Privacy policy

This policy explains what information Education360 collects, why we collect it, who can see it, how long we keep it, and the choices you have. We have tried to write it in plain words. If anything is not clear, please ask us.

In short

We collect only what we need to teach, to keep children safe and to run the institute.
We never sell your information. We show no ads, and we do not let advertisers track you.
A parent must agree before a child under 18 uses Education360.
Classes may be recorded. Recordings are kept for as long as the institute runs, unless we agree to delete one.
Captions, transcripts and class summaries are made on the institute's own computers. No outside AI company receives them.
You can download your data, or ask us to delete your account, at any time from your account menu.

Who we are

Education360 (education360.online) is an online institute. It connects students with teachers for live classes, recorded lessons, one-to-one lessons, homework and quizzes.

Education360 is run by Muhammad Haris Zuberi (Sole Proprietorship). In this policy, "we" and "us" mean Muhammad Haris Zuberi. We decide how your information is used, and we are responsible for it.

You can reach us by email at Haris@education360.online, or by phone or WhatsApp on +92 302 8201850.

What information we collect

We collect information when you use our website or app, when you contact us, and when other people give it to us. For example, a parent adds a child, our office notes a phone call, or someone reports a concern.

Account details: name, email address, mobile or WhatsApp number, country, city, time zone, language, and whether you are a student, parent, teacher or partner. Your password is stored scrambled, never as plain text.
Children's details: first and last name, age group or date of birth, level, gender if given, city, time zone, and which parent they are linked to. See Children and parents below.
Learning records: courses, class groups, class times, attendance (worked out from the minutes connected to a live class), lessons watched, homework and files handed in, voice answers, quiz answers and marks, teachers' feedback, reports, certificates, Hifz (Quran memorization) records, and reviews you write.
Class recordings: the video and sound of live classes that a teacher records. See Live classes, recordings, captions and summaries below.
Chat and messages: class chat (including private messages in class), messages between families and teachers, and support tickets. Our system blocks phone numbers, email addresses and links in class chat and messages.
Captions and transcripts: the written text of what was said in a class or a recording, with the speaker's name, made by our own software.
Payment information: invoices, payments, refunds and family credit, and the payment proofs you send: a photo or PDF of your transfer, the transaction ID, the date, the amount and the name on the paying account. We do not take card payments, so we never see card details.
Teachers' information: your application (including your CV, photo and expected pay), public profile, free times, pay terms and earnings, payout details (bank account or mobile wallet), tax details (such as CNIC and NTN), and safety checks (see our Safeguarding policy).
Partners' information: if you join our partner programme, your details, the people you referred, your commission, and your payout and tax details.
Sign-in and device information: IP address, browser and device type, the times you sign in, failed sign-in attempts, the devices you are signed in on, and your two-step sign-in settings. If you use a passkey (fingerprint or face), your fingerprint or face never leaves your device. We keep only a public key.
Use of course files: when you open or download a course document, we record who opened it, when, which copy, the IP address and the device. Each copy carries the reader's name and a code, so a leaked copy can be traced.
Website visitors: what you type into our forms (contact, report a concern, events, course alerts, free level tests, Find my teacher), and website statistics from Google Analytics where it is switched on and allowed. See Website visitors and cookies below.
Consent records: what you agreed to, which version, when and how.
Notes the office keeps: for example, a record of a phone call about an enrollment.

Some information can be sensitive. For example: a reason for a pause such as illness, a request for extra help in class, a scholarship or Zakat application, or joining a religious course. We use it only for that purpose, and only the staff who handle it can see it.

Why we use it, and the reason the law allows it

To teach and to run your account: classes, timetables, reminders, recordings, homework, marks, reports and certificates. Reason: we need it to give you (or your child) the service you asked for. This is our agreement with you (contract).
To bill, to receive payments, and to pay teachers and partners: invoices, receipts, payment proofs, refunds, payouts and tax. Reason: our agreement with you, and the law, which requires us to keep accounts and tax records.
To keep children and everyone safe: parental consent, teacher checks, the chat filter, reports of concerns, and keeping evidence. Reason: our legitimate interest, and our duty, to protect children. Sometimes the law requires it.
To make classes easier to follow: live captions, transcripts, class summaries and practice questions. Reason: they are part of the service, and we have a legitimate interest in better teaching. For children, the parent's consent covers captions and transcripts.
To keep our systems secure: sign-in records, limits on repeated attempts, backups and health checks. Reason: our legitimate interest in protecting your information, and the law.
To answer you: support tickets, WhatsApp chats and calls. Reason: our agreement with you, or our legitimate interest in helping you.
To send news about courses: only if you ticked the box for it and confirmed your email. Never for anyone under 18. Reason: your consent. You can stop at any time with the link in every message.
To count website visits: Google Analytics on our public pages. Reason: your consent where we ask for it. For visitors in Pakistan, our interest in improving the website, and you can still say no.
To improve our service: reports on which courses and teachers families choose, without naming you. Reason: our legitimate interest.

We do not make decisions about you that have legal or similarly serious effects by computer alone. Some things are worked out automatically, such as attendance from the time connected, quiz marks, practice suggestions, and blocking phone numbers in chat. A teacher or our office can check and change them.

Qalam, the helper in our app, follows fixed rules. It is not AI, and it does not learn from you.

Children and parents

Who counts as a child: anyone under 18.
Age at sign-up: we ask whether the student is under 13, 13 to 17, or 18 or older. If a date of birth is given, it decides. If we do not know the age, we treat the student as a child.
Under 13: children cannot sign up themselves. A parent or legal guardian creates the account and manages it.
13 to 17: a teenager may start a sign-up, but the account waits until a parent confirms it. We send the parent a link by WhatsApp, text message or email. The link works for 7 days.
One consent covers it all: when a parent confirms, they agree to the child's account, to the child's classes being recorded, to live captions and transcripts of those classes, and to this policy and our Safeguarding policy. We keep a record of each consent.
Accounts made by our office: if our office creates a child's account, we ask a parent to confirm it when they first sign in. Or our office records the parent's consent given by phone or on paper, with a note of how it was given. Until a parent confirms, we send reminders, and we may stop the child joining classes.
Children in the United States under 13: our office also checks the parent's consent directly, for example by a video call or a signed form, as US law (COPPA) requires.
What parents can do: see their child's classes, attendance, work, marks and reports; read their child's messages and class chat, including private messages; watch their child's recordings; correct details; download their child's data; ask us to delete their child's account; and withdraw consent. If a parent withdraws consent, we will explain what it means. For example, we cannot keep a child's account without a parent's consent, so we would close it, while keeping the records the law requires.
When a student turns 18: the account becomes an adult's account. We tell both the student and the parent.

Extra protection for children:

Course news is switched off for everyone under 18.
We never show a child's full name in public. Reviews show only a first name and the first letter of the last name. A child is named in our published results only if a parent has agreed.
Leaderboards are off unless we switch them on. Even then, they show only a first name and an initial, and a child under 13 appears only if a parent says yes.
Free level test results are sent by email or WhatsApp only to a parent, or to a student aged 16 or over.
Google Analytics never runs on the pages you see after signing in.
We never ask a child for more information than they need to take part.
Children never chat with an AI.

A note for students

We use your information to run your classes and to keep you safe.
Your teacher and our office can see your work and messages. If you are under 18, your parent can too.
Your parent and our office can read class chat, including private messages.
Classes may be recorded. You will see a REC sign. Students in your class and their parents may watch the recording.
Never share your phone number, address or social media in class or in messages. Our system blocks them to keep you safe.
If anything worries you, press Report a concern, or tell your parent or our office.

Live classes, recordings, captions and summaries

Our own classroom: live classes run on our own media server, Education360 Live. Video and sound go only between your device and our server. We do not use Zoom, Google Meet or similar services.
Recording: the teacher (or our office) can record a class. Before you join, a notice says the class may be recorded, and a REC sign shows while it is recording. A recording shows what is on the main screen. This is usually the teacher's camera, the whiteboard or a shared screen, and sometimes the camera of the student who is speaking. It also has the sound of everyone who speaks. Our Cookies and recordings notice has the details.
Who can watch: the teacher checks a recording before sharing it. They share it with the students of that class (or of the whole course) and their parents. A one-to-one recording is shared only with that student and their parents. Our office can watch every recording, including the original before the teacher's changes.
How long: recordings are kept for as long as the institute runs, unless we agree to delete one (see Your rights and choices). When a teacher deletes a recording, it is only hidden; our office keeps the original. When an account is deleted, its one-to-one recordings are deleted too, unless they are needed for a safeguarding case. Group recordings are kept, because other students are in them.
Captions and transcripts: when live captions are switched on and someone presses CC in a class, our software writes captions of what is said, with the speaker's name. Everyone sees a "Live captions" sign. The transcript is kept with the class, and the teacher and our office can read it. Recordings can have captions too. Teachers can correct them, and anything a teacher cut from a recording never reaches students.
Summaries and practice questions: if we switch this on, our software can write a class summary, practice questions and flashcards from the transcript, with names and contact details taken out. A teacher checks and approves everything before students see it. Students see the label "Prepared on the institute's own computers, checked by your teacher".
On our own computers: captions, transcripts and summaries are made by our own software on the institute's own computers in Pakistan. Only our office can approve a computer for this work. No outside AI company receives class sound, transcripts or students' work. We do not use them to train AI.

Payments

We take payments by bank transfer, Raast, mobile wallet or cash deposit, to the account shown on your invoice. We do not take card payments online at the moment.
When you send a payment proof, it is stored privately. Only you and the office staff who handle payments can open it. If your invoice is from an independent teacher, the proof goes to that teacher.
We will never ask you for your bank password, card number, PIN, or a one-time code from your bank or wallet.
For refunds, see our Refund and cancellation policy.
Teachers and partners: we send payout lists to banks and wallet companies so they can pay you, and we report tax deducted to the Federal Board of Revenue (FBR), as the law requires.

Who can see your information

You, and your parents if you are under 18.
Your teachers: the names, level, time zone, attendance, work, marks and messages of their own students. They do not see payment proofs, bank details or other families' information. Independent teachers also see the contact details of the students they enrolled themselves.
Other people in your class: the name you join with, your video and voice when your camera or microphone is on, and the messages you send to everyone. They may also see you in the recording of the class.
Our office staff, each only what their job needs. For example, finance staff see invoices and payments. When our office opens a conversation between a family and a teacher, this is logged and shown in the conversation.
Our safeguarding lead and deputy (and senior office staff we name for this): reports of concerns and the evidence attached. Finance staff, and any teacher a concern is about, cannot see them.
The public: teacher profiles; reviews (first name and initial); and a certificate's check page, for anyone who has the certificate's code. Certificate check pages are hidden from search engines unless the certificate's owner chooses otherwise.
Authorities: the police, child protection services, courts or tax authorities, when the law requires it, or when we need to protect a child.
Our professional advisers, such as our accountant or lawyer, who must keep it confidential.
A new owner: if Muhammad Haris Zuberi is ever reorganized or sold, your information would pass to the new owner, who must follow this policy. We would tell you first.

Outside services we use

We run Education360 on our own server with our own software. We use outside companies only for the jobs below, and they get only what they need for that job.

Hosting: our server is rented. They provide the machine. They do not use your information.
Email: we send email through our rented servers.
Text messages (SMS): Not available right now.
WhatsApp: if we send you WhatsApp messages, or you write to us on WhatsApp, WhatsApp (owned by Meta) carries them under its own terms.
Google Analytics: only on our public pages, as described in Website visitors and cookies below.
Videos and maps on our public pages (YouTube, Vimeo or Google Maps) load only when you press play or open them.
Banks and mobile wallet companies handle payments and payouts.

We do not use any outside service for live classes, recordings, captions or AI.

Where your information is kept

Our main server is in UK.
Every night, encrypted copies of our database, and copies of new files such as recordings and documents, are copied over an encrypted connection to a computer kept by the owner of Education360 in Pakistan. Only the owner's private key can open the database copies.
Captions, transcripts and summaries are made on the institute's own computers in Pakistan.
Email, WhatsApp and Google may handle information in other countries, including the United States.
If you live in the UK or the European Union, these countries may not have the same data protection laws as yours. We protect your information as this policy describes, wherever it is.

How long we keep it

We keep information only as long as we need it.

Your account: while it is open.
People who signed up but never enrolled: 24 months after their last activity. We email you 30 days before we delete it.
Former students and their parents: 36 months after the last class. Money records and certificates are kept as below.
Invoices, payments, payment proofs, refunds, teacher pay and tax records: 6 years after the end of the tax year they belong to, as tax law requires, or longer while a tax case is open.
Class recordings: for as long as the institute runs, unless we agree to delete one.
Captions, transcripts and summaries: with the class or recording they belong to.
Messages: 24 months. Class chat: 12 months.
Support tickets: 36 months after they are closed.
Safeguarding records: until the child concerned is 25 years old, or longer while a case is open.
Teacher applications that were not approved: 12 months.
Copies of teachers' check documents: 12 months after the teacher leaves. The record of which checks were done: 6 years.
Sign-in and security records: 12 months.
Unfinished forms: 30 days.
Free level test answers and Find my teacher answers from visitors: 180 days.
Course alerts: until the course opens, or 12 months.
Consent records: while your account is open, and 6 years after.
Your data download: 7 days.
Backups: the oldest backup copies are about 12 months old. Deleted information can stay in these encrypted copies until they are replaced. We use them only to recover from a disaster.
Google Analytics statistics: around 14 months, in Google Analytics.

We may keep something longer only when we need it for a safeguarding case, a legal claim or the law, and only for that reason.

Your rights and choices

Wherever you live, you can:

See and download your information.
Correct it. You can change most details yourself in your profile.
Delete your account.
Stop course news and other promotional messages, with the link in the message or in your profile.
Say no to analytics, with Cookie choices at the bottom of our website.
Withdraw a consent you gave. This works from then on.
Object to how we use your information, or ask us to limit its use while we look at your request.
Ask about recordings: you can ask us to delete a recording or a part of one, and we will agree where we can. Sometimes we need to keep it, for example if other students still need it to learn, or for a safeguarding case.
Complain: see Questions and complaints below.

We answer requests within 30 days. We may first need to check who you are. We do not charge for this.

Downloading or deleting your data

Download: in your account menu, open Your data & privacy and choose Download my data. You will be asked for your password. We prepare a zip file with your information in spreadsheet files, and an explanation in English and Urdu. You can do this once a day, and the link works for 7 days. Class recordings are not included, because other people are in them; you can watch them in the app. If you need something that is not in the file, write to us.
Delete: in the same place, choose Delete my account. A parent can delete one child's account. We email you a link to confirm. After you confirm, you have 7 days to change your mind. Our office then checks and completes it within 30 days of your confirmation. If something must be settled first, such as an unpaid invoice, a course that is still running, or a safeguarding case, we will tell you.
What deletion does: we remove or anonymise your personal details. Your name is replaced, your contact details and photo are removed, messages you wrote are blanked, your reviews are removed, and your homework answers and files are deleted.
What we keep: money records, for 6 years by law, with your name as it was on each invoice; certificates, which stay valid, but your name is no longer shown on the check page; safeguarding records; group class recordings; and marks, without your name.

How we keep your information safe

Every page uses an encrypted connection (HTTPS).
Passwords are stored scrambled, and we do not allow common, easy-to-guess passwords.
Anyone can turn on two-step sign-in with an authenticator app or a passkey, and keep recovery codes. You can also sign in with a code sent to your email.
We limit repeated sign-in attempts, sign you out after a time without use, and let you sign out of your other devices.
Payment proofs, teachers' check documents and course files are kept in private storage. Our system checks permission every time one is opened.
Staff see only what their job needs. A change to a teacher's payout details needs the password again, and we email the account holder.
We back up every night, keep the database copies encrypted, and test that we can restore them.
Our system checks itself every minute, and we have a written plan for incidents.
If a breach puts you at risk, we will tell you as soon as we can, and we will tell the authorities where the law requires.

No system is perfectly safe. Please keep your password secret, and tell us at once if you think someone else has used your account.

Website visitors and cookies

Our website uses a few small files (cookies) and browser storage so that it works: to keep you signed in, to remember your language and to protect forms.
Google Analytics, when we switch it on, runs only on our public pages, never on the pages you see after signing in. In Pakistan, we count visits without asking first, and you can say no at any time with Cookie choices at the bottom of the page. Outside Pakistan, we ask first, and Google Analytics stores no cookies until you say yes.
Advertising features are always switched off. The statistics contain no names, emails or phone numbers.
If you register for a free class or event, we use your details to send reminders and one follow-up message. Event replays are open to the people who registered, for 30 days.

All the details are in our Cookies and recordings notice.

Changes to this policy

When we change this policy, we keep every version. You can read earlier versions from the link at the top of this page.
An important change gets a new version number and a short note about what changed. We tell you in the app and by email, and ask you to accept it. For 30 days you will see a reminder. After that, we ask you to tick to accept the next time you enrol, book a class or send a payment proof.
A policy change will never lock you out of your invoices, your data or help.

Questions and complaints

Please tell us first. Email Haris@education360.online, use our Contact page, or call or WhatsApp +92 302 8201850. We will reply as soon as we can, and within 30 days.
If you live in the UK, you can complain to the Information Commissioner's Office: ico.org.uk, phone 0303 123 1113.
If you live in the European Union, you can complain to the data protection authority of your country: list of authorities.
Wherever you live, you keep any rights that the law of your country gives you.

Contact us

Name: Muhammad Haris Zuberi
Email: Haris@education360.online
Phone and WhatsApp: +92 302 8201850
Worried about a child's safety? Use Report a concern, or see our Safeguarding policy.