Privacy Policy

Bayt Alalwah is a software platform provided by BAYT ALALWAH LTD, a registered British software company. It brings private schools, institutes, and kindergartens together in one place, alongside a marketplace and AI assistants, and its mobile app lets students, parents, and teachers follow the institutions they belong to.

This Policy covers all of the services we provide, namely:

• The website at the domain baytalalwah.com.
• The institution dashboards through which schools, institutes, and kindergartens manage their profile, their members' data, and their subscription.
• The mobile app intended for students, parents, and teachers.
• The marketplace and the orders created through it.
• The AI features built into the platform.

BAYT ALALWAH LTD acts as the data controller for data relating to user accounts at the platform level. Institutions, however, act as independent controllers responsible for processing their members' data that they manage through the dashboards, as explained in the section on Our Roles in Processing Data.

The platform is provided by BAYT ALALWAH LTD, a British software company incorporated in England and Wales under the Companies Act 2006. Its public registration details are:

Legal name

BAYT ALALWAH LTD

Company number

17434336

Company type

Private company limited by shares

Registered in

England and Wales

Date of incorporation

02/09/2026

Registered office

112 Loughborough House, 2 Honour Gardens, Dagenham, United Kingdom, RM8 2GJ

Wherever they appear in this Policy, the following terms have the meanings set out below:

• The Platform (or we): the Bayt Alalwah software platform and all of its online services, operated by BAYT ALALWAH LTD.
• User (or you): any person who accesses or uses the platform, whether a student, parent, teacher, institution administrator, or store owner.
• Institution: any private school, institute, or kindergarten registered on the platform.
• Student: a member of an institution enrolled for the purpose of study.
• Parent or Guardian: the parent or legal guardian who follows the affairs of one or more students.
• Teacher: a member of an institution's teaching staff.
• Store or Seller: the independent party that offers products for sale through the marketplace.
• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data, such as collection, storage, use, sharing, and deletion.
• Data Controller: the party that determines the purposes and means of processing personal data.
• Data Processor: the party that processes data on behalf of, and under the instructions of, the controller.
• Services: everything the platform makes available through the website, app, dashboards, marketplace, and AI features.

Responsibility for processing data on the platform is divided between two main parties, and our role depends on the type of data:

BAYT ALALWAH LTD as a data controller

BAYT ALALWAH LTD acts as the data controller for user accounts created at the platform level (such as registration and sign-in data, preferences, and nearby-institution discovery), and for marketplace data at the platform level.

BAYT ALALWAH LTD as a data processor

BAYT ALALWAH LTD acts as a data processor when it processes members' data on behalf of, and under the instructions of, the institutions — for example, student data managed by a school, institute, or kindergarten through the dashboard.

Institutions as independent controllers

Each institution is an independent controller of the data it collects about its members and manages through the platform, and it is responsible for ensuring a lawful basis and the required consents for that processing, including with respect to minors.

We collect the information you provide to us directly when you create your account and use the services, including the following:

Account data

• Full name.
• The phone number used for sign-in and verification.
• Date of birth.
• Gender.
• Province or city.
• Account type (student, parent, or teacher).
• Study stage (for students).

Institution data

When an institution registers, we collect the data shown on its public profile, such as the institution's name, address, geographic coordinates, phone numbers, email, social media links, logo, cover image, description, and levels or training fields, in addition to the data of its members that it manages through the dashboard.

Content, orders, and support

We also collect the content you create or upload, product listings and their details for stores, order data, and the messages you send us through the support or contact channels.

When you use the platform, we automatically collect certain technical and usage information needed to operate, protect, and improve the service:

• Device and technical data: device type, operating system, app version, and device identifiers.
• Usage and log data: the pages and screens you visit, the actions you take, access dates and times, and your IP address.
• Approximate location: we use your device's approximate location — and only after you grant permission — to power the nearby-institutions feature.
• Cookies and local storage: to keep your sign-in session and remember your preferences (such as language and theme).

We do not track your precise location in the background, and we do not collect location without your explicit permission. You can withdraw this permission at any time from your device settings.

We may receive information about you from third parties to the extent the service requires, including:

• The messaging and verification-code provider (via WhatsApp or SMS) that helps us send the one-time password (OTP) and verify your phone number.
• Institutions that enrol their students or parents or link them to their accounts.
• The maps provider that enables display of institution locations and directions to them.
• Referrals from other users when they share an institution link or content within the platform.

Many people who use Bayt Alalwah services are students, and some of them are children. This section explains how information about them is handled, and what a parent or guardian can see and do.

Student accounts and use

A child or student may use Bayt Alalwah services in connection with an institution they belong to, or through features made available to them. A minor's account should be created and used with the involvement of a parent or guardian, or through their institution.

Depending on the features their institution uses and the features they use themselves, information relating to a student may include:

• Their name and profile information, such as date of birth, gender, city, and study stage.
• Their institution membership, including grade or stage and class or section.
• Their timetable, and attendance records including check-in and check-out times.
• Homework set for their class.
• Exam and assessment results, and grades recorded by teachers.
• Courses, lessons, and live sessions they are enrolled in or invited to.
• Fees and installments recorded by the institution.
• Messages exchanged with teachers or the institution, where messaging is enabled.
• Other information needed to provide a feature the student uses.

Not every student uses every feature; which of these apply to a particular student depends on their institution and on the features in use.

Parent and guardian access

Where an institution links a parent or guardian to a student, that parent or guardian can see information about the linked child in the parent section of the mobile app. Depending on what the institution uses, this may include:

• Attendance.
• Homework.
• The timetable.
• Grades and exam results.
• Fees, installments, and recorded payments.
• Information and news from the institution.
• Notifications about the child, such as attendance updates, new homework, results, and fee updates.

This access is limited to children who are linked to that parent or guardian through their institution — for example, when the institution invites the parent or guardian to follow specific students and the invitation is accepted. It stops when that link ends, when the parent's membership of the institution ends, or when the child is no longer an active student there. A parent or guardian cannot search for students and cannot see any student who is not linked to them, and the parent section is for viewing only: it does not let a parent act as the student.

Responsibility of parents and guardians

Where a parent or guardian creates, manages, or links an account for a child, or provides information about a child — for example in an admission application sent to an institution, which includes the child's name, date of birth, and gender and, where applicable, the requested grade or program — they should make sure they are authorized to do so and that the information they provide is accurate and kept up to date.

The role of institutions

Schools, kindergartens, institutes, and other organizations that use the software provide and manage much of the student information in Bayt Alalwah. Attendance, homework, grades and results, timetables, and fees shown to a parent or guardian are usually entered by the institution or its staff, and questions about the accuracy of those records are best raised with the institution.

BAYT ALALWAH LTD is not the student's institution and does not teach students. It provides the software and services through which institutions manage this information and make it available to students and their parents or guardians. The institution is responsible for having a lawful basis and any required consents for processing its students' information, as explained in Our Roles in Processing Data.

How we protect children's information

BAYT ALALWAH LTD takes additional care with information relating to children and students. We collect only what the relevant feature needs, limit who can see it to the people the institution relationship allows, and apply appropriate technical and organizational safeguards, described in the Data Security section. We do not sell children's information or use it to build marketing profiles.

Questions about a child's information

A parent or guardian may contact BAYT ALALWAH LTD with privacy questions about their child's information, or to exercise the rights described in Your Rights on their child's behalf, using the details in the Contact Us section. Where the information is held on behalf of an institution, we may refer the request to that institution or work with it to respond.

We use your data for the following legitimate purposes:

• Providing, operating, and maintaining the services.
• Verifying your identity and securing sign-in through the one-time password.
• Enabling institution discovery and the nearby-institutions feature.
• Operating the institution dashboards and managing their subscriptions.
• Operating the marketplace and processing orders.
• Providing the AI features available to you.
• Sending notifications and alerts related to your account and institution.
• Personalizing your experience and improving the platform's content and performance.
• Protecting the platform and its users, and detecting and preventing fraud and misuse.
• Providing support and responding to your enquiries.
• Complying with legal and regulatory obligations.

We process your data on the basis of one or more of the following legal grounds, depending on the context of the processing:

• Performance of a contract: where processing is necessary to provide the services you requested, such as creating the account, managing the subscription, and processing orders.
• Consent: such as enabling location services or using certain AI features.
• Legitimate interests: such as protecting and securing the platform, improving our services, and detecting misuse.
• Legal obligation: where applicable laws require us to carry out certain processing or retain certain data.

Where processing is based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

The platform provides AI features that are tied to a subscription and enabled by the platform administrator for each institution individually.

To provide these features, we process the queries you enter along with the related context needed to produce a useful response, such as the material the request concerns.

AI output remains subject to human oversight, and we do not make decisions with a legal or otherwise significant effect on you based solely on automated processing.

AI output may contain inaccurate or incomplete information, so important information should be verified before relying on it.

We do not use your personal data to train third-party public AI models, and we treat the content of your interaction with these features as confidential.

When you use the marketplace, we process the data needed to complete your order, and we share with the independent seller only what is necessary to fulfil it, such as your name, contact details, and delivery details.

We also process the data of stores and sellers, their product listings, order details, and the related invoices.

Payments on the platform are made entirely offline; we do not provide an online payment gateway and we do not collect or store bank card numbers or bank-account details.

Disputes may arise from orders between the buyer and seller, in which case we process the data needed to help resolve them within the limits of our role as an intermediary.

We do not sell your personal data. We limit its sharing to the following cases:

• With the institution you belong to, to the extent the service requires.
• With a parent or guardian whom your institution has linked to you, as described in Children, Students and Parents/Guardians.
• With service providers and sub-processors who help us operate the platform under contracts that bind them to confidentiality.
• With independent sellers, to the extent necessary to fulfil your marketplace orders.
• With other users, within what the service is designed to make available, such as public institution profiles.
• With competent bodies or authorities where a legal obligation or a judicial order requires it.
• In connection with a merger, acquisition, or transfer of business, while keeping the data subject to this Policy.

We rely on trusted service providers who process data on our behalf and under our instructions, and under contractual obligations of confidentiality and data protection, including:

• Supabase: to provide authentication, database, storage, and back-end functions, with isolation of institution data through Row Level Security.
• The messaging and verification-code provider via WhatsApp or SMS.
• The map tile provider (OpenStreetMap) to display locations.
• Hosting providers and content delivery networks.
• Optional analytics and push-notification services where needed.

We take care to ensure these providers adhere to appropriate protection standards and do not use your data for their own purposes.

We use essential cookies and local storage to operate the service properly — specifically to keep your sign-in session and maintain its security, and to remember your preferences such as language and theme.

You can control cookies from your browser settings, but disabling essential cookies may prevent some platform functions from working.

We retain your data for as long as your account remains active, and to the extent necessary to fulfil the purposes described in this Policy or to meet our legal obligations.

Data we process on behalf of an institution is retained according to that institution's instructions and the duration of its relationship with its members.

When your account is deleted, we delete your data or anonymize it as described in "Deleting Your Account" below, subject to any minimum legal retention periods.

You can ask for your account to be deleted at any time, from your profile page in the Bayt Alalwah app.

• When you ask, you are signed out on every device, and your account can no longer be used.
• The account then enters a 90-day deletion period. If you sign in again during those 90 days, the request is cancelled automatically and your account becomes active again, as it was.
• Once the 90 days are over, the account is permanently deleted and can no longer be restored. Your personal account information — such as your profile, sign-in details, registered devices, carts, notifications, reviews and ratings, and the admission applications you submitted — is deleted, and you are removed from the institutions and relationships you belonged to.
• Some records are shared with other people or institutions. Where they must remain for the integrity of those records or for legitimate record-keeping, they are kept without your identity: a store keeps its orders, and an institution keeps its fee, attendance, exam and grade records, with your name and contact details removed or replaced; messages you sent in a conversation that continues for the other participant remain, without your name.
• We may also keep limited records that do not identify you, where this is necessary for security, fraud prevention, the integrity of the platform, or legitimate system or business record requirements.

An account that owns an institution or a store cannot be deleted from the app while it owns it; its ownership must first be transferred, or the institution closed, through the platform.

Copies of deleted data may remain in backups for a limited period before being removed in the course of our routine deletion cycles.

We take reasonable technical and organizational measures to protect your data, the most notable of which are:

• Isolating institution data in a multi-tenant environment through Row Level Security.
• Encrypting data in transit through the secure transport protocol (TLS).
• Access controls and the principle of least privilege.
• Authentication through a one-time password instead of relying on static passwords.

Despite these measures, no method of electronic transmission or storage is 100% secure, so we cannot guarantee absolute security. You are responsible for protecting your device, your phone number, and the verification codes sent to you.

In the event of a data breach that may affect your rights, we take the necessary steps and notify the relevant authorities and users as required by applicable laws.

Your data may be processed or stored on servers belonging to cloud service providers located outside the country where you live.

When we transfer your data outside your country, we take care to subject it to appropriate protection safeguards through contractual commitments with the service providers.

By using the platform, you consent to your data being processed and transferred in this way, within the limits permitted by applicable laws.

You have a set of rights with respect to your personal data, including:

• Access to your data and obtaining a copy of it.
• Correcting or updating inaccurate data.
• Deleting your data in the cases permitted by law.
• Restricting the processing of your data or objecting to it.
• Porting your data to another party where technically feasible.
• Withdrawing your consent where processing is based on it.
• Lodging a complaint about the processing of your data.

To exercise any of these rights, please contact us using the contact details below. We may request proof of your identity before acting on the request, and we aim to respond within a reasonable period.

If your data is held by us on behalf of an institution, your request may need to be directed to that institution as the controller of that data.

Each institution, as an independent controller of its members' data, bears a number of responsibilities when it uses the platform:

• Ensuring a lawful basis and the required consents to process its members' data, including the consents of the parents of minors.
• Ensuring the accuracy of the data it enters and keeping it up to date.
• Using the data only for legitimate purposes connected with the services it provides to its members.
• Complying with applicable laws and regulations.
• Respecting its members' rights and responding to their requests regarding their data.

The platform may contain links to external websites or services, such as institution and store links, map services, and social media accounts.

We do not control the privacy practices of these external parties and are not responsible for them; we recommend reviewing their privacy policies before providing them with any data.

We may update this Policy from time to time to keep pace with the evolution of our services or legal requirements.

When we make material changes, we will notify you through the platform, the app, or email a suitable time before they take effect.

Your continued use of the platform after the changes take effect constitutes your acceptance of them. The date of the last update is indicated at the top of this page.

If you have any question, comment, or complaint regarding this Policy or our processing of your data, you can contact us via:

• Email: info@baytalalwah.com
• Support: support@baytalalwah.com

A parent or guardian may use the same channels for privacy questions about their child's information.

We will do our best to respond to and handle your request within a reasonable period.