Privacy Policy

Borhan is multi-tenant: every centre, academy or school operates in a completely separate workspace. The centre your child is enrolled with is the data controller — it decides what is recorded and which of its staff can see it.

Borhan acts as a data processor on the centre's behalf: we run the software, store the data and protect it, but we do not use it for our own purposes, we do not sell it, and we do not share it with advertisers. A request to delete or correct your data goes to the centre first.

Every account holds:

• Email address — the primary sign-in identifier
• Name and phone number — where the centre has entered them
• Password, stored as an argon2id hash and not recoverable as text
• Role (student, parent, instructor, secretary, administrator) and the organisation it belongs to

For students, additionally:

• Date of birth and a guardian's phone number — where the centre has entered them
• Attendance record: the date, time and status of every session
• Lesson progress and assessment scores
• Invoices and payments: amounts, dates and payment method
• A random attendance QR code — not derived from any personal data, and rotatable

A large share of Borhan's users are under 18. Student accounts are created by the centre, not by self-registration, and the centre is responsible for obtaining guardian consent before entering any minor's data.

There is no advertising, no behavioural tracking and no marketing profile for any user, adult or minor.

When a student checks in, a notification may be sent to the guardian's number by WhatsApp or SMS. The message contains the student's name, the group name and the check-in time — no financial data and no grades.

These notifications pass through a third-party provider (WhatsApp, from Meta, or an SMS provider the centre chooses) and are also subject to that provider's privacy policy.

Borhan never stores card details. Payment happens entirely on the payment provider's own pages (Paymob, Fawry, Stripe, PayPal). What returns to us is the outcome of the transaction and its reference, plus the last four digits of the card or the wallet number so a transaction can be identified during review.

• Student: their own data only
• Parent: only the data of children linked to their account
• Instructor: the students in their groups, without financial data
• Secretary: attendance and payments inside the centre, without editing curricula
• Centre administration: everything in their own centre, and nothing outside it

Isolation between centres is enforced at the level of every database query, not in the interface — one centre cannot see another's data even if it tries.

• Passwords are hashed with argon2id and cannot be recovered
• All traffic is encrypted over HTTPS
• Lesson videos use signed links tied to the user that expire within minutes
• Session tokens are short-lived and revoked immediately when an account is disabled
• Payment card data never reaches our servers at all

Data is retained for as long as the centre subscribes to the platform. Financial records (invoices and transactions) are retained even after a student account is deleted, because they are required for accounting audit — but they are separated from personal data.

If a centre ends its subscription, its data is permanently deleted after a grace period agreed in the contract.

You have the right to request a copy of your data, to correct it, or to have it deleted. The request goes to the administration of the centre your account belongs to, as the data controller. Where the centre needs technical help to carry it out, we do so on their behalf.

For any question about privacy: privacy@borhan.app