Privacy Policy

This policy explains how the Q-Trust platform ("the Platform") processes personal data when using our public website and when subscribed schools use the Platform to manage their activities.

Each subscribed school acts as the data controller for its students' and members' data; the Platform acts as a data processor on behalf of the school and according to its instructions.

Demo request form data (public site): name, school name, city, phone number, and email if provided — used exclusively to follow up on your request.

Operational data (within the Platform, entered by the school): student data — including minors — such as name, date of birth, ID number if applicable, photo, guardian contact information, attendance history, monthly fees, and educational documents.

Technical data required for service operation and security: connection logs, IP address for rate limiting, and administrative activity journal within the school's account.

The nature of Quranic school activities means that most students are minors. The school enters this data as the data controller, with guardian consent according to its own enrollment procedures.

We are committed to strict isolation between schools (no school accesses another's data), role-based access control within the school (director, teacher, student/parent), and never using student data for commercial purposes.

Database: MongoDB Atlas (cloud hosting, encryption in transit and at rest).

Photos and files: Cloudinary, in a folder isolated per school.

AI assistant (Advanced plan): conversation text and necessary query results are sent to the language model provider Groq for request processing; they are not used for model training.

Rate limiting and abuse protection: Upstash Redis.

We do not sell personal data and do not share it with any third party beyond these technical sub-processors.

Demo request data: retained as long as the business relationship is active, deleted on request.

Subscribed school data: retained for the duration of the subscription. At the end of the subscription, the school may request a copy of its data, which is then deleted from our systems within a reasonable timeframe.

You — and the guardian of any student — have the right to access, rectification, deletion, and withdrawal of consent, in accordance with Tunisian data protection law. Requests may be addressed to your school as the data controller, or directly to us via the contact page — we will forward them and assist with their execution.

Passwords are encrypted with a strong hashing algorithm and never stored in plain text. Connection to the Platform is encrypted via HTTPS. Sensitive operations are logged in an activity journal showing who performed them and when, including operations executed via the AI assistant after the director's approval.

We may update this policy as the Platform evolves. Substantial changes are notified to subscribed schools by email to the registered director before they take effect.