Privacy Policy

Last updated: 14 June 2026

Qalam (“we”, “us”, “our”) operates the Qalam platform — an Islamic tutoring marketplace connecting students with verified scholars. This policy explains what personal data we collect, why we collect it, and how we protect it.

1. Who We Are

Qalam is an online platform based in the United Kingdom. If you have any questions about this policy or how we handle your data, contact us at support@qalamtutor.com.

2. Information We Collect

Account information

When you register, we collect your name, email address, and password (stored securely via Supabase Auth). You may optionally add a profile photo and bio.

Scholar profile data

Scholars additionally provide: qualifications and credentials, institution, nationality, languages spoken, subjects taught, years of experience, hourly rate, timezone, and an optional introduction video. This information is displayed publicly on your scholar profile. Because qualifications and credentials can reveal religious education or affiliation, we treat this as special category data under UK GDPR and only process it with your explicit consent, given when you apply.

Booking and session data

We record details of sessions you book or teach: scheduled time, duration, subject, any notes you add, session status, and the video room link. Sessions are not recorded — video calls are live only.

Payment information

We collect transaction amounts, payment status, and Stripe payment identifiers. Full card details are handled exclusively by Stripe and never stored on our servers. Scholars who receive payouts provide banking and identity information directly to Stripe or Wise, depending on payout method, as part of their respective Know Your Customer (KYC) processes.

Messages and reviews

We store messages exchanged within the platform and any reviews or ratings you submit after a session.

Usage data

We collect standard server logs including IP address, browser type, pages visited, and timestamps. This helps us maintain platform security and improve performance.

3. How We Use Your Information

To create and manage your account
To facilitate bookings between students and scholars
To process payments and transfer scholar earnings via Stripe or Wise
To send transactional emails (booking confirmations, session reminders, payout notifications)
To display scholar profiles publicly so students can find tutors
To handle disputes, refund requests, and support enquiries
To detect fraud and keep the platform secure
To improve platform features and fix issues

We do not use your data for advertising, and we do not sell your personal information to any third party.

4. Legal Basis for Processing (UK GDPR)

We process your data under the following lawful bases:

Contract — processing necessary to provide the services you have signed up for (account management, bookings, payments)
Legitimate interests — platform security, fraud prevention, and improving our services
Legal obligation — retaining financial records as required by law
Consent — optional communications such as platform updates (you can withdraw consent at any time)
Explicit consent (special category data) — where your scholar application reveals information about your religious education or affiliation, we rely on your explicit consent, given during the application, rather than contract alone

5. Third-Party Services

We share data with the following trusted providers only to the extent necessary to operate the platform:

Supabase

Our database and authentication provider. All user data is stored in Supabase’s managed PostgreSQL infrastructure with row-level security enforced.

Stripe

Payment processing and scholar payouts via Stripe Connect. When you make or receive a payment, relevant transaction data is shared with Stripe. Stripe’s privacy policy applies to data they hold. Scholars must accept Stripe’s Terms of Service and provide KYC information directly to Stripe.

Wise

International scholar payouts. For scholars outside the UK, we share the transaction amount and the banking and identity details you provide directly to Wise in order to send your payout. Wise’s privacy policy applies to data they hold, and Wise conducts its own Know Your Customer (KYC) checks as part of this process.

Daily.co

Video conferencing for live sessions. Room links are generated per-session and expire after the session ends. Sessions are not recorded.

Resend

Transactional email delivery. We share your email address and relevant session details with Resend solely to deliver booking and notification emails.

Google

If you choose to sign in with Google, we receive your name and email address from Google OAuth. We do not receive access to your Google account beyond this.

International transfers

Stripe and Wise may process and store data outside the UK in order to run their own KYC and payout processes. Both rely on their own approved safeguards, including standard contractual clauses, for any transfer of personal data outside the UK. We don’t otherwise transfer your personal data internationally ourselves.

All providers are required to handle your data in accordance with applicable data protection law.

6. Cookies and Sessions

Qalam uses HTTP-only session cookies managed by Supabase Auth to keep you logged in. These cookies are strictly necessary for the platform to function and cannot be disabled while you are signed in. We do not use advertising cookies or third-party tracking cookies.

7. Data Retention

Account data — retained for as long as your account is active. You may request deletion at any time.
Payment records — retained for 7 years to meet UK financial and tax reporting obligations.
Session and booking records — retained for 3 years to support dispute resolution.
Server logs — retained for up to 90 days for security monitoring.

8. Your Rights

Under UK GDPR you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate data
Erasure — request deletion of your data (subject to legal retention obligations)
Restriction — ask us to limit how we use your data
Portability — receive your data in a structured, machine-readable format
Object — object to processing based on legitimate interests

To exercise any of these rights, email us at support@qalamtutor.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Data Security

We apply industry-standard protections including encrypted connections (HTTPS), database-level row security so users can only access their own data, and access controls limiting which staff can view personal information. No system is completely immune to risk. If you suspect unauthorised access to your account, contact us immediately.

10. Children

Qalam accounts are for adults — when you register, you confirm that you are 18 or over. We don’t knowingly collect personal data directly from children. If a session is for your child, you create and control the account, book on their behalf, and provide only the minimal information we need to identify that a session involves a child (their first name). If we become aware that a child has registered their own account, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes by email and update the “Last updated” date at the top of this page. Continued use of Qalam after a change takes effect constitutes acceptance of the revised policy.

12. Contact Us

Questions, requests, or complaints about your privacy should be sent to: support@qalamtutor.com