Privacy Policy

This policy applies to everyone who uses this website, submits an application, joins a waitlist, contacts admissions, or holds a student, guardian, teacher, or administrator account with Afsah Institute (“Afsah”, “we”, “us”).

We collect the following categories of information:

• Application information — student name, email address, phone number, gender, age, selected program, stated learning level, prior experience, goals, and emergency contact.
• Parent and guardian information — name, email address, and phone number, required whenever the student is under 18.
• Account information — the email address used to sign in, and the authentication session stored in your browser.
• Payment information — the amount, currency, status, and payment identifiers for your enrolment. See section 4: we never receive or store your card number.
• Correspondence — messages you send through the contact form, including your name, email address, optional phone number, and the content of the message.
• Limited technical information — the IP address attached to a form submission, retained only to enforce rate limits and block automated abuse.

• To assess applications, place students at an appropriate level, and manage enrolment and waitlists.
• To take tuition payments and keep an accurate record of what has been paid.
• To send transactional email: application confirmations, waitlist notices, payment receipts, and payment failure notices.
• To let teachers see the students enrolled in the courses they are assigned to teach.
• To respond to enquiries sent through the contact form.
• To keep the site secure and prevent automated abuse of our forms.

We do not sell your information. We do not share it with advertisers. We do not use it to build advertising profiles or to train machine-learning systems.

Card payments are processed by Stripe. Your card number, expiry date, and security code are entered directly on Stripe’s systems and are never transmitted to or stored by Afsah. We retain only the transaction amount, currency, status, and Stripe’s reference identifiers so that we can reconcile your enrolment. Stripe’s handling of your data is governed by its own privacy policy.

We rely on a small number of processors, each handling data solely on our instructions:

• Supabase — database, authentication, and file storage.
• Vercel — website hosting and delivery.
• Stripe — payment processing.
• Resend — delivery of transactional email.

We do not transfer your information to any other third party except where we are legally required to, or where it is strictly necessary to protect the safety of a student or another person.

Several of our programs, including Maktab, are designed for children. A student under 18 must be registered by a parent or legal guardian, whose contact details are collected as part of the application. By registering a child, the parent or guardian consents to the collection and use of that child’s information as described in this policy.

We collect no more information about a child than is necessary to deliver the program and to reach a responsible adult. A parent or guardian may review, correct, or request deletion of their child’s information at any time by writing to admissions@afsah.institute. We do not knowingly permit a child to create an account independently of a parent or guardian.

We use a single category of cookie: the session cookie that keeps you signed in to your dashboard. It is strictly necessary for the site to function and cannot be disabled while you remain signed in. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Because we set no non-essential cookies, no consent banner is required.

• Registration and payment records are kept for as long as needed to administer enrolment and to satisfy tax and accounting obligations.
• Contact form messages are kept until the enquiry is resolved and for a reasonable period afterwards.
• Email delivery logs are kept so that we can investigate messages that failed to arrive.
• Rate-limiting records, including the associated IP address, are deleted automatically after 24 hours.

You may, at any time:

• Ask for a copy of the information we hold about you or your child.
• Ask us to correct anything inaccurate.
• Ask us to delete your information, subject to records we are required to retain for financial or legal reasons.
• Withdraw from a program in accordance with our Refund Policy.

Write to admissions@afsah.institute and we will respond within a reasonable period. Transactional email relating to an active enrolment is necessary to deliver the service and cannot be unsubscribed from while that enrolment is live.

Access to student records is restricted by role: students see only their own records, teachers see only the students in the courses assigned to them, and administrative access is limited to authorised staff. These restrictions are enforced at the database level as well as in the application. Sign-in uses emailed one-time links rather than stored passwords. No system can be guaranteed perfectly secure, but we take these measures seriously and review them.

If this policy changes we will update the date shown at the top of this page. Material changes affecting how we use information already collected will be communicated by email to enrolled students and guardians.

Questions about this policy may be sent to admissions@afsah.institute or by post to Afsah Institute, [street address], [city], [state] [ZIP].