Privacy notice

The Maktab App is software used by Maktabs and madrasahs to run registers, homework, Hifdh records, level tests, merits and fees. It is operated by Centorise Ltd, a company registered in England and Wales, number 17368406.

When a Maktab uses the platform, that Maktab is the data controller and we are its processor. It decides what is recorded and why; we hold and process it on that Maktab's written instructions and do not use it for anything else. If you are a parent or a member of staff and you want to see, correct or delete what is held about you or your child, your Maktab is the right first port of call — and we will help them answer you.

We are the controller in our own right for a small amount of information: enquiries and visit bookings made through this website, our own staff records, the security logs that record sign-in attempts, and the record of a Maktab accepting our email terms (see "Emails a Maktab sends from its own email account" below).

Name, date of birth, gender, home address and the school they attend during the day. Who their guardians are and how to reach them. Which classes they are in, and their attendance, including lateness.

Their learning: level tests and results, Hifdh records including the passages heard and mistakes marked, homework set and returned, merits awarded, and end-of-term reports.

Where a family has provided it: health and welfare information — medical conditions, allergies, special educational needs, additional needs such as an EHCP, emergency contacts, and consent for emergency treatment or paracetamol.

Where a Maktab uses the map feature, a student's postcode is converted into approximate coordinates so leaders can see where families travel from.

Photographs and voice recordings, where a parent or teacher attaches them to a homework entry.

Health and additional-needs information is treated as special category data under UK data protection law, and it is handled more carefully than the rest.

Inside a Maktab, it is visible to leaders and office staff, and to a teacher for the children in their own classes — because an allergy that a teacher cannot see is of no use to anybody. It is not visible to other parents, and it is never used for anything other than the child's care and safety at the Maktab.

Which staff can see it is set by each Maktab through its own roles and permissions.

Name, email address, telephone number and home address; which children you are linked to and your relationship to them; the messages you exchange with the Maktab; your fee balance, payments and receipts; and, if you turn them on, your notification preferences and the devices you have subscribed.

Name, contact details, home address, emergency contacts, job title and role, qualifications, hours worked and pay information, and — where the Maktab records it — medical information relevant to their work.

A Maktab can share a link that lets someone apply to work there. The person does not need an account. The form collects their name, contact details, address, an emergency contact, their qualifications and experience, why they want the role, when they are available, the names and email addresses of two referees, whether they say they have the right to work, a current DBS check and a safeguarding certificate, and, if they choose, a CV. It does not ask for health information.

What an applicant says about their right to work, DBS check or safeguarding certificate is recorded as they said it. It is a claim, and nobody has checked it. The Maktab records any checks later, if it hires them.

The Maktab is the data controller and we are its processor. The Maktab uses the application only to consider it. Applying does not create an account, and we do not send the applicant an email.

If the Maktab hires the applicant, the application becomes part of their staff record. If it does not, the application is deleted automatically, as set out under "How long it is kept" below.

A Maktab can choose to connect its own email account, so that emails to its parents come from the Maktab's own address. Someone at the Maktab types in the account's email server, its username and a password. We recommend an app password from the email provider, and a mailbox that is used only for sending these emails.

What we store, and why. We store the email server, the username, the sending address and the password (or app password). We use them only to send the emails the Maktab writes in the app, in the background, to the parents the Maktab chooses. We never read the Maktab's mailbox.

How it is protected. The password is encrypted before it reaches the database, using a key that is kept separately and that we can replace. It is never shown again, never sent back to the screen and never written to our logs. Only the staff the owner chooses can connect or disconnect the account.

When it is deleted. We delete the password when the Maktab disconnects the account in the app, and when the login stops working.

If the Maktab gives us app details from its own Microsoft or Google account. Instead of an email server and password, a Maktab can have its IT person make a small app in the Maktab's own Microsoft 365 or Google Workspace account and give us the app's details: an application ID, a client secret or private key, and the mailbox to send from. We store them encrypted in the same way, use them only to send the emails the Maktab writes, and delete them when the Maktab disconnects or the details stop working. The app can only send mail. We never read the Maktab's mailbox. We recommend that the Maktab's IT person limits the app to the one sending mailbox.

Each parent gets one email, even if they have more than one child at the Maktab. For each email, we keep a record of who it was sent to and whether it was sent, so the Maktab can see what happened. Those records are deleted 90 days after the email finishes sending.

News emails have an unsubscribe link, and we stop sending news to anyone who uses it. Notices, such as closures, term dates and safety, are sent regardless.

Our record of the Maktab's agreement. Before a Maktab can connect an email account, the school owner accepts our email terms with a tick box. We keep a record of who accepted, when, the exact words they saw, their IP address and their browser. We keep it because we have a legitimate interest in being able to show what was agreed. We keep it for the life of the contract plus 6 years, and then we shorten the IP address.

The database is in the United Kingdom, in London.

Some of the services we depend on to make the platform work are not UK-only. The code that serves the app runs on Cloudflare's network at whichever data centre is nearest the visitor. Our own emails, such as sign-in links, are sent through a provider based in the United States. Emails a Maktab sends from its own account go through that Maktab's own email provider. Card payments are processed by Stripe. Where a Maktab has connected its own file storage, the files it keeps in the app go to that storage, in whichever region the Maktab chose. That includes homework attachments, staff documents and the CVs sent with staff applications.

Every one of these is named on our sub-processor list, with what it does and the country it does it in. Transfers outside the UK are made under the safeguards UK law provides for them.

We do not sell personal information, we do not share it for advertising, and we do not use it to train AI models.

It reaches the companies on our sub-processor list and nobody else, other than where the law requires us to disclose something.

While a Maktab is using the platform, its records are kept so the Maktab can do its job — attendance history, progress and financial records are exactly the things a school needs to be able to look back on.

Some things are cleared automatically: sign-in links are deleted 30 days after they are used or expire; enquiry and booking details are stripped from our records after 180 days; staff-room discussions are archived on a schedule each Maktab sets, nine months by default; and a parent account with no children still enrolled is disabled after a period the Maktab sets, one year by default.

Staff applications are deleted automatically. The Maktab sets how long, and the form tells the applicant. By default, an application that was not successful is deleted 6 months after the Maktab decides. A general application is deleted 12 months after it was last changed, and an application nobody has decided on is kept for up to that long from its last change. The Maktab can keep one longer, and has to give a reason. An application from someone who is hired is not deleted: it stays with their staff record.

Beyond those, other records are kept until the Maktab asks us to remove them or until its contract with us ends. We have not built automatic retention rules for them yet, and we will update this notice when they are in place rather than describe them before they exist.

You can ask to see the information held about you, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive a copy in a portable form. You can also withdraw consent where something relies on it.

If you applied to work at a Maktab and want your application deleted sooner, ask the Maktab. The Maktab can delete it in the app straight away.

If it concerns a child at a Maktab, ask the Maktab first — the records are theirs and they can answer fastest. If you would rather come to us, or your request concerns information we hold in our own right, send us a message and we will respond within one month.

There is no charge for any of this.

Tell us, and we will look into it. Our complaints procedure explains what happens and how long it takes.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. You can go to them at any point — you do not have to come to us first.

The platform exists to record children's education, so almost everything in it concerns a child. Children do not have their own logins: a parent or guardian holds the account and sees their own children only.

We design with that in mind — the least information that does the job, visible to the fewest people who need it, and never used to profile a child or to advertise to anyone.

When this notice changes we update the date at the top. Where a change is significant, we will tell the Maktabs using the platform rather than rely on them noticing.