Skip to content

Privacy notice

Last updated: 6 November 2026

1. Who we are

Taallum is an educational service that helps you learn Qur’anic Arabic and Arabic grammar. This Privacy Notice explains how we process your personal data when you use the Taallum mobile app and the taallum.online website.

Data controller: Techdecision Ltd

Registered address: 17 Green Lanes, London, N16 9BS, United Kingdom

Privacy contact: info@techdecision.co.uk

2. What data we process, why we process it and our lawful bases

We process your personal data only to the extent necessary to provide the Taallum service, manage your account, support learning activities and keep the service secure.

  • Account and authentication information: Your name, email address, account details and sign-in activity are processed to create and manage your account, verify your identity and provide access to the service. Lawful basis: performance of a contract (UK GDPR Article 6(1)(b)).
  • Lessons and learning progress: Completed lessons, your answers, questions answered incorrectly, learning progress and revision activity are processed to provide the learning service and allow you to track your progress. Lawful basis: performance of a contract (Article 6(1)(b)).
  • Placement test answers: Your answers to the placement test are processed to assess your level and recommend a suitable starting lesson. Lawful basis: performance of a contract (Article 6(1)(b)).
  • Guest usage information: When you use the app without creating an account, an anonymous record of your introductory questions and completed learning days may be stored on our servers. This information is processed to support the guest learning experience and track usage. Lawful basis: provision of the service you request and, where applicable, steps taken before entering into a contract (Article 6(1)(b)).
  • Class and teacher-related learning information: Information such as questions you answered incorrectly, exercises generated for you, whether those exercises were useful, live lesson attendance and other class or learning progress information is processed to support teaching activities and allow teachers to monitor your learning. Lawful basis: performance of a contract (Article 6(1)(b)).
  • Teachers’ lesson documents: If you are a teacher, the documents you upload (for example PDF or Word notes) and the lessons you write or draft are stored so that you can build lessons for your classes. If you ask Tutor to draft a lesson from a document, the document’s text is sent to Anthropic to generate the draft (see Section 3a). Lawful basis: performance of a contract (Article 6(1)(b)).
  • Information stored locally on your device: Revision cards, your position within a lesson, preferences, session details (your name and email address), class information, and the fact that you accepted the privacy notice and the terms of use and confirmed that you are 18 or over, are stored on your device to support the app’s functions, offline use and continuity of your learning experience. Lawful basis: performance of a contract (Article 6(1)(b)).
  • Time zone information: Your device time zone is stored on our servers so that your learning day and daily learning activities can be calculated and displayed according to your local time. Lawful basis: performance of a contract (Article 6(1)(b)).
  • IP address and sign-in security records: Your IP address, sign-in attempts and related security records are processed to protect your account against unauthorised access, misuse and security threats. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is protecting Taallum accounts and systems and detecting and preventing unauthorised access.
  • Technical error reports: Technical error information from the app or website is processed to identify problems and keep the service functioning properly. Only error reports are sent through Sentry; performance monitoring is not used. Email addresses are masked in error reports. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is maintaining service reliability and resolving technical errors.
  • Study reminder: If you turn it on on the Notifications page, you receive an email reminder at the hour you choose (07:00–21:00, in your own time zone) when you have not completed that day's lesson. For this we process your reminder preference, the hour you choose and your time zone; the time zone is kept only while the reminder is on. The reminder stops after three days in a row without a completed lesson; one "your place is kept" email is then sent on day 7 and one on day 30, and nothing more until you complete a lesson or turn the reminder on again. Lawful basis: consent (Article 6(1)(a)). The reminder is off unless you turn it on; you can withdraw your consent at any time on the Notifications page or through the link in every email. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
  • Reminder consent records: When you turn the reminder on or off, we record the date and time and the version of the consent wording in force, linked to your account. This record shows whether consent was given or withdrawn. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is being able to show when your consent to reminders was given or withdrawn.
  • Reminder send log: For each reminder sent we record your account number, which email was sent, the date, its outcome (sent, delivered, failed, bounced or marked as spam) and the email provider's message id. Your email address and the content of the email are not kept in this log. The log ensures that the same reminder is not sent twice, that you receive at most one email a day, and that delivery problems can be investigated. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is sending the reminder you asked for correctly, once and within limits.
  • Delivery reports and suppressed addresses: Our email provider, Resend, tells us whether a reminder was delivered, permanently bounced or marked as spam. No reminder is sent to an address that bounced permanently while that address remains on your account; for this we keep a one-way hash of the address, not the address itself. If you mark a reminder as spam, the reminder is turned off and your consent is treated as withdrawn. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is not sending email that does not arrive or is not wanted.
  • Reminder unsubscribe token: When email reminders are enabled, we generate and store a random, unique token for each student. This token is included in the reminder email's unsubscribe link so that you can disable reminders without signing in. The token contains no name, email address or other personal information, and it is deleted when reminders are disabled. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is letting you stop reminders easily.
  • Tutor question usage counter: An hourly usage counter linked to your account number is maintained to limit the number of questions and prevent misuse of the AI service. This counter is deleted after 30 days. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is ensuring fair use of the AI service and protecting system security.
  • Reported Tutor answers: If you use the “Report this answer” feature, the relevant question and answer are stored so that we can investigate the report and review potentially incorrect or inappropriate AI responses. Only authorised administrators can access this information; teachers cannot. It is deleted 90 days after the investigation is closed. Lawful basis: legitimate interests (Article 6(1)(f)). Our legitimate interest is reviewing reported answers, identifying errors and improving the quality and safety of the service.
  • Explicit consent records: When you give or withdraw consent for the use of Tutor, we record the date and time of the action and the version of the consent text you accepted, linked to your account. This record helps us demonstrate whether consent was given or withdrawn and meet our legal obligations. Lawful basis: compliance with a legal obligation (Article 6(1)(c)); processing of relevant special-category data is separately based on explicit consent (Article 9(2)(a)). The consent record is deleted when your account is deleted.
  • Website cookies: Session cookies and a language preference cookie are used to provide the website’s session and language functions. Necessary session cookies support the online service you have requested and keep you signed in. The language cookie remembers your chosen language so that we can display the service in your preferred language. See Section 8 for details.

3. Tutor (AI learning assistant)

The AI learning assistant in Taallum is called Tutor in English. It is designed to answer questions about Arabic grammar and language learning only.

Every question you send to Tutor is transmitted to Anthropic to generate an AI response. We do not apply a pre-filter to detect or remove religious terms or content before questions are sent to Anthropic. Tutor determines at the response-generation stage whether a question is within its permitted scope. It may decline to answer questions outside that scope and may suggest that you consult your teacher. This message is shown only to you; it is not forwarded to your teacher.

Taallum does not routinely store your Tutor questions or Tutor’s answers on its own servers. Your teachers cannot see your Tutor questions or answers. If you report an answer, the relevant question and answer are stored only for review and can be accessed only by authorised administrators.

Tutor’s responses may be incorrect or incomplete. They are for educational purposes and should not be treated as religious rulings, fatwas or tafsir advice.

The lawful basis for providing Tutor is performance of the service contract (Article 6(1)(b)). If your question contains information that may reveal your religious beliefs or religious practices, processing that information is separately based on your explicit consent (Article 9(2)(a)).

This explicit consent is required for Tutor to process the relevant special-category data. If you do not give consent or withdraw it, you cannot use Tutor, and your questions are not sent to Anthropic. Other Taallum learning features are not affected.

3a. Lesson drafts from teachers’ documents

If you are a teacher, you can ask Tutor to draft a lesson from a document you uploaded. When you do, Taallum reads the text of that document and sends it to Anthropic, which returns a draft lesson. Only the document’s text is sent: not your name, your email address or your account details.

Taallum does not keep the text that was sent or Anthropic’s reply. It saves only the draft lesson in your account. Every part of the draft is marked as proposed until you accept or correct it, and no student sees the lesson until you publish it. We record that a draft was made, with the date and hour, the model used and its size, but not who asked for it or what the document said.

Please do not include other people’s personal data in documents you upload, such as students’ names, contact details or results. If a document contains such data, it is sent to Anthropic with the rest of the text when you ask for a draft.

Drafts may be incorrect or incomplete. You are responsible for checking each part before you publish the lesson.

Lawful basis: performance of a contract (Article 6(1)(b)) for providing the drafting service you ask for. This basis covers your use of the service; it does not cover other people’s personal data placed in a document, which you should not upload (see above). Drafting is optional; you can always write lessons yourself.

4. Special-category personal data and explicit consent

Depending on the information they contain, questions you send to Tutor may reveal information about your religious beliefs or religious practices. Such information may be special-category personal data under the UK GDPR.

Because questions are not filtered for religious content before being sent to Anthropic, questions that may contain this type of information are also transmitted to Anthropic to generate an AI response.

We rely on your explicit consent to process this information (UK GDPR Article 9(2)(a)). You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before it was withdrawn.

5. Information we do not collect

Taallum is not designed to access or collect:

  • Microphone input or voice recordings.
  • GPS location or precise address.
  • Your contacts.
  • Your photos.
  • Advertising identifiers.

When you first open the app and when creating an account, you are asked to confirm that you are aged 18 or over. We do not collect your date of birth for this confirmation.

6. Who we share your data with

We share personal data only with service providers where necessary to operate the service and for the limited purposes described below:

  • Supabase: Storage of account and learning data and authentication. The contracting entity is Supabase Pte. Ltd. The database is hosted in the EU; access from Singapore and the United States may be possible.
  • Resend: Sending account verification, password reset, invitation and study reminder emails, and telling us whether a reminder was delivered, bounced or marked as spam. Resend processes and stores email-related personal data, including email addresses, message content and delivery logs, in the United States, and keeps it on its side for 30 days.
  • Hostinger: Hosting the Taallum website. IP addresses may be recorded in website server logs.
  • Anthropic: Generating AI responses to Tutor questions, and drafting lessons from documents teachers choose to send for that purpose. The contracting entity is Anthropic Ireland, Limited. Data may be stored in the United States, and the model may operate in different locations around the world.
  • Sentry: Identifying technical errors in the app and website. The installation is in the EU; only error reports are sent, performance monitoring is not used, and email addresses are masked in error reports.
  • Apple and Google: Distribution of the app through the relevant app stores and operation of app-store services.
  • Teachers: Student information necessary for teaching and class activities, such as questions you answered incorrectly, exercises generated for you, whether those exercises were useful, live lesson attendance and other learning progress or class information. The teacher of a class whose live lessons you join as a guest sees only your name and your attendance at their live lessons, never your learning progress or mistakes.

Teachers cannot see your Tutor questions or Tutor’s answers. They also cannot access AI answers that you report.

7. International data transfers

Some of our service providers may access your data from, or store it outside, the United Kingdom or the European Economic Area.

  • Supabase: The database is hosted in the EU. However, access from Singapore and the United States may be possible. Appropriate safeguards for international access or transfers, such as the UK International Data Transfer Addendum (UK Addendum) in the Supabase contractual arrangements, are applied.
  • Resend: Resend processes and stores email-related personal data in the United States, including email addresses, message content and delivery logs. International transfers are safeguarded under the Standard Contractual Clauses in Resend's Data Processing Agreement and its participation in the EU-U.S. Data Privacy Framework, including the UK Extension.
  • Anthropic: Although the contracting entity is Anthropic Ireland, Limited, data may be stored in the United States and the model may operate in different locations around the world. This applies to Tutor questions and to the text of documents teachers send for lesson drafts. Your data may therefore be transferred to, or accessed from, locations outside the UK/EEA. Where a restricted international transfer is made, we rely on appropriate safeguards under Article 46 of the UK GDPR. These include the European Commission's Standard Contractual Clauses (SCCs), supplemented by the UK International Data Transfer Addendum, as incorporated into Anthropic's Data Processing Addendum, where applicable. We assess international transfers and implement any additional safeguards required to ensure that personal data receives an appropriate level of protection.

You can contact us for further information about international transfers or to request a copy of the safeguards used.

8. Cookies

The Taallum website uses the following cookies:

  • Session cookies (sb-…): These keep your signed-in session active and allow you to access your account. They are necessary for session and authentication functions.
  • Language cookie (NEXT_LOCALE): This remembers your selected interface language. It is stored for one year.

These cookies are not used for advertising tracking or advertising profiling.

9. How long we keep your data

We keep personal data only for as long as necessary for the relevant purpose:

  • Account and learning progress: Until you delete your account.
  • Backups: 7 days.
  • Verification code and link records: A code is valid for 15 minutes; expired codes or links are deleted 24 hours later.
  • Sign-in attempts (successful and failed, with their IP address) and request counters: 30 days.
  • Session records: The IP address and browser or app details of the devices you are signed in on are kept until the session ends or your account is deleted.
  • Tutor hourly question counter: Linked to your account number and deleted after 30 days.
  • Administrator activity logs: 2 years. Personal information such as names, email addresses and free-text content is minimised in these logs wherever possible.
  • Guest use without an account: If no lesson has been completed, the guest record created when you start using the app without an account is deleted 30 days after the date it was created.
  • Guest record with completed lessons: If at least one lesson has been completed in a guest record, the record is deleted 12 months after the later of the last lesson completion date or the last sign-in date.
  • Tutor questions and answers, and document text sent for lesson drafts: Not routinely stored on Taallum servers. Anthropic’s standard retention period may be up to 30 days. Anthropic may retain conversations flagged as violating its usage policies for up to 2 years. If a Zero Data Retention (ZDR) arrangement applies, retention is subject to the relevant contractual terms and exceptions.
  • Teachers’ uploaded documents and lessons: Until you delete the document on the My lessons page, or your teacher account is deleted. A lesson made from a document stays until you delete the lesson.
  • Reported Tutor answers: 90 days after the investigation is closed.
  • Explicit consent records: Until your account is deleted; these records are also deleted when your account is deleted.
  • Reminder preference and reminder consent records: Until your account is deleted; your time zone is kept only while the reminder is on.
  • Reminder send log: Each record is deleted 90 days after it was created, or when your account is deleted.
  • Identifiers of delivery reports: 30 days. These records are not linked to any person; they are kept so that the same report is not processed twice.
  • Suppressed address records (bounce or spam complaint): Until your account is deleted.
  • Email records at Resend: 30 days under Resend's own retention; these records may remain with Resend until that period ends, even after your account is deleted.

If you delete your account and register again with the same email address, your new account starts fresh: the previous account's reminder preferences and suppression records do not apply, the reminder is off, and your consent is asked for again.

10. Automated decisions and provision of the service

No decision that produces legal or similarly significant effects about you is made solely by automated means. The placement test only recommends a suitable starting lesson.

Taallum needs account and learning progress data to provide your learning experience. Without account and progress data, the app cannot provide lessons.

11. Your data protection rights

Under the UK GDPR, and subject to applicable conditions, you have the right to:

  • Access your personal data.
  • Request correction of inaccurate or incomplete data.
  • Request erasure of your data.
  • Request restriction of processing.
  • Object to processing based on legitimate interests.
  • Receive your data in a portable format where applicable.
  • Withdraw your explicit consent at any time.

In the app:

  • To download your data, go to Profile → Download my data.
  • To delete your account, go to Profile → Delete account.
  • To stop study reminders, use the Notifications page on the website or the stop link in any reminder email. The link does not require you to sign in; the reminder stops at once.

To object to the processing of the reminder send log, write to info@techdecision.co.uk. Where your objection is upheld, no new records are created; existing records are reviewed and erased unless there are compelling legitimate grounds to keep them. Where keeping them is justified, access and use are restricted to what is strictly necessary and the reasons are documented.

For other requests or questions, you can contact us at info@techdecision.co.uk.

You also have the right to complain to the UK data protection authority, the Information Commissioner’s Office (ICO): https://ico.org.uk/

12. Age restriction

Taallum is intended only for people aged 18 or over. You must confirm that you are at least 18 when you first open the app and when creating an account. If you tell the app that you are under 18 and confirm, your guest record and the progress on your phone are deleted and you may not use the app. If your phone is signed in to an account, write to us to have the account deleted. We do not accept accounts for people under 18 through parent accounts or parental consent.

If you believe that an existing account belongs to someone under 18, please contact us. We will review the account and take appropriate action.

13. Changes to this notice

We may update this Privacy Notice from time to time. The latest version will be published on our website, with its updated revision date.

Where changes are material, we will tell you in the app by asking you to review and accept the updated Privacy Notice.

Where required, we will ask you to review and acknowledge the updated Privacy Notice in the acceptance step shown the next time you sign in. Where a change requires fresh consent, we will obtain that consent separately; acknowledging the updated Privacy Notice will not automatically constitute consent to new processing activities.