Privacy Policy

Labbaik Labs Ltd ("Labbaik", "we", "us") operates Labbaik (uselabbaik.com), a maktab, madrasah, mosque, and Islamic community management platform, at app.uselabbaik.com. Registered in England & Wales, Company No. 17166064. Registered address: Unit 21 Walker Avenue, Milton Keynes, MK12 5TW. ICO Registration Reference: ZC136003 (registered 29 April 2026, expires 28 April 2027). Data Protection Officer email: [email protected].

For student, parent, staff and other records an organisation keeps in Labbaik — your maktab, madrasah, mosque or community group — that organisation is the data controller and Labbaik is its data processor, acting only on its instructions under our Data Processing Agreement. Labbaik is the controller only for the data we need to run our own business, such as account sign-in records, our billing with organisations, support conversations and security logs.

• Student data: full name, date of birth, gender, curriculum group and progress, attendance records, class enrolment.
• Guardian/parent data: full name, email address, phone number, home address (used for registration and billing).
• Payment data: Stripe customer ID, payment history, subscription status, fee concession notes. We do not store full card details — all card data is handled by Stripe.
• Account data: email address, role (admin/teacher/parent), login timestamps, and details of how you sign in (see How You Sign In below).
• Staff/teacher data: full name and contact details, role, and — where the organisation tracks it — DBS safeguarding check details; see Staff Safeguarding Checks (DBS) below.
• Usage data: page views, feature usage, error logs (for platform improvement).
• Certificate application data: for Nikah and other certificate types, the names, dates of birth, marital status, profession, home address, and contact details of the bride, groom, witnesses, and wakeel/wali, plus mahr (dowry) amounts and the date/venue of the ceremony. This data is submitted by the applicant, not necessarily the account holder, and is stored on behalf of the issuing organisation.
• Donation data: name and email address of the donor (for receipts), and donation amount and frequency (one-off or recurring monthly).
• Voice notes (optional): if you choose to send a voice note to our support team, the audio recording and an automatically generated text transcript of it; see Voice Notes (Optional Feature) below.

• Delivering the maktab management service (attendance, progress, payments, parent communications).
• Processing payments via Stripe on behalf of the maktab.
• Sending transactional emails (payment confirmations, magic-link logins, registration approvals, progress updates).
• Sending a sign-in code on WhatsApp when a parent or student asks for one.
• Sending push notifications to parents who have opted in.
• Complying with our legal obligations under UK GDPR and the Data Protection Act 2018.

Labbaik doesn’t use passwords. Depending on your role, you can sign in in these ways:

• Email link or code (everyone): we email you a one-time link and a six-digit code. We use your email address to send it and to find your account.
• Google (everyone): see Google LLC in Who We Share Data With below.
• WhatsApp code (parents and students only): when you enter your WhatsApp number, we check it against the phone numbers your organisation holds for you. If it matches, we send a six-digit code to that number through Twilio’s WhatsApp service. We keep only a scrambled (hashed) copy of the code, and it stops working after 10 minutes or 5 wrong tries. We delete the hashed code, and the number and email it was for, after 30 days. We keep a record that a code was sent, the number it went to, and when, to prevent misuse and to account for messaging costs. We never include the code in that record. Staff and admin accounts can’t sign in this way.
• Passkeys (admins and teachers, optional): your phone or computer keeps the passkey and checks your face, fingerprint or screen lock itself. Your face, fingerprint and screen lock never reach Labbaik. We store only the passkey’s public key, its name, and when it was added and last used. You can remove a passkey at any time in Settings.
• Two-step verification (admins and teachers, optional): if you turn it on, we store the secret your authenticator app uses to make codes, so that we can check them.

To stop automated sign-in attempts, sign-in requests are checked with Cloudflare Turnstile and limited per network and per phone number.

The Labbaik app for iOS and Android gives you the same service as app.uselabbaik.com, and this policy covers both. The app only collects data you enter or features you choose to use:

• Camera: only when you scan an attendance QR code or join a live class. We don't store images or video from the camera.
• Microphone: only during a live class you join, which runs through Zoom, or if you choose to record an optional voice note in the support chat (see Voice Notes (Optional Feature)). Your device asks your permission first, and recording stops when you finish or cancel it.
• Photos and files: only the ones you choose to upload, such as a document or a profile photo.
• Push notifications: if you turn them on, we store a notification subscription for your device so we can send you updates. You can turn them off at any time.
• Sign-in diagnostics: if signing in fails, we record your email address, browser details and the page you were on so we can fix the problem.

The app doesn't use advertising identifiers, doesn't track you across other companies' apps or websites, and doesn't include third-party analytics or advertising tools. We use Cloudflare Turnstile to check that sign-ups and form submissions come from a real person.

You can delete your account from inside the app or on the web. See Data Deletion Requests below.

• Contract: processing is necessary to provide the service you or your institution has subscribed to.
• Legitimate interests: operational analytics, fraud prevention, platform security.
• Legal obligation: financial record-keeping, safeguarding obligations for minors.
• Substantial public interest (safeguarding): processing staff DBS/criminal-offence data, under Schedule 1 of the Data Protection Act 2018, for safeguarding children — see Staff Safeguarding Checks (DBS) below.
• Consent: marketing communications and push notifications (you may withdraw at any time).

Where an organisation tracks staff safeguarding checks through Labbaik, we store DBS (Disclosure and Barring Service) record details for teaching staff: certificate number, issue date, expiry date, certificate type (standard/enhanced), and whether it includes barred-list information — together with a copy of the certificate document, where the organisation chooses to upload one.

This is criminal-offence data, a special category under UK GDPR. It is processed by the organisation (as data controller for its staff, in the same way it is data controller for its students) for safeguarding purposes and to comply with its own legal obligations, and by Labbaik as a data processor acting on the organisation's instructions. Access is restricted to the organisation's admins and head teachers — it is never visible to teachers, parents, or other staff.

As data controller for this data, the organisation is responsible for meeting its own conditions for lawfully processing it, including maintaining an appropriate policy document under Schedule 1 of the Data Protection Act 2018 where required.

We send automated expiry reminders to the organisation so DBS checks can be renewed before they lapse. We do not independently verify DBS certificates with the DBS itself — the organisation remains responsible for confirming the validity of any certificate it records.

• Supabase (Supabase Inc.) — our database, authentication and file storage provider. Data is stored in London, UK. Supabase processes data as a data processor under our instructions.
• Cloudflare Inc. — hosts and delivers the Labbaik app and websites, and runs the Turnstile bot checks on sign-in and public forms.
• Stripe Inc. — payment processing. Stripe is an independent data controller for payment data under their own privacy policy.
• Resend Inc. — transactional email delivery.
• Twilio Inc. — WhatsApp messaging (where enabled), and WhatsApp sign-in codes that parents and students ask for. Twilio and Meta (WhatsApp) receive the phone number and the message, including the code.
• Google LLC — if you choose to sign in with Google, your Google account name and email address are shared with us via OAuth. Google's privacy policy applies to data held by Google.
• Anthropic (Claude) and OpenAI — our AI service providers, used to power the AI features described in Artificial Intelligence Features below.
• Daily (daily.co) — runs Labbaik Live video classes and events. Daily receives participants’ display names and, if an organisation records a session, the recording before it is copied to the organisation’s own Google Drive or Dropbox.
• Ideal Postcodes and LocationIQ — suggest addresses as you type one in (Ideal Postcodes for UK addresses, LocationIQ for addresses elsewhere). They receive the text you type, not your other details.
• Apple, Google and Mozilla push services — deliver push notifications to devices whose owners have turned them on.
• Google Drive, Dropbox, and Zoom — if you choose to connect one of these, as described in Third-Party Integrations below.
• Quran Foundation (Quran.com) — provides the Qur’an text, translations and recitations for the Qur’an Companion. Our servers request this content using Labbaik’s own credentials, and those requests contain no personal information. Your browser loads Quran Foundation’s Qur’an fonts and the recitation audio directly, as described in Qur’an Companion (Quran.com) below.
• OpenTimestamps — a free, decentralised timestamping service used to anchor certificate fingerprints to the Bitcoin blockchain, as described in Certificate Verification and Blockchain Anchoring below. OpenTimestamps never receives your personal information, only the anonymous cryptographic fingerprint.
• We do not sell, rent, or share personal data with third parties for marketing purposes.
• Organisations can find the full list of sub-processors, and how we tell them about changes, in our Data Processing Agreement.

Our database and file storage are in London, UK. Some of the providers listed above process data outside the UK, mainly in the United States. Where personal data leaves the UK, we rely on a safeguard recognised by UK data protection law — the UK–US data bridge where the provider is certified to it, or the ICO’s International Data Transfer Agreement or Addendum to the standard contractual clauses — as set out in our contract with each provider.

Labbaik includes optional artificial intelligence ("AI") features that help admins, teaching staff, and parents work with information already held on the platform — for example, answering questions about a student's attendance, progress, or exam results, generating reports, drafting class or event materials, and providing in-app support. AI features are only available to admin, teacher, and parent accounts — children do not have access to any AI feature.

The AI tools available to each role are deliberately narrow and scoped to your own organisation's data — an admin's AI assistant cannot see or act on another organisation's records, and the tools available to a parent are limited to their own children's records. Most AI tools are read-only: looking up and summarising attendance, academic progress, exam results, payment status, and (for admins) organisational revenue. A small number of tools can take action on your behalf where you explicitly ask them to in the conversation — for example, approving a pending student enrolment (which creates the student's record and sends a payment link to the parent), recording a manual payment, applying a family fee discount, or pausing/cancelling a Stripe subscription. The more sensitive of these require you to confirm a preview before anything is actually written. Our in-app AI support assistant can also escalate your query to a member of Labbaik's engineering/support team when it cannot resolve it itself.

When you use an AI feature, the information you submit, together with any account or student data the feature is authorised to access in order to respond to your request, may be securely transmitted to one of our AI service providers for processing:

• Anthropic (Claude) — powers our in-app and WhatsApp AI assistants, used to answer questions about attendance, progress, exam results, payments, and class/enrolment records, and to escalate unresolved queries to our support team. It is also used, only if an admin chooses to upload a book or syllabus PDF (or photos of its contents page) to the optional curriculum builder, to read it and suggest the book's title and its sections with page ranges. Usually only the pages needed to find the contents are sent — typically the first and last pages of the book, or the pages the admin selects — though the admin can choose to have the whole book read. The suggestion is reviewed and edited by the admin before anything is saved. A copy of an uploaded PDF may also be kept with your organisation's curriculum in our own storage. It is likewise used, if an organisation chooses to import its existing spreadsheets using Hijrah, to work out what each file contains and how its columns map to Labbaik's fields — see Importing Your Existing Data (Hijrah, Optional Feature) below.
• OpenAI — used for generating class-structure suggestions and event posters/copy, and, only if you choose to send one, for converting a voice note to text (see Voice Notes (Optional Feature) below). For poster and event-copy generation, only the event or class details you provide and your organisation's logo are sent to OpenAI — no student or parent personal data is involved. A voice note is sent to OpenAI as audio, so it contains whatever you say in it.

We do not use customer, student, parent, certificate, or organisation data to train our own AI models. Data submitted through Labbaik's AI features is not used by our AI service providers to train their general-purpose AI models by default under their commercial/API services.

AI providers may temporarily retain requests and responses for security, abuse prevention, legal compliance, and service operation in accordance with their applicable commercial terms, data processing agreements, and retention policies. We aim to minimise the personal information transmitted to AI providers and only provide information reasonably necessary to perform the requested task.

AI-generated responses may occasionally be inaccurate or incomplete. Users should review AI-generated information before relying on it for important administrative, educational, safeguarding, financial, or legal decisions.

Where available, you can choose to send a voice note to Labbaik support — over WhatsApp, or by recording one in the in-app support chat — instead of typing. This is an optional feature: everything it does can be done by typing, and nothing on the platform requires you to send a voice note.

If you choose to send one:

• The recording is stored with your support conversation, where our support team can listen to it. In the in-app chat your device asks for microphone permission when you first tap record, and recording stops when you finish or cancel it.
• The audio is sent to OpenAI, our speech-to-text provider, which converts it to text. The transcript is stored with the recording and shown alongside it. Our AI support assistant (powered by Anthropic) then uses the transcript to understand your request, in the same way as a typed message, as described in Artificial Intelligence Features above.
• Transcripts are generated automatically and may contain mistakes; the recording remains the record of what was said. Typing a message with your voice note means it is not transcribed.
• The statements in Artificial Intelligence Features about not training AI models on your data, and about providers' temporary retention, apply to voice notes in the same way.

Please don't include more personal information, particularly about children, than is needed to explain your request. You can ask us to delete a voice note and its transcript at any time using the process in Data Deletion Requests or Your Rights (UK GDPR).

Hijrah is an optional tool that lets an organisation admin bring in the spreadsheets (CSV or Excel files) it already keeps — for example student lists, classes, fees, payment history, staff, progress, attendance, and recurring tasks — instead of entering everything by hand. You can always add this information manually instead.

• Your files are not kept. A spreadsheet you choose is read in your browser. We do not save the file itself in our database or file storage, and no copy of it is kept once the import is finished. Only the records you review and approve for import (such as students, classes, and fees) are saved, as part of your organisation's data, under the rest of this policy.
• To work out what each file contains and match its columns to the right fields, the file name, the column headings, and a few sample rows from each file are sent to Anthropic (Claude); where a file describes your class structure, the rows describing that structure are sent too. These samples can include personal details such as names. The suggestions are shown to you to check and correct before anything is imported.
• The statements in Artificial Intelligence Features about not training AI models on your data, and about providers' temporary retention, apply to this in the same way.

As with all student and parent data, the organisation is responsible for having the right to import the information it uploads. Please remove any columns you don't need before importing.

The Qur’an Companion is a Qur’an reader and practice tool inside Labbaik. Students and parents can open a passage from their homework, their progress page or the Qur’an tab, listen to it ayah by ayah, and practise it. Teachers and admins can open it from their own view. The Qur’an text, translations and recitations come from Quran Foundation, the organisation behind Quran.com, through its official API.

• What Quran Foundation receives from us. Our servers ask Quran Foundation for the passage being read (the surah and ayahs, the script, the reciter and any translation chosen), using Labbaik’s own credentials. These requests contain no names, email addresses, student details or other personal information. We keep a copy of the Qur’an content for up to 24 hours so that the same passage doesn’t have to be requested again; this copy contains no personal information.
• What your browser loads directly. To show the Qur’an in the correct script and play the recitation, your browser loads Quran Foundation’s Qur’an fonts and the recitation audio files directly from Quran Foundation and the audio hosts it uses. As with any website, these servers receive your device’s IP address and standard browser information, under their own privacy policies. We do not send them your account details.
• What we store. When a student or parent practises, we record a practice session: the student, the passage, where it was opened from (for example a homework task), the practice settings used, how many recitations were listened to, how many ayahs were revealed while the text was hidden, and when the session started and finished. Teachers can also set how many times a homework passage should be listened to, which is saved with the homework. Practice sessions can be seen by the student’s family and by staff at the organisation who can see that student. When teachers or admins use the reader, nothing is recorded.
• What practice does not do. Practising never changes a student’s progress and never marks homework as done. A family can choose to mark a homework task as practised, and the teacher still assesses the student in class.
• Settings on your device. Reader preferences (such as script, reciter, translation, text size, speed and practice settings) and the last passage read are saved in your browser’s local storage on that device only, and are not sent to us. See our Cookie Policy.
• No Quran.com account. The Qur’an Companion does not connect to, or sign you in to, a Quran.com account.

Practice records about students are processed by us as a data processor on behalf of the student’s institution, in the same way as other progress records (see Children’s Data). You can ask for them to be deleted using the process in Data Deletion Requests or Your Rights (UK GDPR).

Labbaik offers optional connections to Google Drive, Dropbox, and Zoom via OAuth — an industry-standard authorisation protocol. You connect these yourself from your account settings, authorising access directly with the provider; Labbaik never sees or stores your password for these services, and you can revoke access at any time, either in Labbaik or directly with the provider.

Each connection only ever sees what it needs to:

• Google Drive — connected using Google's per-file (drive.file) scope. Labbaik can only see files it creates on your behalf or that you explicitly select through the connection. We cannot browse, list, or access the rest of your Drive.
• Dropbox — connected with "App Folder" access. Labbaik's connection is confined to its own dedicated folder inside your Dropbox. We cannot see or access any other files in your account.
• Zoom — used only to create and manage video meetings for your classes and events on your organisation's behalf. It does not give us access to files, recordings, or any other Zoom account data beyond the meetings Labbaik creates.

In every case, the file or meeting data Labbaik can see is limited to what you've explicitly shared with or created through the connection — we have no visibility into anything else in your Google Drive, Dropbox, or Zoom account. Access tokens for these connections are encrypted at rest, transmitted over TLS, and refreshed automatically without your login credentials ever passing through or being stored by Labbaik. See our Security page for more detail.

Labbaik charges a platform fee on Stripe transactions processed through the platform, except donations. Maktabs and parents are informed of this fee at the point of payment setup. This fee is deducted automatically at the point of payment and varies by payment type:

• Class/admission fees and certificates (e.g. Nikah): charged on a graduated scale based on the organisation's trailing 30-day payment volume, from 1.5% on the first £3,000/month down to 0.35% above £50,000/month (unless an individually negotiated rate applies) — see our Terms of Service for the full schedule.
• Donations (Sadaqah and Zakat): no platform fee (0%) on any donation. Stripe's own processing fee still applies. For non-Zakat donations, whether Stripe's fee is paid by the donor or deducted from the organisation's receipt depends on whether the donor opts to cover it at the point of giving, unless the organisation is covered by our 100% donation policy, under which Labbaik credits the organisation's Stripe fees back to it. For Zakat-designated donations, Stripe's processing fee is always added on top of the donor's stated amount, never deducted from it — a mandatory (non-optional) surcharge so that the full amount designated as Zakat reaches the cause, consistent with Zakat fiqh requirements. A donor may also choose to add an optional gift to Labbaik on a one-off non-Zakat donation; the gift is shown separately and is paid to Labbaik, not the organisation. See our Terms of Service for details.

An organisation may choose to pass some or all of this fee on to the student or parent, rather than absorbing it itself. Where an organisation does this, it is disclosed to the student/parent at the point of payment setup — before the student/parent enrols or pays — in accordance with applicable law.

When a certificate (for example, a Nikah certificate) is issued through Labbaik, we generate a unique cryptographic fingerprint ("hash") of the certificate's core details, and — once the organisation uploads a signed copy of the physical document — a separate fingerprint of that signed document. These fingerprints are recorded on the Bitcoin blockchain via a service called OpenTimestamps. This is a public, permanent, and free record that allows anyone to independently confirm a certificate's contents have not been altered since the date it was issued.

Important points about this process:

• The fingerprint itself is a scrambled code. It does not contain your name or any other personal information, and cannot be reversed to reveal your personal details.
• Your actual personal information (name, date of birth, address, etc.) is never published on the blockchain. It is stored securely by Labbaik and by the organisation that issued your certificate, exactly as described elsewhere in this policy.
• The public verification page (verify.uselabbaik.com) shows only the certificate type, the issuing organisation's name, and the date of issue. It does not display the names or personal details of the people involved.
• Records on the Bitcoin blockchain are permanent and cannot be edited or deleted by Labbaik, the issuing organisation, or you. If you later ask us to delete your personal data, we will delete or anonymise your personal information from our own systems, but the underlying fingerprint will remain on the blockchain indefinitely. Because the fingerprint alone cannot identify you or reveal any personal information, we do not consider this to conflict with your right to erasure — but we want you to be aware of it before you apply for a certificate.

• Active student/parent records: retained for the duration of the institution's subscription plus 2 years.
• Payment records: retained for 7 years in compliance with HMRC requirements.
• Attendance and progress records: retained for 3 years after a student leaves.
• Qur’an Companion practice records: retained with the student’s progress records, for 3 years after a student leaves.
• Deleted accounts: personal data is anonymised or erased within 30 days of a verified deletion request.
• Certificate records: currently retained indefinitely, as we have not yet set a fixed automatic deletion schedule for this data. You may request erasure of your personal information from a certificate record at any time using the process described in Your Rights (UK GDPR) and Data Deletion Requests below; we will action verified requests within 30 days, consistent with our other data. (The underlying blockchain fingerprint is unaffected by this — see Certificate Verification and Blockchain Anchoring above.)

You have the right to: access your data, correct inaccurate data, request erasure ("right to be forgotten"), restrict or object to processing, data portability, and to withdraw consent at any time. To exercise any of these rights, email [email protected]. We will respond within 30 days. If your request is about records an organisation keeps about you or your child, that organisation is the data controller: we’ll pass your request to them and help them respond, and organisations can download their records themselves at any time. You also have the right to lodge a complaint with the ICO at ico.org.uk.

Parents and staff can request deletion inside the Labbaik app: tap Request account deletion at the bottom of your Profile (parents) or More page (staff). The request goes to your organisation's admin and to Labbaik. Organisation admins can close the whole organisation from Account → Settings → Close account.

If you can't sign in, you can request deletion of your own data or your child's data by emailing [email protected] with the subject line "Account Deletion Request". Include the name, email address, and institution associated with the account. We will confirm deletion within 30 days. Our Delete Your Account page sets out the steps, what we delete, and what we must keep.

We use essential session cookies for authentication. We do not use third-party advertising or tracking cookies. Analytics are limited to anonymised, aggregated usage data.

All data is encrypted in transit (TLS) and at rest (AES-256), and stored in London, UK, with automatic daily backups. Each organisation’s data is kept separate by row-level security (RLS) policies enforced in our database, checked by automated tests on every change. Access within an organisation is role-based, staff can protect their accounts with passkeys and two-step verification, and changes to key records such as attendance, progress and student details are logged. Sensitive documents such as DBS certificates are kept in private storage. A small number of Labbaik staff can access organisation data, under a duty of confidentiality, only to give support, fix problems or meet legal obligations.

If a personal data breach affects an organisation’s data, we will tell the organisation without undue delay and no later than 72 hours after becoming aware of it. We follow responsible disclosure practices for security vulnerabilities. Full details are on our Security page.

Many of our users are children under 13. We collect children's data only at the direction of the maktab institution, which acts as data controller for its students. We process this data as a data processor under our Data Processing Agreement, which covers every institution. Parents may request access to or deletion of their child's data at any time. Children do not have access to any AI feature — see Artificial Intelligence Features above.

We will notify active users of material changes via email or in-app notice at least 14 days before they take effect.

Labbaik Labs Ltd, Unit 21 Walker Avenue, Milton Keynes, MK12 5TW. Email: [email protected].