Privacy Policy

Introduction

Minhaj Kids, operated by GainWells Global Sdn. Bhd. (“we,” “our,” or “us”), is committed to protecting the personal information of every family who places trust in us. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you hold over your data.

By accessing or using our website and services, you agree to the practices described in this policy. If you do not agree, please do not use our platform.

Who We Are

Minhaj Kids is an online Islamic education platform offering live, private one-to-one classes in Quran, Arabic Language, and Islamic Studies for Muslim children aged 5 to 14. Minhaj is owned and operated by GainWells Global Sdn. Bhd., a company registered in Malaysia. GainWells Global Sdn. Bhd. is the data controller responsible for your personal information.

For any data-related queries, please contact us at: info@minhaj.kids

Information We Collect

We collect personal information in the following categories:

Account and Identity Information

• Parent or guardian full name
• Email address and password
• Phone number
• Child's name, age, and learning level

Payment Information

• Billing name and address
• Payment card details (processed securely through our third-party payment provider; we do not store full card numbers on our servers)

Technical and Usage Data

• IP address and browser type
• Pages visited and session duration
• Device type and operating system
• Cookies and similar tracking technologies (see Section 7)

Communications

• Messages sent to our support team
• Feedback, reviews, or survey responses you provide

How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your account
• To enrol your child in classes and deliver our educational services
• To process payments and send receipts
• To communicate with you about your account, bookings, and class updates
• To send service-related notifications (class reminders, schedule changes)
• To respond to your enquiries and provide customer support
• To improve our platform, content, and user experience
• To comply with our legal and regulatory obligations

We do not use your personal information to make automated decisions that significantly affect you.

Legal Basis for Processing (UK and EU Users)

For users in the United Kingdom and European Economic Area, we process your personal data on the following legal grounds:

• Contractual necessity — to deliver the education services you have signed up for
• Legitimate interests — to improve our platform and communicate relevant updates
• Legal obligation — to comply with applicable laws including safeguarding requirements
• Consent — where you have explicitly agreed, such as for marketing emails

You may withdraw consent at any time by contacting us or updating your communication preferences.

Payment Information

All payment transactions are processed through a certified third-party payment processor. We do not store your full credit or debit card number on our servers. Your payment data is encrypted and handled in accordance with PCI-DSS standards.

Your billing address and transaction history are retained for tax and legal compliance purposes.

Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve our website. These include:

• Essential Cookies — required for the platform to function (login sessions, account access). These cannot be disabled.
• Analytics Cookies — help us understand how visitors use our website so we can improve it. We use Microsoft Clarity, which records clicks, scrolling and page movements as heatmaps and session replays, including in the family portal and the teacher area; it hides what you type into forms, links a session to your account or to a form you sent us only through a random code (never your name or email), so we can help if you report a problem, and it never runs in our office administration pages or our apps. Where the law asks us to (the EEA, the UK and Switzerland), these are only set with your consent.
• Preference Cookies — remember your settings and preferences across visits.

You can manage or withdraw cookie consent at any time through the cookie settings banner on our website or through your browser settings. Disabling non-essential cookies will not prevent you from using our core services.

How We Share Your Information

We do not sell your personal information. We share your data only in the following circumstances:

• Service Providers — trusted third parties who assist us in operating the platform (payment processors, video conferencing tools, email delivery services). These providers are contractually bound to handle your data securely and only for the purposes we specify.
• Tutors — qualified tutors on our platform will have access to your child's name, enrolled subjects, and learning level to deliver classes effectively.
• Legal Requirements — we may disclose information where required by law, court order, or regulatory authority, or where necessary to protect the safety of a child in line with our safeguarding obligations.
• Business Transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before any such transfer takes effect.

Messages You Send Us on WhatsApp, Instagram and Messenger

Many families reach us on WhatsApp, Instagram Direct or Facebook Messenger rather than by email. When you message us on any of these, we receive and store the content of your messages, any photos or files you send, the time they were sent, and the identifier the platform gives us for your account — your WhatsApp phone number, or the account-scoped ID Instagram and Messenger provide. Where the platform makes it available, we also receive the name or username shown on your profile.

We use this only to answer you and to continue that conversation. Messages are stored alongside your family's existing record so that whoever replies can see your trial booking or your child's enrolment while they answer, instead of asking you to repeat yourself. We do not use the contents of your messages for advertising, we do not build profiles from them, and we do not sell, rent or transfer them to anyone.

These conversations are also processed by Meta Platforms, Inc., who operate WhatsApp, Instagram and Messenger and deliver the messages to us. Their handling of your data is governed by their own privacy policy, not this one.

You can ask us to delete your message history at any time, and we will do so within 30 days. Write to info@minhaj.kids, or follow the instructions at minhaj.kids/data-deletion. You can also stop us contacting you on a channel at any time by telling us so in that conversation.

Our Mobile Apps

The Minhaj Kids app for families and the Minhaj Kids Staff app for our teachers and team show the same pages as our website, so everything in this policy applies to them too. The apps also use some features of your phone. Each one is used only for the purpose described here:

• Signing in — you sign in with a one-time code sent to your email address. The app does not ask for or keep a password.
• Notifications — if you allow notifications, your phone gives us a notification token, which we store with the phone's type, language and app version. We use it only to send class reminders, homework and messages about your child. The token is passed to Google Firebase Cloud Messaging (and, on iPhone, Apple's notification service) to deliver them. We delete it when you sign out, or when the phone tells us it is no longer valid.
• Microphone — used only while your child records a recitation for homework. The recording is saved with that homework so the teacher can listen and give feedback.
• Camera and photos — used only when you choose to take or attach a photo, for example of written homework. The photo is saved with that homework.
• Face ID or fingerprint — if you turn on the app lock, your phone checks your face or fingerprint itself. We never receive or store biometric data.
• Saved on the phone — the app keeps your family's upcoming lessons on the phone so they can be shown without an internet connection, and keeps the child mode PIN on the phone in scrambled (hashed) form. Both stay on the phone and the saved lessons are removed when you sign out.
• No advertising or tracking — the advertising and analytics tags used on our website are switched off inside the apps. The apps do not show advertising, do not track you across other companies' apps or websites, and your data is never sold.

You can delete your account from inside the family app (menu, then Delete my account). The request reaches our team, who confirm it with you and delete your data as described in the Data Retention section. You can change the app's permissions at any time in your phone's settings.

Children's Privacy and Safeguarding

We take our duty of care to children with the utmost seriousness. Our platform is designed for children aged 5 to 14, and all accounts are managed by a parent or guardian.

• We do not collect personal information directly from children without verified parental consent.
• All tutors undergo background checks and safeguarding training before joining our platform.
• Live classes are private one-to-one sessions, and every one takes place inside the monitored platform classroom.
• We do not display advertising to children or share their data for marketing purposes.

If you believe your child's information has been collected without your knowledge, please contact us immediately at info@minhaj.kids.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. When you close your account:

• Account data is deleted within 90 days, unless we are required to retain it by law.
• Payment transaction records are retained for 7 years for tax and legal compliance.
• Any data related to safeguarding incidents may be retained for longer periods as required by applicable law.

Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. These include:

• Encrypted data transmission (SSL/TLS)
• Secure password storage using industry-standard hashing
• Access controls limiting data to authorised personnel only
• Regular security assessments of our platform

No online service can guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant authorities in accordance with applicable law.

Your Rights

Depending on your country of residence, you may have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete information
• Delete your personal data (subject to legal retention obligations)
• Restrict or object to certain types of processing
• Data portability — receive your data in a structured, commonly used format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us at info@minhaj.kids. We will respond within 30 days.

If you are located in the UK, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. For users in the EU, you may contact your local data protection authority.

International Data Transfers

Minhaj Kids serves families across multiple countries. If your data is transferred outside your country of residence, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the relevant regulatory authority.

Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently.

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email or by a prominent notice on our website, and update the effective date at the top of this document.

Your continued use of our services after any update constitutes your acceptance of the revised policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out to us:

Minhaj Kids
Email: info@minhaj.kids
Website: www.minhaj.kids