basis for Processing

We process personal data under UK GDPR on the following legal bases:

For school tenant data, the lawful basis is determined by the school as data controller. The school is responsible for obtaining any necessary consents — including parental consent for minors — before that data is provided to the Service.

5. Data Sharing and Third-Party Processors

We do not sell your personal data. We never share school tenant data — student, guardian, teacher or school records — for advertising, and there is no advertising in the Tawaasal applications. On our marketing website only, and only with your consent, we share limited data with the analytics and advertising providers listed below. We share data only with the following categories of recipients.

Within a school

Users within a school's Tawaasal environment will see data relevant to their role. School administrators have visibility across the school; teachers see data for the classes and students they are assigned to; guardians see data for their own children; students see their own data. Access is controlled by the school's configuration and by our role-based permission system.

Service providers (sub-processors)

We use the following sub-processors to deliver the Service:

| Provider | Purpose | Region | |---|---|---| | Stripe | Payment processing | United States, with UK and EU representatives | | Google LLC (Firebase Cloud Messaging) | Mobile push notifications | Global Google infrastructure | | Google LLC (Firebase Crashlytics) | Crash and diagnostic reporting for the mobile app | Global Google infrastructure | | Google LLC (Sign in with Google) | Optional social sign-in | Global Google infrastructure | | Apple Inc. (Apple Push Notification service, Sign in with Apple) | iOS push notifications and optional social sign-in | United States | | Cloud infrastructure providers | Hosting, storage, and content delivery | United Kingdom and European Economic Area | | Email and messaging providers | Transactional email and SMS | United Kingdom and European Economic Area | | Resend, Inc. | Marketing email delivery and subscription list management for opted-in recipients | United States |

All sub-processors are bound by data processing agreements and process personal data only on our documented instructions. An up-to-date list of sub-processors is available on request from privacy@tawaasal.com.

Website analytics and advertising (tawaasal.com only)

With your consent, the following providers receive data from our website. Google and Meta act as independent controllers for some of this data under their own terms; you can read how they use it at Google's privacy policy and Meta's privacy policy.

| Provider | What they receive | When | |---|---|---| | Google LLC (Google Analytics 4) | Pages viewed and website actions, browser and device details, IP address | Analytics consent | | Google LLC (Google Ads) | Ad click identifier and website actions; when an order is placed or paid, the order reference, value, currency, time and your hashed email address | Marketing consent | | Meta Platforms Ireland Ltd (Meta Pixel and Conversions API) | Website actions and ad click identifier; when an order is placed or paid, the order reference, value, currency, time, your hashed email address, Meta's browser identifier (_fbp), your browser's user agent, your IP address and the page the order was placed from | Marketing consent | | Cloudflare, Inc. (Web Analytics), where enabled | Page performance and visit counts, without cookies | Analytics consent |

If you tap the WhatsApp button on our website, WhatsApp opens and your conversation with us is handled by WhatsApp (Meta) under its own terms, as well as by us.

We also use Google reCAPTCHA on our website forms (sign-up, contact, the website assistant, and data-rights requests) to protect them from spam and abuse. reCAPTCHA sends Google information about your browser and how you interact with the form, including your IP address. This is necessary to keep the forms secure and runs without consent; it loads only on pages with a protected form.

AI assistants connected by a school (not sub-processors)

A school may choose to let some of its users connect an AI assistant to Tawaasal and ask it questions about the school's data in plain language: who was absent today, how a class did in its last assessment, what is on tomorrow's timetable. When a user does this, Tawaasal sends the assistant's provider the data that user is already allowed to see, and only in answer to that user's questions. The connector provides no operation that creates, changes or deletes data in Tawaasal.

The assistant's provider is chosen by the school and its user, not by us, and the connection is made through the user's own account with that provider. We have no contract with the provider covering this data, and we do not treat the provider as our sub-processor. The question you type, the data returned and the answer the assistant writes are all held by the provider under its own privacy policy and terms; we store neither the question nor the answer, and we cannot control how long the provider keeps them or how it uses them. The school must make sure its users connect only accounts whose terms do not allow the provider to use this data to train its models; personal consumer accounts on some of these services do not meet that requirement. Removing a connection stops further requests but does not delete what the provider already holds; the provider's own deletion controls are the way to do that.

| Provider | Assistant | Region | |---|---|---| | OpenAI, L.L.C. | ChatGPT | United States | | Anthropic, PBC | Claude | United States | | Google LLC | Gemini | United States and global Google infrastructure |

Nothing is connectable until a school administrator turns the feature on, accepts a plain-language notice, and chooses which roles may connect. Connections are switched off for pupil and guardian accounts by default; a school that switches them on is responsible for the safeguards the law requires. An assistant can be given attendance, grades, merit points, timetables and the reports the school has marked as reachable, and nothing else: safeguarding concerns, wellbeing records, private messages, leave requests, parents' evening notes, financial records, and uploaded files, images, audio and video are not available to an assistant on any plan or setting. Every user can see and remove their own connections from their profile; a school administrator can see and remove every connection in the school; and all connections expire after 90 days.

Law enforcement and legal compliance

We may disclose personal data where we are required to do so by law, court order, or other lawful request from a competent authority.

6. Data Retention

7. Your Rights

Under UK GDPR you have the right to:

To exercise these rights against data we control, visit our Data Rights page or email privacy@tawaasal.com.

For data held within a school's Tawaasal environment, please contact your school directly — the school is the controller and decides how to respond. We will support the school in fulfilling your request.

8. Children's Data

Tawaasal is used by schools and may be used by pupils under the age of 18, including in some cases pupils under the age of 13.

We process children's data only on the documented instructions of the school. The school is the data controller and is responsible for:

We do not knowingly collect personal data directly from children outside of the school environment. We do not use children's data for advertising, marketing, profiling, or any purpose other than providing the Service as instructed by the school. An AI assistant provider that a school has chosen to connect processes data under its own terms, not ours; see section 5.

We design the Service to be safe for children:

We design our practices to align with UK GDPR (age of consent: 13), the EU GDPR-K framework (with the relevant member-state age threshold, between 13 and 16), the US Children's Online Privacy Protection Act (COPPA) where applicable, the Saudi Personal Data Protection Law (PDPL), and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

If you believe we hold personal data about your child that we should not, please contact privacy@tawaasal.com and we will work with you and your school to investigate.

9. Mobile App Permissions

Our mobile applications may request the following device permissions. You can deny or revoke each one at any time from your device settings; if you do, some features may not work as expected.

We do not collect device location, contacts, calendar entries, or health data.

10. Demo Environment

We publish a demonstration of the Tawaasal school app so that anyone can try it before buying. It is a single shared environment, not a school's real system — every visitor signs in with the same published demo accounts. If you have come here looking for your own school's records, they are not here.

Because it is shared, anything you type into it can be seen by the next person who tries it. Everything in the demonstration is erased and rebuilt each night. Please do not enter real information about yourself, your child, or anyone else.

We keep a short record of each visit: when you signed in, the IP address you connected from and the country we work out from it, your browser, operating system and device type, which demo account was used, and how many records were created while you were there. We use it to keep the demonstration running, to protect it from abuse, and to understand how it is used. We keep that record for up to 365 days.

The demonstration is not covered by our Data Processing Agreement. That agreement is between a school and Ibdaa Solutions and applies to that school's own environment. A demo visitor is not a customer, so your use of the demonstration is covered by this Privacy Policy alone.

11. Tracking and Advertising

Inside the Tawaasal applications — the web application at tawaasal.app and the mobile applications, where school data lives — there is no advertising, no advertising cookies and no cross-app or cross-site tracking, and school, student, guardian and staff data is never used for advertising. On Apple devices, our app does not request the IDFA (Identifier for Advertisers) and does not present the App Tracking Transparency prompt.

On our marketing website (tawaasal.com) we advertise Tawaasal on Google and on Meta (Facebook and Instagram), and we measure the results. Nothing from our analytics or advertising providers loads until you choose on the cookie banner:

You can withdraw consent at any time through Manage Cookies in the website footer; this stops new collection in your browser. To also stop reports about orders you have already placed, email privacy@tawaasal.com or use our data-rights page: we erase the ad click references and hashed email kept with your orders and stop any report not yet sent. See our Cookie Policy for the full list of cookies.

12. Security

We implement industry-standard security measures, including:

No system is perfectly secure. If you become aware of a security issue, please report it to privacy@tawaasal.com.

13. International Transfers

Your personal data is primarily processed in the United Kingdom and the European Economic Area. Some of our sub-processors and providers — notably Stripe, Google and Meta — operate global infrastructure and may process data outside these regions, including in the United States. Where we transfer personal data outside the UK and EEA, we rely on appropriate safeguards — including the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses — supported by transfer risk assessments where required. For the website analytics and advertising data in section 11, Google LLC and Meta Platforms, Inc. are certified under the EU–US Data Privacy Framework and its UK Extension, and we rely on that certification, or on the Standard Contractual Clauses in their terms where it does not apply. You can ask for a copy of the safeguards we rely on at privacy@tawaasal.com. Where a school enables AI connectors, data sent to a connected assistant is transferred to that assistant's provider in the United States (and, for Google, its global infrastructure) on the school's instruction; the school, as controller, is responsible for the lawful basis of that transfer.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated by email and, where appropriate, by an in-app or in-portal notice.

15. Contact Us

| | | |---|---| | Data protection enquiries | privacy@tawaasal.com | | General enquiries | hello@tawaasal.com | | Registered office | Ibdaa Ltd, 128 City Road, London, EC1V 2NX, United Kingdom | | Company number | 11658668 |

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated. Customers in other jurisdictions may also contact their local supervisory authority.