Privacy
Data protection impact assessment
Version 1.2, last updated 1 November 2026
We have assessed the risks to people from The Maktab App, its free tools and this website. The remaining risk is medium, with one high risk: keeping records longer than needed, until automatic removal for older pupil records is built. It falls as the actions in this assessment are completed.
Who we are. Centorise Ltd, a company registered in England and Wales (number 17368406), trading as The Maktab App.
What this covers. The school platform used by maktabs and madrasahs. The free tools on this website: the travel cost calculator, Hifz Tracker, Hijri calendar, Qibla compass and Muraja'ah, including the optional Maktab account. And the booking and contact forms.
Our role. For school records we act for each school: the school is the controller and we are its processor. For our own accounts, security records, website, support and free tools, we are the controller.
What it is not. It does not replace a school's own assessment. Each school decides its own purposes and lawful basis, and should complete its own DPIA. This document is written to help with that. It is our own assessment, not legal advice, and not an approval by the Information Commissioner's Office (ICO).
This is a living document. We review it when our processing changes, and at least once a year.
Our role
We are the processor for school records and the controller for everything else. So this assessment has three parts.
Part
A. School platform
What it covers
Pupils, parents, staff, applicants, events, fees, registers, progress, messages, homework files, and support requests that contain school records
Our role
Processor
Who decides
The school
Part
B. Our own processing
What it covers
Platform accounts and sign-in security, billing schools, our support desk contacts, complaints, records of terms accepted
Our role
Controller
Who decides
Centorise Ltd
Part
C. Free tools and website
What it covers
The five free tools, their optional Google Drive and Maktab account, optional support payments, and the booking and contact forms
Our role
Controller
Who decides
Centorise Ltd
| Part | What it covers | Our role | Who decides |
|---|---|---|---|
| A. School platform | Pupils, parents, staff, applicants, events, fees, registers, progress, messages, homework files, and support requests that contain school records | Processor | The school |
| B. Our own processing | Platform accounts and sign-in security, billing schools, our support desk contacts, complaints, records of terms accepted | Controller | Centorise Ltd |
| C. Free tools and website | The five free tools, their optional Google Drive and Maktab account, optional support payments, and the booking and contact forms | Controller | Centorise Ltd |
For Part A we describe the processing and the protections we provide, so a school can use them in its own assessment (UK GDPR Article 28(3)(f)). We do not judge whether a school's purposes are necessary. That is for the school.
When a support request contains school records, we handle those records as the school's processor, under our data processing terms. School owners and administrators appear in Parts A and B. Their details are school records. Their sign-in and account records are ours.
Why we carried out a DPIA
A DPIA is needed because the platform holds children's health information and records that can reveal religious belief (UK GDPR Article 35).
Screening point
Special category data
Applies?
Yes
Why
Pupils' medical conditions, allergies, medication and special educational needs. Records of attending a maktab, and Qur'an progress, can reveal religious belief.
Screening point
Vulnerable people
Applies?
Yes
Why
Most records are about children.
Screening point
Systematic monitoring
Applies?
Partly
Why
Attendance registers and progress records are kept over time by the school.
Screening point
Combining data
Applies?
Partly
Why
A school's own records are linked: pupil, family, fees, register. Nothing is combined across schools.
Screening point
New technology
Applies?
Partly
Why
A cloud platform replacing paper and spreadsheets. Free tools that use device location and sensors, on the device.
Screening point
Large scale
Applies?
Not yet
Why
Around a dozen schools in October 2026. We will assess again as this grows.
| Screening point | Applies? | Why |
|---|---|---|
| Special category data | Yes | Pupils' medical conditions, allergies, medication and special educational needs. Records of attending a maktab, and Qur'an progress, can reveal religious belief. |
| Vulnerable people | Yes | Most records are about children. |
| Systematic monitoring | Partly | Attendance registers and progress records are kept over time by the school. |
| Combining data | Partly | A school's own records are linked: pupil, family, fees, register. Nothing is combined across schools. |
| New technology | Partly | A cloud platform replacing paper and spreadsheets. Free tools that use device location and sensors, on the device. |
| Large scale | Not yet | Around a dozen schools in October 2026. We will assess again as this grows. |
UK GDPR allows one assessment to cover similar processing with similar risks (Article 35(1)). We assess the free tools together as a set only where they hold no personal data on our systems. The Maktab account is assessed separately in this document.
The processing
School records live in one database in London, walled off school by school. The free tools keep data on the person's device unless they choose Google Drive or a Maktab account.
The Maktab account for the free tools is kept in its own walled-off part of the database, separate from school records. The tool code cannot read school records.
Google (sign-in), postcodes.io and phone notification services also receive limited data. The full list is on the sub-processors page.
People whose data is processed:
- Pupils, mostly children (Part A).
- Parents and guardians, emergency contacts, and people allowed to collect a child (Part A).
- School staff, volunteers and people applying to work at a school (Part A).
- People booking a place on school events, and applicants for a place (Part A).
- School owners and administrators, as account holders (Parts A and B).
- Our own staff and contractors (Part B).
- People using the free tools (Part C).
- Website visitors who book a demo or contact us (Part C).
Category
Identity
What
Name, date of birth, gender, address, day school
Why
Identify the pupil and keep records
Sensitive?
No
Category
Health
What
Medical conditions, allergies, medication, emergency treatment consent
Why
Keep the child safe
Sensitive?
Yes: health
Category
Needs
What
Special educational needs and plans
Why
Support the child
Sensitive?
Yes: health
Category
Attendance
What
Attendance, absence notices, lateness
Why
Registers and safeguarding
Sensitive?
No
Category
Learning
What
Qur'an, Hifdh and level progress, reports, merits, notes
Why
Teaching and pastoral care
Sensitive?
Can reveal religious belief
Category
Files
What
Homework photos, voice notes and files
Why
Teaching
Sensitive?
Images of children, kept in the school's own cloud storage
Category
Fees
What
Fees, payment plans, Direct Debit references
Why
Collecting fees for the school
Sensitive?
Financial. Card and bank details are held by Stripe.
Category
Messages
What
Messages between parents, teachers and the office
Why
Communication
Sensitive?
No, but may contain anything
Category
Staff
What
Staff details, hours, checks, applications and CVs
Why
Running the school
Sensitive?
Some may be sensitive
Category
Postcode
What
Converted to an approximate location
Why
Show the school where pupils travel from
Sensitive?
No
Category
Security
What
Sign-in records, IP addresses, device notification tokens
Why
Security and notifications
Sensitive?
No
Category
Audit trail
What
A record of changes
Why
Accountability and finding mistakes
Sensitive?
Can contain any of the above
Category
Free tools
What
Qur'an logs and settings. For the Qibla compass, a location rounded to about 100 metres, saved on the device.
Why
The tool's purpose
Sensitive?
Qur'an logs can reveal religious belief
Category
Maktab account
What
Email, Google account id if used, plan type, consent records, one saved document per tool (up to 512 KB)
Why
Run the optional account and keep the saved copy
Sensitive?
Saved revision data may reveal religious belief
| Category | What | Why | Sensitive? |
|---|---|---|---|
| Identity | Name, date of birth, gender, address, day school | Identify the pupil and keep records | No |
| Health | Medical conditions, allergies, medication, emergency treatment consent | Keep the child safe | Yes: health |
| Needs | Special educational needs and plans | Support the child | Yes: health |
| Attendance | Attendance, absence notices, lateness | Registers and safeguarding | No |
| Learning | Qur'an, Hifdh and level progress, reports, merits, notes | Teaching and pastoral care | Can reveal religious belief |
| Files | Homework photos, voice notes and files | Teaching | Images of children, kept in the school's own cloud storage |
| Fees | Fees, payment plans, Direct Debit references | Collecting fees for the school | Financial. Card and bank details are held by Stripe. |
| Messages | Messages between parents, teachers and the office | Communication | No, but may contain anything |
| Staff | Staff details, hours, checks, applications and CVs | Running the school | Some may be sensitive |
| Postcode | Converted to an approximate location | Show the school where pupils travel from | No |
| Security | Sign-in records, IP addresses, device notification tokens | Security and notifications | No |
| Audit trail | A record of changes | Accountability and finding mistakes | Can contain any of the above |
| Free tools | Qur'an logs and settings. For the Qibla compass, a location rounded to about 100 metres, saved on the device. | The tool's purpose | Qur'an logs can reveal religious belief |
| Maktab account | Email, Google account id if used, plan type, consent records, one saved document per tool (up to 512 KB) | Run the optional account and keep the saved copy | Saved revision data may reveal religious belief |
Children do not have their own logins. Parents, staff and school administrators sign in.
Lawful basis
We rely on contract and legitimate interests for our own processing. We rely on explicit consent for the saved revision data in a Maktab account. Schools choose their own basis for school records.
Purpose
Accounts and billing
Lawful basis
Contract, Article 6(1)(b). Legal obligation for tax records, 6(1)(c).
Purpose
Sign-in security
Lawful basis
Legitimate interests, 6(1)(f), recorded in our legitimate interests assessment: sign-in security, rate limits, preventing misuse.
Purpose
Records of terms
Lawful basis
Legitimate interests, 6(1)(f). Legal obligation, 6(1)(c), for complaints and breach duties.
Purpose
Demo and contact forms
Lawful basis
Steps before a contract, 6(1)(b).
Purpose
Google Drive
Lawful basis
We do not process the data kept in the person's own Drive. To connect Drive we briefly handle the connection only: legitimate interests, 6(1)(f).
Purpose
Maktab account
Lawful basis
Contract, 6(1)(b). For saved data that may reveal religious belief, explicit consent, Article 9(2)(a), given by a separate tick box. People withdraw it by deleting the account, which deletes the data.
Purpose
Support payments
Lawful basis
Contract, 6(1)(b). Legal obligation for accounting records, 6(1)(c).
| Purpose | Lawful basis |
|---|---|
| Accounts and billing | Contract, Article 6(1)(b). Legal obligation for tax records, 6(1)(c). |
| Sign-in security | Legitimate interests, 6(1)(f), recorded in our legitimate interests assessment: sign-in security, rate limits, preventing misuse. |
| Records of terms | Legitimate interests, 6(1)(f). Legal obligation, 6(1)(c), for complaints and breach duties. |
| Demo and contact forms | Steps before a contract, 6(1)(b). |
| Google Drive | We do not process the data kept in the person's own Drive. To connect Drive we briefly handle the connection only: legitimate interests, 6(1)(f). |
| Maktab account | Contract, 6(1)(b). For saved data that may reveal religious belief, explicit consent, Article 9(2)(a), given by a separate tick box. People withdraw it by deleting the account, which deletes the data. |
| Support payments | Contract, 6(1)(b). Legal obligation for accounting records, 6(1)(c). |
School records (Part A): guidance for schools. The school decides its basis and should take its own advice. Most will use contract (fees, enrolment), legitimate interests (registers, progress), legal obligation (some safeguarding and staff duties) and vital interests (a medical emergency).
For health information a school needs an Article 9 condition, such as explicit consent, or safeguarding of children under the Data Protection Act 2018, Schedule 1, paragraph 18, which needs an appropriate policy document. A religious not-for-profit body may also be able to rely on Article 9(2)(d) for its members and regular contacts. We plan to offer schools a template policy document.
Religious belief. We treat records of attending a maktab, and Qur'an progress, as able to reveal religious belief. We protect all of them with the care special category data needs. We do not state a legal conclusion on this point. Schools should take their own advice.
Children
We have considered the ICO's Age Appropriate Design Code (the Children's Code) and applied it where it is relevant. It applies mainly to the free tools. The school platform is designed so that children cannot sign in.
- School platform. Children have no accounts. The parent portal is designed so that parents see only their own family. Staff see records through roles the school controls, and health information sits behind its own permission.
- Free tools. Children may use them. Data stays on the device by default. The Qibla compass uses the device location only after the browser asks. It saves a location rounded to about 100 metres on the device and does not send it to us. No advertising, tracking, profiling or nudging.
- Maktab account. Only for people aged 13 or over, the UK age of digital consent for online services offered directly to children (Data Protection Act 2018, section 9). Sign-up asks the person to tick that they are 13 or over. People under 13 must not create one, and can keep using the device and Hifz Tracker Google Drive options. If we learn an account belongs to someone under 13, we delete it.
- Optional support payments. For adults, or children with a parent's permission. Paying unlocks nothing.
Sub-processors and where data goes
Our database is in London. The services that run the app and send emails operate in the United States or worldwide, so some data leaves the UK under the safeguards UK law requires.
Service
Neon
What it does
The database for school records, and for the free tools' Maktab account
Where
Amazon Web Services, London
Service
Cloudflare
What it does
Runs the application and website, filters attacks. Counts visits to the public website anonymously.
Where
Worldwide network. Requests are handled near the person.
Service
Stripe
What it does
Card and Direct Debit payments to schools. Optional support payments for the free tools.
Where
United States and elsewhere
Service
Resend
What it does
Sends sign-in codes and notification emails
Where
United States
Service
What it does
Sign in with Google. Google Drive for the Hifz Tracker (and for anyone already connected in Muraja'ah).
Where
United States and worldwide
Service
Google Fonts
What it does
Fonts on the website and tools
Where
United States and worldwide
Service
postcodes.io
What it does
Converts a postcode to an approximate location
Where
United Kingdom
Service
Apple, Google and Mozilla push services
What it does
Deliver phone notifications
Where
United States and worldwide
Service
Chosen by a school
What it does
The school's own email provider (Google or Microsoft) and its own file storage (Google Drive, Microsoft Azure or Amazon S3)
Where
Wherever the school's provider operates
Service
WhatsApp (Meta)
What it does
Opens a WhatsApp chat with the school if a person chooses. We send no data.
Where
Meta's own terms
| Service | What it does | Where |
|---|---|---|
| Neon | The database for school records, and for the free tools' Maktab account | Amazon Web Services, London |
| Cloudflare | Runs the application and website, filters attacks. Counts visits to the public website anonymously. | Worldwide network. Requests are handled near the person. |
| Stripe | Card and Direct Debit payments to schools. Optional support payments for the free tools. | United States and elsewhere |
| Resend | Sends sign-in codes and notification emails | United States |
| Sign in with Google. Google Drive for the Hifz Tracker (and for anyone already connected in Muraja'ah). | United States and worldwide | |
| Google Fonts | Fonts on the website and tools | United States and worldwide |
| postcodes.io | Converts a postcode to an approximate location | United Kingdom |
| Apple, Google and Mozilla push services | Deliver phone notifications | United States and worldwide |
| Chosen by a school | The school's own email provider (Google or Microsoft) and its own file storage (Google Drive, Microsoft Azure or Amazon S3) | Wherever the school's provider operates |
| WhatsApp (Meta) | Opens a WhatsApp chat with the school if a person chooses. We send no data. | Meta's own terms |
Where data goes outside the UK, we rely on a safeguard UK law recognises for each provider: the UK to US data bridge where the provider is certified, or the UK Addendum to the EU standard contractual clauses in its data processing terms.
Our sub-processors page is the current list. We give schools at least 30 days' notice of a new sub-processor, with the right to object and to end the agreement, as our data processing terms set out.
Some providers may access data from other countries for support. A school outside the UK, for example in Australia, is the controller under its own country's law.
Visit counting on the public website
Since 31 October 2026 we count visits to our public website with Cloudflare Web Analytics, so we can see which pages and free tools are useful.
Where it runs. On the public pages and the free tools only, and only for visitors in the United Kingdom. Never inside the app: app addresses can contain a pupil's code or name, so a page that leads into the app is loaded fresh, without the counter.
What it records. The page address, the site the visitor came from, their country, their type of device and browser, and how quickly the page loaded. No cookies, nothing stored on the device, no profile and no advertising. We see totals only.
Lawful basis. Legitimate interests: improving the website and tools. The Data (Use and Access) Act 2025 allows simple statistics like this without asking first, provided people are told and can object easily.
Saying no. A switch on the cookies page turns it off for that device. It is also off when the browser sends a Do Not Track or Global Privacy Control signal.
Children. Families use the free tools. Counting is anonymous and there is no profiling, so it does not change the risk to children.
Visitors outside the UK are not counted while we take advice on the law in the EU.
Retention and deletion
Security and short-lived records are deleted automatically. Most school records are kept until the school deletes them or leaves.
Record
Sign-in links
How long
30 days after used or expired
How
Deleted automatically each night
Record
Sign-in attempts
How long
90 days, including IP address
How
Deleted automatically
Record
Rate-limit counters
How long
2 days
How
Deleted automatically
Record
Demo bookings
How long
180 days
How
Personal details removed automatically
Record
Job applications
How long
6 months after the decision (12 months for a talent pool)
How
Deleted automatically
Record
Parent emails
How long
90 days after sending, for recipient records
How
Deleted automatically
Record
Audit trail
How long
6 years, then personal details inside it are blanked
How
Automatic
Record
Parent accounts
How long
Switched off after 365 days with no enrolled child by default. Each school can set 90 days to 10 years.
How
Automatic
Record
School records
How long
Until the school deletes them, or its contract ends
How
School action, or our end-of-contract deletion
Record
Tool data on a device or Drive
How long
Until the person clears it
How
Under the person's control
Record
Maktab account
How long
Until the person deletes it. Accounts not used for 12 months are deleted automatically.
How
Delete button in the account sheet, or automatic clean-up
Record
Restore history
How long
Up to 7 days
How
Deleted data can stay in the database provider's restore history for up to 7 days
| Record | How long | How |
|---|---|---|
| Sign-in links | 30 days after used or expired | Deleted automatically each night |
| Sign-in attempts | 90 days, including IP address | Deleted automatically |
| Rate-limit counters | 2 days | Deleted automatically |
| Demo bookings | 180 days | Personal details removed automatically |
| Job applications | 6 months after the decision (12 months for a talent pool) | Deleted automatically |
| Parent emails | 90 days after sending, for recipient records | Deleted automatically |
| Audit trail | 6 years, then personal details inside it are blanked | Automatic |
| Parent accounts | Switched off after 365 days with no enrolled child by default. Each school can set 90 days to 10 years. | Automatic |
| School records | Until the school deletes them, or its contract ends | School action, or our end-of-contract deletion |
| Tool data on a device or Drive | Until the person clears it | Under the person's control |
| Maktab account | Until the person deletes it. Accounts not used for 12 months are deleted automatically. | Delete button in the account sheet, or automatic clean-up |
| Restore history | Up to 7 days | Deleted data can stay in the database provider's restore history for up to 7 days |
We have not yet built automatic removal of former pupils' details, or a retention period for event bookings. Until we do, those records are kept until the school deletes them.
People's rights
For school records, people ask their school and we help the school answer. For our own processing and the free tools, people ask us directly.
Right
Be informed
School records (Part A)
The school's privacy notice. Our privacy notice explains our part.
Our processing and the free tools (Parts B and C)
Our privacy notice, and the free tools privacy and terms page.
Right
Access
School records (Part A)
The school answers. We help, and a school owner can export the school's data.
Our processing and the free tools (Parts B and C)
Ask us. Tool data on a device or in Google Drive is already in the person's hands. The tools offer a backup download.
Right
Correct
School records (Part A)
Parents can ask the office to change contact details in the app. The school corrects other records.
Our processing and the free tools (Parts B and C)
Ask us, or edit in the tool.
Right
Erase
School records (Part A)
The school deletes records. We delete everything at the end of the contract.
Our processing and the free tools (Parts B and C)
Clear the tool, or press the delete account button, which removes everything.
Right
Restrict or object
School records (Part A)
Through the school
Our processing and the free tools (Parts B and C)
Ask us
Right
Data portability
School records (Part A)
School export
Our processing and the free tools (Parts B and C)
Backup download. Muraja'ah also downloads a spreadsheet.
Right
Complain
School records (Part A)
To the school, then the ICO
Our processing and the free tools (Parts B and C)
To us, then the ICO. We acknowledge within 30 days. People can also complain to the ICO at any time.
| Right | School records (Part A) | Our processing and the free tools (Parts B and C) |
|---|---|---|
| Be informed | The school's privacy notice. Our privacy notice explains our part. | Our privacy notice, and the free tools privacy and terms page. |
| Access | The school answers. We help, and a school owner can export the school's data. | Ask us. Tool data on a device or in Google Drive is already in the person's hands. The tools offer a backup download. |
| Correct | Parents can ask the office to change contact details in the app. The school corrects other records. | Ask us, or edit in the tool. |
| Erase | The school deletes records. We delete everything at the end of the contract. | Clear the tool, or press the delete account button, which removes everything. |
| Restrict or object | Through the school | Ask us |
| Data portability | School export | Backup download. Muraja'ah also downloads a spreadsheet. |
| Complain | To the school, then the ICO | To us, then the ICO. We acknowledge within 30 days. People can also complain to the ICO at any time. |
Our complaints page explains how to raise a concern with us. You can also write to contact@themaktabapp.com.
Security measures
The main protections are separation between schools in the database, role-based access with health information behind its own permission, and encrypted connections throughout. We describe our measures at this level on purpose, and keep detailed technical records internally.
Area
Between schools
What is in place
School records are separated by row-level security in the database on the tables that hold school data, together with checks in the application. We are extending database-level separation to the few remaining tables.
Area
Who sees what
What is in place
Each school sets roles and permissions. Health and special needs information has its own permission. The parent portal is designed so that parents see only their own family.
Area
Signing in
What is in place
Sign in with Google or a one-time email code. No sign-in passwords are stored. Codes expire quickly and attempts are limited. Sessions are held in secure cookies. A school's own mail server password, if entered, is stored encrypted.
Area
Encryption
What is in place
Encrypted connections (HTTPS) everywhere. Our database provider encrypts stored data. Connection details for a school's own storage and mailbox are encrypted by us before they are stored.
Area
Web protections
What is in place
Standard browser security protections, and checks that changes come from our own pages.
Area
Accountability
What is in place
An audit trail of changes. Everyday use of the platform can add to it but cannot change or delete it. Only a scheduled maintenance job and our own administrators can alter it, and the job only blanks personal details after 6 years or after an erasure. Support access to a school's account is recorded.
Area
Our own access
What is in place
Administration areas have extra access controls. Changes to live data need deliberate, separate steps.
Area
Releases
What is in place
Automated checks, including privacy and separation checks, run as part of our release process.
Area
Backups
What is in place
Our database provider keeps up to 7 days of restore history.
Area
Free tools
What is in place
Data stays on the device by default. The Google Drive option uses Google's narrowest access (only files the tool creates). The Maktab account is kept apart from school records. Its database login can reach only its own area. Sign-in codes are scrambled before they are stored.
| Area | What is in place |
|---|---|
| Between schools | School records are separated by row-level security in the database on the tables that hold school data, together with checks in the application. We are extending database-level separation to the few remaining tables. |
| Who sees what | Each school sets roles and permissions. Health and special needs information has its own permission. The parent portal is designed so that parents see only their own family. |
| Signing in | Sign in with Google or a one-time email code. No sign-in passwords are stored. Codes expire quickly and attempts are limited. Sessions are held in secure cookies. A school's own mail server password, if entered, is stored encrypted. |
| Encryption | Encrypted connections (HTTPS) everywhere. Our database provider encrypts stored data. Connection details for a school's own storage and mailbox are encrypted by us before they are stored. |
| Web protections | Standard browser security protections, and checks that changes come from our own pages. |
| Accountability | An audit trail of changes. Everyday use of the platform can add to it but cannot change or delete it. Only a scheduled maintenance job and our own administrators can alter it, and the job only blanks personal details after 6 years or after an erasure. Support access to a school's account is recorded. |
| Our own access | Administration areas have extra access controls. Changes to live data need deliberate, separate steps. |
| Releases | Automated checks, including privacy and separation checks, run as part of our release process. |
| Backups | Our database provider keeps up to 7 days of restore history. |
| Free tools | Data stays on the device by default. The Google Drive option uses Google's narrowest access (only files the tool creates). The Maktab account is kept apart from school records. Its database login can reach only its own area. Sign-in codes are scrambled before they are stored. |
We do not yet offer two-step sign-in inside the app. Staff can protect their Google account with Google's own two-step verification.
Risks to people
We found 14 risks. The most serious are someone seeing a child's health information who should not, and records that reveal religious belief being exposed.
Likelihood is remote, possible or probable. Severity is minimal, significant or severe. The overall score is low, medium or high, using the ICO method.
Ref
R1
Risk
Someone sees a child's health or special needs information without a need (a stolen login, or roles set too widely)
Part
A
Likelihood
Possible
Severity
Severe
Overall
High
Ref
R2
Risk
One school's records are seen by another school
Part
A
Likelihood
Remote
Severity
Severe
Overall
Medium
Ref
R3
Risk
A breach exposes records that reveal people's religion
Part
A, C
Likelihood
Remote
Severity
Severe
Overall
Medium
Ref
R4
Risk
Records are kept longer than needed
Part
A
Likelihood
Probable
Severity
Significant
Overall
High
Ref
R5
Risk
A school has no clear lawful basis or privacy notice for what it records
Part
A
Likelihood
Probable
Severity
Significant
Overall
High
Ref
R6
Risk
Data is sent abroad without the right safeguards
Part
A, B, C
Likelihood
Possible
Severity
Significant
Overall
Medium
Ref
R7
Risk
Photos and voice notes of children are shared or kept beyond need
Part
A
Likelihood
Possible
Severity
Severe
Overall
High
Ref
R8
Risk
Payment mistakes, or misuse of payment details
Part
A
Likelihood
Remote
Severity
Significant
Overall
Low
Ref
R9
Risk
Staff or applicant details are exposed
Part
A
Likelihood
Possible
Severity
Significant
Overall
Medium
Ref
R10
Risk
A message reaches the wrong person
Part
A
Likelihood
Possible
Severity
Significant
Overall
Medium
Ref
R11
Risk
A free tool sends location or other data off the device
Part
C
Likelihood
Remote
Severity
Significant
Overall
Low
Ref
R12
Risk
A Google Drive connection or a Maktab account is misused
Part
C
Likelihood
Remote
Severity
Significant
Overall
Low
Ref
R13
Risk
Children use the free tools without age-appropriate protection, or sign up to an account without consent
Part
C
Likelihood
Possible
Severity
Significant
Overall
Medium
Ref
R14
Risk
A breach or a change of provider is not handled or passed on in time
Part
A, B, C
Likelihood
Possible
Severity
Severe
Overall
High
| Ref | Risk | Part | Likelihood | Severity | Overall |
|---|---|---|---|---|---|
| R1 | Someone sees a child's health or special needs information without a need (a stolen login, or roles set too widely) | A | Possible | Severe | High |
| R2 | One school's records are seen by another school | A | Remote | Severe | Medium |
| R3 | A breach exposes records that reveal people's religion | A, C | Remote | Severe | Medium |
| R4 | Records are kept longer than needed | A | Probable | Significant | High |
| R5 | A school has no clear lawful basis or privacy notice for what it records | A | Probable | Significant | High |
| R6 | Data is sent abroad without the right safeguards | A, B, C | Possible | Significant | Medium |
| R7 | Photos and voice notes of children are shared or kept beyond need | A | Possible | Severe | High |
| R8 | Payment mistakes, or misuse of payment details | A | Remote | Significant | Low |
| R9 | Staff or applicant details are exposed | A | Possible | Significant | Medium |
| R10 | A message reaches the wrong person | A | Possible | Significant | Medium |
| R11 | A free tool sends location or other data off the device | C | Remote | Significant | Low |
| R12 | A Google Drive connection or a Maktab account is misused | C | Remote | Significant | Low |
| R13 | Children use the free tools without age-appropriate protection, or sign up to an account without consent | C | Possible | Significant | Medium |
| R14 | A breach or a change of provider is not handled or passed on in time | A, B, C | Possible | Severe | High |
Measures to reduce the risks
Every risk has measures in place. The planned measures reduce the remaining risk further. We update this table as each one is completed.
Risk
R1 Health information
In place
Separate health permission. Secure sign-in with short-lived codes. Audit trail.
Planned
Narrower default access to health information, so schools grant it only to those who need it. Two-step sign-in for staff.
Remaining risk today
Medium
Risk
R2 Between schools
In place
Database-level separation on school data tables. Checks in the release process.
Planned
Extend database-level separation to the remaining tables.
Remaining risk today
Low
Risk
R3 Religion revealed
In place
All records protected with special category care. Encryption. Separation.
Planned
A written incident procedure (see R14).
Remaining risk today
Medium
Risk
R4 Kept too long
In place
Automatic deletion for security, booking, applicant, email and audit records. Dormant parent accounts switched off.
Planned
Automatic removal of former pupils' details. A retention period for event bookings.
Remaining risk today
High until built
Risk
R5 School's lawful basis
In place
Our privacy notice and data processing terms. This assessment.
Planned
A template privacy notice and policy document for schools.
Remaining risk today
Medium
Risk
R6 Data abroad
In place
Database in London. Provider data processing terms.
Planned
Record the transfer safeguard for each provider. Choose UK or EU regions where offered.
Remaining risk today
Medium
Risk
R7 Photos and voice notes
In place
Stored in the school's own storage, not ours. Access by role.
Planned
Guidance for schools on consent and keeping files.
Remaining risk today
Medium
Risk
R8 Payments
In place
Card and bank details held by Stripe, not us. Money goes straight to the school.
Planned
None needed.
Remaining risk today
Low
Risk
R9 Staff details
In place
Role-based access. Automatic deletion of unsuccessful applications.
Planned
None beyond R1.
Remaining risk today
Medium
Risk
R10 Wrong recipient
In place
Messages tied to family and class records.
Planned
A clearer display of who a message goes to.
Remaining risk today
Medium
Risk
R11 Tool data leaves device
In place
Tools work on the device. Location stays on the device.
Planned
A network test recorded in each tool's screening record.
Remaining risk today
Low
Risk
R12 Drive or account misuse
In place
Narrowest Google Drive access. Secure cookies. The account is kept apart from school records. Explicit consent at sign-up. The 13 or over check. Accounts unused for 12 months are deleted automatically. Code emails and attempts are limited and the number of accounts is capped.
Planned
Limits reviewed when the account opened to everyone (1 Nov 2026): at most 2,000 accounts, 512 KB a document, 30 saves a minute. Review again as use grows.
Remaining risk today
Low
Risk
R13 Children and tools
In place
Nothing is collected by default. No adverts or tracking. The 13 or over tick and separate explicit consent for the Maktab account.
Planned
None needed.
Remaining risk today
Low
Risk
R14 Breach handling
In place
Breach duties in our data processing terms. Complaints process.
Planned
A written incident procedure: telling a school without undue delay about a breach of its records, and deciding within the ICO's 72-hour window for our own.
Remaining risk today
Medium
| Risk | In place | Planned | Remaining risk today |
|---|---|---|---|
| R1 Health information | Separate health permission. Secure sign-in with short-lived codes. Audit trail. | Narrower default access to health information, so schools grant it only to those who need it. Two-step sign-in for staff. | Medium |
| R2 Between schools | Database-level separation on school data tables. Checks in the release process. | Extend database-level separation to the remaining tables. | Low |
| R3 Religion revealed | All records protected with special category care. Encryption. Separation. | A written incident procedure (see R14). | Medium |
| R4 Kept too long | Automatic deletion for security, booking, applicant, email and audit records. Dormant parent accounts switched off. | Automatic removal of former pupils' details. A retention period for event bookings. | High until built |
| R5 School's lawful basis | Our privacy notice and data processing terms. This assessment. | A template privacy notice and policy document for schools. | Medium |
| R6 Data abroad | Database in London. Provider data processing terms. | Record the transfer safeguard for each provider. Choose UK or EU regions where offered. | Medium |
| R7 Photos and voice notes | Stored in the school's own storage, not ours. Access by role. | Guidance for schools on consent and keeping files. | Medium |
| R8 Payments | Card and bank details held by Stripe, not us. Money goes straight to the school. | None needed. | Low |
| R9 Staff details | Role-based access. Automatic deletion of unsuccessful applications. | None beyond R1. | Medium |
| R10 Wrong recipient | Messages tied to family and class records. | A clearer display of who a message goes to. | Medium |
| R11 Tool data leaves device | Tools work on the device. Location stays on the device. | A network test recorded in each tool's screening record. | Low |
| R12 Drive or account misuse | Narrowest Google Drive access. Secure cookies. The account is kept apart from school records. Explicit consent at sign-up. The 13 or over check. Accounts unused for 12 months are deleted automatically. Code emails and attempts are limited and the number of accounts is capped. | Limits reviewed when the account opened to everyone (1 Nov 2026): at most 2,000 accounts, 512 KB a document, 30 saves a minute. Review again as use grows. | Low |
| R13 Children and tools | Nothing is collected by default. No adverts or tracking. The 13 or over tick and separate explicit consent for the Maktab account. | None needed. | Low |
| R14 Breach handling | Breach duties in our data processing terms. Complaints process. | A written incident procedure: telling a school without undue delay about a breach of its records, and deciding within the ICO's 72-hour window for our own. | Medium |
New tools and features
A new free tool is covered by this assessment only after a recorded screening shows it meets every rule below. Anything else gets its own section here before it goes live.
The rules (all must be true):
- It runs on the person's device, and anything it keeps stays there.
- No account or sign-in. (The optional Maktab account is assessed separately in this document.)
- Nothing personal is stored on our systems, apart from short-lived technical logs.
- No tracking, advertising, profiling, or sharing or selling of data.
- Location and other device sensors are used only on the device, only after the browser asks, and are never sent to us.
- No sensitive information is sent to us.
- No new outside service receives anyone's data.
- Safe for children by default: nothing that collects is switched on by default, no nudging, plain wording.
- Anything stored on the device is explained, and there is a clear way to remove it.
What needs its own assessment instead: sign-in or accounts; storing anything personal in our cloud database; cloud connections such as Google Drive; sensitive information reaching us; payments; profiling or recommendations about a person; a new outside service or country; or use at a much larger scale.
The screening record for each tool notes what it does, where each piece of data goes, a check against every rule with evidence, the children check, the outcome, and who checked it and when. A tool is screened again whenever it changes how it handles data, and at least once a year.
Tools covered today
The screenings of 29 October 2026 were reviews of each tool's code. A test of each tool's network traffic is planned and will be added to its record.
Tool
Travel cost calculator
What it does
Works out travel costs
Status
Meets the rules on code review. Network test planned.
Screened
29 Oct 2026
Tool
Hijri calendar
What it does
Islamic calendar
Status
Meets the rules on code review. Network test planned.
Screened
29 Oct 2026
Tool
Qibla compass
What it does
Direction of prayer from the device's location
Status
Meets the rules on code review. Network test planned.
Screened
29 Oct 2026
Tool
Hifz Tracker
What it does
Memorisation log. Optional Google Drive.
Status
Assessed separately below, because it uses Google Drive.
Screened
29 Oct 2026
Tool
Muraja'ah
What it does
Qur'an revision planner. Optional Maktab account. Spreadsheet download and upload in the browser.
Status
Assessed separately below, because of the Maktab account.
Screened
29 Oct 2026
| Tool | What it does | Status | Screened |
|---|---|---|---|
| Travel cost calculator | Works out travel costs | Meets the rules on code review. Network test planned. | 29 Oct 2026 |
| Hijri calendar | Islamic calendar | Meets the rules on code review. Network test planned. | 29 Oct 2026 |
| Qibla compass | Direction of prayer from the device's location | Meets the rules on code review. Network test planned. | 29 Oct 2026 |
| Hifz Tracker | Memorisation log. Optional Google Drive. | Assessed separately below, because it uses Google Drive. | 29 Oct 2026 |
| Muraja'ah | Qur'an revision planner. Optional Maktab account. Spreadsheet download and upload in the browser. | Assessed separately below, because of the Maktab account. | 29 Oct 2026 |
Our pages, including the tools, currently load fonts from Google Fonts, which receives the visitor's IP address. We plan to move these fonts onto our own systems so the tools meet the rule on outside services in full.
A tool is added to this list only once it has been screened. If a tool stops meeting the rules, we move it to its own section. We do not remove it.
Free tools with storage options
People choose where a tool keeps their data. The device is the default. Only the Maktab account puts it in our database.
Question
Tools offering it
On this device (default)
Hifz Tracker, Muraja'ah
Their own Google Drive
Hifz Tracker. Muraja'ah no longer offers it, but anyone already connected keeps it until they move.
Maktab account
Muraja'ah first. Later tools may reuse it.
Question
Where the data is
On this device (default)
The browser on that device
Their own Google Drive
A file in the person's own Drive, in a folder called The Maktab App
Maktab account
Our Neon database on Amazon Web Services in London, kept apart from school records
Question
What we hold
On this device (default)
Nothing
Their own Google Drive
Nothing stored. To keep the connection, a sealed cookie stays on the person's device. Our system passes the Google connection through without keeping it.
Maktab account
Email address, Google account id (if used), plan type, consent records, and the tool's saved data (one document per tool, up to 512 KB). No name. Short-lived sign-in codes and sessions.
Question
Sign-in
On this device (default)
None
Their own Google Drive
Google, to connect Drive
Maktab account
Google, or a one-time email code. No passwords. Codes last 10 minutes. Sessions last 90 days.
Question
Lawful basis
On this device (default)
We receive nothing
Their own Google Drive
Legitimate interests, for the connection only
Maktab account
Contract. Explicit consent for saved data that may reveal religious belief.
Question
Age
On this device (default)
Any
Their own Google Drive
Google account rules (13 or over in the UK)
Maktab account
13 or over
Question
Cost
On this device (default)
Free
Their own Google Drive
Free
Maktab account
Free. No payment is taken for the account.
Question
Delete
On this device (default)
Clear the tool
Their own Google Drive
Disconnect, and delete the file in Drive
Maktab account
Delete account button removes everything. Accounts not used for 12 months are deleted automatically.
| Question | On this device (default) | Their own Google Drive | Maktab account |
|---|---|---|---|
| Tools offering it | Hifz Tracker, Muraja'ah | Hifz Tracker. Muraja'ah no longer offers it, but anyone already connected keeps it until they move. | Muraja'ah first. Later tools may reuse it. |
| Where the data is | The browser on that device | A file in the person's own Drive, in a folder called The Maktab App | Our Neon database on Amazon Web Services in London, kept apart from school records |
| What we hold | Nothing | Nothing stored. To keep the connection, a sealed cookie stays on the person's device. Our system passes the Google connection through without keeping it. | Email address, Google account id (if used), plan type, consent records, and the tool's saved data (one document per tool, up to 512 KB). No name. Short-lived sign-in codes and sessions. |
| Sign-in | None | Google, to connect Drive | Google, or a one-time email code. No passwords. Codes last 10 minutes. Sessions last 90 days. |
| Lawful basis | We receive nothing | Legitimate interests, for the connection only | Contract. Explicit consent for saved data that may reveal religious belief. |
| Age | Any | Google account rules (13 or over in the UK) | 13 or over |
| Cost | Free | Free | Free. No payment is taken for the account. |
| Delete | Clear the tool | Disconnect, and delete the file in Drive | Delete account button removes everything. Accounts not used for 12 months are deleted automatically. |
At sign-up the Maktab account asks for three separate tick boxes: that the person is 13 or over; that they agree to the free tools terms and privacy notice; and, separately, that they agree we keep their saved revision data, which may reveal religious belief. The version of the notice they agreed to (2026-10-30) is stored with the account.
Protection against misuse: sign-in code emails are limited per device and per email address, attempts at a code are limited, and the number of accounts is capped, so the service stays small and cheap to run.
Optional support payments. A tool may invite a person to help keep it free. Payment is optional and unlocks nothing. Stripe receives the payment details, and we receive Stripe's record of the payment. The tool remembers on the device or account that the person came back from paying, so that it stops asking.
Consultation, review and sign-off
A solicitor has reviewed this assessment. The director of Centorise Ltd has approved the measures and accepted the remaining risk. We review it at least once a year.
Who
Platform design and code
How
Review of data, security and retention
When
October 2026
Who
Legal review
How
Review by a solicitor
When
October 2026
Who
Next review due
How
Full review of this assessment
When
30 October 2027
| Who | How | When |
|---|---|---|
| Platform design and code | Review of data, security and retention | October 2026 |
| Legal review | Review by a solicitor | October 2026 |
| Next review due | Full review of this assessment | 30 October 2027 |
We review it sooner if: the Maktab account opens to everyone, optional payments change, a new tool fails the screening, we add a sub-processor or country, or a security incident happens.
Contact. We are not required to appoint a Data Protection Officer. Questions about this assessment or about how we use personal data go to contact@themaktabapp.com.
Version history
- Version 1.2, 1 November 2026. Muraja'ah and the Maktab account opened to everyone. The account limits were reviewed before opening and kept. Not yet reviewed by a solicitor.
- Version 1.1, 31 October 2026. Added anonymous visit counting on the public website for visitors in the UK (Cloudflare Web Analytics). Not yet reviewed by a solicitor.
- Version 1.0, 30 October 2026. First published version, after review by a solicitor. Updated for the Maktab account for the free tools, which is live in beta.