Privacy policy: Misbah School System

1. Who we are

HomeShopper AI Inc.(“we”), 9655 49 Ave NW, Edmonton, Alberta T6E 5Z5, Canada, provides Misbah School System: a school management system (applications, attendance, homework, points, certificates, staff records, live classes and Qur’an circles) that we host and run for schools under a written agreement. It includes connecting a school’s own WhatsApp number to Meta’s WhatsApp Business Platform, so the system can send the school’s notices.

This policy covers that service, including our Meta app “Misbah School System”.

2. Our role

Each school decides what data goes into its system and why, and is responsible for it. We process that data only on the school’s documented instructions, under our agreement with the school.

Parents, students and staff should normally send questions or requests about their own data to their school. You can also write to us: we help the school answer, and we deal directly with requests about data we hold for our own purposes, such as our correspondence with you.

3. What we process

What a school’s system holds depends on the features the school uses. It can include, for applicants, students (including children), parents or guardians, and staff:

• Identity and contact details: names, dates of birth, nationality, national ID, residence permit (iqama) or passport numbers, phone numbers, email addresses and family or guardian relationships.
• School records:applications, attendance, marks, evaluations, points and rewards, homework, certificates, and staff attendance and payroll records. When staff check in, the system records how far they are from the school, using their device’s location at that moment.
• Files that school users upload: documents, images of identity documents, photos, audio and video.
• Sign-in and device data: usernames or email addresses, sign-in records, push notification identifiers, and technical logs including IP addresses.
• The WhatsApp connection.When a school connects its number through Meta’s sign-up, Meta gives us the IDs of the school’s business portfolio, WhatsApp business account and phone number, and an access token for sending messages on the school’s behalf. We never see the password of anyone’s Facebook account.
• Messages:the phone numbers the school’s notices are sent to, the notice text (from message templates approved by Meta), delivery and read statuses from Meta, and replies people send to the number the notices come from. We use a reply only to send one automatic answer pointing to the school’s main contact number and to act on requests to stop notices. Reply content is deleted within 7 days; we keep only the record needed to honour a stop request, for as long as it applies.
• The school’s own WhatsApp number.Notices are normally sent from a separate number used only for notices, so we have no access to the contacts or conversations in the school’s own WhatsApp app. Only if a school separately chooses to connect the same number it uses in the WhatsApp Business app does Meta share with us a copy of its WhatsApp contacts, its chat history from up to six months back (only if the school allows this in the app), and copies of messages it sends from the app; we would use these only to show the school its WhatsApp conversations in the system.

4. How we use and share it

Only to host, run, back up, support and fix the system for the school, and to send the school’s notices. We do not sell it, use it for advertising, or use it to train AI models.

The school’s own users see data according to the roles the school gives them. Beyond that, we share it only with the providers below, or where the law requires us to.

5. Providers we use

• DigitalOcean: hosting, database and file storage, in Frankfurt, Germany. Our own server for live classes and circle calls also runs there; calls are not recorded.
• Google Cloud Storage: an encrypted backup copy, in Frankfurt, Germany.
• Google Firebase: sign-in (processed in the United States) and push notifications to phones (Google’s global network).
• Meta (WhatsApp Business Platform): delivers the school’s WhatsApp messages. The school has its own agreement with Meta for its WhatsApp account. If a school connects through 360dialog instead, 360dialog also handles its messages, under the school’s own agreement with 360dialog.

Our authorised staff may access the system remotely from Saudi Arabia, the United Kingdom and Canada, only to provide the service. This means data is processed outside the school’s country. Our agreement with each school sets out how such transfers are handled.

6. Security

Connections to the system are encrypted. Backups are encrypted before they leave the server. Each school’s data is kept separate from every other school’s at the database level. School users get access according to their roles, and our staff’s access is limited to authorised service purposes.

7. How long we keep it

For as long as the school’s agreement runs. During that time, operational logs are kept for no more than 90 days.

When the agreement ends, we give the school a copy of its data and then delete it from our systems, including sign-in accounts. Copies in the rolling backups we manage expire within 35 days after that. We also ask our providers to delete the copies they hold; some keep deleted data in their own systems for longer (Google, for example, may take up to 180 days to remove Firebase sign-in data from its systems).

If a school disconnects its WhatsApp number, we stop sending from it and delete the access token Meta gave us. The school can also ask us to delete the WhatsApp contacts and messages we hold for it.

8. Deleting data

See how to have data deleted.

9. Changes

We update this page when our practices change. The date at the top shows the latest version.

10. Contact

HomeShopper AI Inc., 9655 49 Ave NW, Edmonton, Alberta T6E 5Z5, Canada. hello@homeshopper.ai