Privacy Policy

Taleem Sync ("Taleem Sync", "we", "us", or "our") is a cloud-based school management platform. This policy explains what data we collect through taleemsync.online and the Taleem Sync mobile app (together, the "Service"), why we collect it, and what rights you have over it.

Taleem Sync is an early-stage, independently operated software project. We are not yet a formally registered company in any jurisdiction. If that changes, we will update this policy to name the operating entity.

A school (the "Institution") signs up for Taleem Sync and creates accounts for its own staff, teachers, guardians, and students. In most cases, the Institution — not the individual user — decides what student, staff, and guardian data is entered into the system, and is the data controller for that information under most privacy laws. Taleem Sync acts as the data processor: we store and process the data on the Institution's behalf, under the Institution's instructions.

If you are a student, guardian, or staff member and have questions about data an Institution has entered about you, please contact that Institution first — they control the record. If you believe Taleem Sync itself has mishandled data, contact us using the details in Section 11.

Account data. Name, email or username, phone number, role, and a hashed password (we never store passwords in plain text) for everyone who logs in — administrators, teachers, guardians, and students.

Institution-entered records. Whatever an Institution enters to run the school day-to-day: student enrollment and academic records, attendance, exam results, fee transactions and payment history, timetables, staff payroll records, circulars and messages, and uploaded documents (e.g. CNIC/B-Form copies, certificates) or images (e.g. student/staff avatars, school logos).

Usage and security data. Login timestamps, IP address, and an audit trail of actions taken in the system (who changed what, and when) — kept for account security, abuse prevention, and so an Institution can investigate its own data if something looks wrong.

Billing data. Subscription plan, billing history, and payment records that an Institution's administrator manually records (e.g. bank transfer reference numbers). We do not currently process card payments directly or store card numbers.

Contact form submissions. If you use the public contact form, we collect the name, email, and message you provide, solely to respond to your inquiry.

• To operate the core functionality of the Service — attendance, fees, exams, timetables, and everything else an Institution uses day to day.
• To authenticate logins and enforce role-based access, so a guardian can never see another family's records and staff only see what their role permits.
• To maintain audit logs for security and accountability.
• To send transactional communications — e.g. account credentials, password resets, circulars, and notifications an Institution sends through the platform.
• To respond to support requests submitted through the contact form.
• To detect and prevent abuse, fraud, or security incidents.

We do not sell personal data, and we do not use student, guardian, or staff records entered by an Institution for advertising or profiling purposes.

The Service uses two essential cookies to keep you signed in: a short-lived access token and a longer-lived refresh token, both marked httpOnly and secure, meaning they can't be read by page scripts and are only ever sent over an encrypted connection. These are strictly necessary for the Service to function (you can't stay logged in without them) and are not used for tracking or advertising.

Our public marketing pages (taleemsync.online outside of the dashboard) load Google AdSense, which may set its own cookies to serve or measure ads. This only happens on the public site — it is never loaded on authenticated dashboard pages where Institution data is managed. The cookie banner shown on your first visit lets you accept or decline this.

We keep the list of third parties small on purpose:

• Hosting. The Service runs on infrastructure we operate and control directly — we do not use a third-party platform-as-a-service that would otherwise have its own access to your data.
• Email delivery. Transactional emails (credentials, notifications, contact form replies) are sent through a standard SMTP provider.
• Google Fonts and Google AdSense. Used only on public marketing pages, never inside the authenticated dashboard.

We do not share Institution data with data brokers, advertisers, or analytics resellers.

Taleem Sync is used by schools to manage records that include minors — students are not themselves the ones who sign up or agree to this policy; their school (the Institution) does, on their behalf, in the course of running the school. If you are a parent or guardian with questions about your child's data, your school's administration is best placed to answer them, since they control what was entered and why. We are always happy to help if you contact us directly.

• Every school's data is isolated by tenant — one Institution can never query or see another Institution's records, enforced at the database and application layer.
• Role-based permissions control exactly what each user (admin, teacher, guardian, student, etc.) can see and do, down to individual actions.
• Passwords are hashed, never stored or logged in plain text.
• All traffic to the Service is encrypted in transit (HTTPS is enforced).
• Session cookies are httpOnly and secure, so they can't be stolen via a page script.
• Administrative and financial actions are logged in an audit trail an Institution's administrators can review.

No system is perfectly secure, and we make no absolute guarantee — but data protection is treated as a core design constraint, not an afterthought.

We retain Institution data for as long as the Institution's account remains active, so the school can continue operating normally. If an Institution closes its account, we will delete or anonymize its data within a reasonable period, except where we're required to retain something for legal, security, or accounting reasons.

Depending on your location and role, you may have rights to access, correct, or request deletion of personal data. Since most student, guardian, and staff data is entered and controlled by an Institution, the fastest way to exercise these rights is usually through your school's administrator. If you'd like to reach us directly instead, use the contact details below and we'll do our best to help or route your request appropriately.

As Taleem Sync grows — including if we formally incorporate, add new features, or bring on new service providers — we'll update this page and change the "Last updated" date above. For significant changes, we'll make a reasonable effort to give notice through the Service.

Questions about this policy or how your data is handled? Reach us at taleemsync@gmail.com or via our contact page.