Madaris trust Hidayah with children's records, parents' details and fee payments. This page sets out plainly who is responsible for that data, where it is kept, who can see it and how it is protected. Our privacy policy has the full legal detail.
Who is responsible
- Hidayah is run by ISolution Technologies Ltd, a company registered in England and Wales.
- Each madrasa is the data controller for its own students', parents' and staff records. It decides what is recorded and who in the madrasa can see it.
- Hidayah is the data processor. We store and process that data only to provide the service to the madrasa, and only on its instructions.
- We never sell data and never use a madrasa's data for advertising.
What data is held
What each madrasa chooses to record, typically:
- Students: name, date of birth, class, attendance, Qur'an progress, exam results and behaviour notes. Medical, allergy and dietary notes if the madrasa adds them.
- Parents and guardians: name, contact details and which children they are linked to.
- Staff and teachers: name, contact details, role and attendance.
- Fees: invoices, payments, receipts and refunds.
Where data is kept
- The live system runs on a dedicated server in the United States. We rent the hardware and run everything on it ourselves. The data centre's staff have no login to it.
- Backups are taken every night and kept in two places: a backup store in the United States, and our own backup server in the UK, whose storage is encrypted.
- All traffic between your browser and Hidayah is encrypted (HTTPS).
- Because our live server is in the United States, data held in Hidayah is stored outside the UK. The protections on this page apply to all of it.
Who can see the data
| Who | What they can see |
|---|---|
| Madrasa owner | Everything in their own madrasa or madaris. |
| Managers | Only the madaris the owner switches on for them, and only the areas they are allowed, such as reports. |
| Teachers | Only the students in their own class. Teachers cannot see what any family owes or has paid. |
| Parents | Only their own children's records and fees. |
| Other madaris | Nothing. Each madrasa's records are kept separate from every other madrasa. |
| Hidayah | Only our founder, through the server or by signing in as the madrasa's admin, and only to support the madrasa or fix a problem. Our automatic update system can also reach the server to install new versions. |
Services we use
A small number of trusted services help us run Hidayah:
| Service | What it does |
|---|---|
| Server provider | Rents us the server hardware and network in the United States. It has no login to the server. |
| Stripe | Processes card and Direct Debit payments. Full card numbers and bank account details are held by Stripe and never stored on our servers. |
| Amazon Web Services | Delivers the emails Hidayah sends, such as invitations, receipts and reminders. |
| Cloudflare | Protects the website from attacks and keeps it fast. |
| Bugsnag | Receives error reports when something fails, so we can fix it. These can include the signed-in person's details. Based in the United States. |
| Backup storage | IDrive holds our nightly backups. Google Drive holds an encrypted copy of our UK backup server. |
How data is protected
- Everyone signs in with their own login, and passwords are stored scrambled (hashed), never as plain text.
- Each person only sees what their role allows, as set out above.
- A madrasa can limit teacher logins to its own tablets.
- More than 5 sign-in attempts a minute from the same network address are blocked for a minute.
- Every time we sign in as a madrasa's admin from our admin panel, it is recorded in an audit log.
- Changes people make to fees, payments and refunds are recorded, with who made them and when.
- The server is scanned for malware and attacks around the clock (Imunify360), sits behind a firewall, and blocks addresses that keep trying to break in.
- Signing in to the server is by SSH key only. Password sign-in is switched off.
How long data is kept
- A madrasa's data is kept while it uses Hidayah.
- If a madrasa leaves, we return its data on request and then delete it within 90 days.
- Our own invoices and payment records for a madrasa's subscription are kept for at least 6 years, as UK accounting rules require. The madrasa's own fee records are deleted with the rest of its data.
- Deleted data drops out of our backups as they are replaced on their normal cycle.
If something goes wrong
If we become aware of a breach affecting a madrasa's data, we will tell the madrasa without undue delay, so it can meet its own duties, and the regulator where the law requires it.
Requests from parents
Parents who want to see, correct or delete their family's data should ask their madrasa first, because the madrasa is the data controller. When a madrasa passes a request to us, we provide the data or make the change within 10 working days, so the madrasa can answer within the one month the law allows.
Data protection contact
We have not appointed a formal Data Protection Officer. Our assessment is that the law does not require one at our current size, and we review that as we take on more madaris. Our founder is the named data protection lead and handles every data protection question. Email [email protected].