Privacy Policy

Labbaik Labs Ltd ("Labbaik", "we", "us") operates Labbaik (uselabbaik.com), a maktab, madrasah, mosque, and Islamic community management platform, at app.uselabbaik.com. Registered in England & Wales, Company No. 17166064. Registered address: Unit 21 Walker Avenue, Milton Keynes, MK12 5TW. ICO Registration Reference: ZC136003 (registered 29 April 2026, expires 28 April 2027). Data Protection Officer email: privacy@uselabbaik.com.

• Student data: full name, date of birth, gender, curriculum group and progress, attendance records, class enrolment.
• Guardian/parent data: full name, email address, phone number, home address (used for registration and billing).
• Payment data: Stripe customer ID, payment history, subscription status, fee concession notes. We do not store full card details — all card data is handled by Stripe.
• Account data: email address, role (admin/teacher/parent), login timestamps.
• Staff/teacher data: full name and contact details, role, and — where the organisation tracks it — DBS safeguarding check details; see Staff Safeguarding Checks (DBS) below.
• Usage data: page views, feature usage, error logs (for platform improvement).
• Certificate application data: for Nikah and other certificate types, the names, dates of birth, marital status, profession, home address, and contact details of the bride, groom, witnesses, and wakeel/wali, plus mahr (dowry) amounts and the date/venue of the ceremony. This data is submitted by the applicant, not necessarily the account holder, and is stored on behalf of the issuing organisation.
• Donation data: name and email address of the donor (for receipts), and donation amount and frequency (one-off or recurring monthly).

• Delivering the maktab management service (attendance, progress, payments, parent communications).
• Processing payments via Stripe on behalf of the maktab.
• Sending transactional emails (payment confirmations, magic-link logins, registration approvals, progress updates).
• Sending push notifications to parents who have opted in.
• Complying with our legal obligations under UK GDPR and the Data Protection Act 2018.

• Contract: processing is necessary to provide the service you or your institution has subscribed to.
• Legitimate interests: operational analytics, fraud prevention, platform security.
• Legal obligation: financial record-keeping, safeguarding obligations for minors.
• Substantial public interest (safeguarding): processing staff DBS/criminal-offence data, under Schedule 1 of the Data Protection Act 2018, for safeguarding children — see Staff Safeguarding Checks (DBS) below.
• Consent: marketing communications and push notifications (you may withdraw at any time).

Where an organisation tracks staff safeguarding checks through Labbaik, we store DBS (Disclosure and Barring Service) record details for teaching staff: certificate number, issue date, expiry date, certificate type (standard/enhanced), and whether it includes barred-list information — together with a copy of the certificate document, where the organisation chooses to upload one.

This is criminal-offence data, a special category under UK GDPR. It is processed by the organisation (as data controller for its staff, in the same way it is data controller for its students) for safeguarding purposes and to comply with its own legal obligations, and by Labbaik as a data processor acting on the organisation's instructions. Access is restricted to the organisation's admins and head teachers — it is never visible to teachers, parents, or other staff.

As data controller for this data, the organisation is responsible for meeting its own conditions for lawfully processing it, including maintaining an appropriate policy document under Schedule 1 of the Data Protection Act 2018 where required.

We send automated expiry reminders to the organisation so DBS checks can be renewed before they lapse. We do not independently verify DBS certificates with the DBS itself — the organisation remains responsible for confirming the validity of any certificate it records.

• Supabase (Supabase Inc.) — our database and authentication provider. Data is stored in EU-region Supabase infrastructure. Supabase processes data as a data processor under our instructions.
• Stripe Inc. — payment processing. Stripe is an independent data controller for payment data under their own privacy policy.
• Resend Inc. — transactional email delivery.
• Twilio Inc. — WhatsApp messaging (where enabled).
• Google LLC — if you choose to sign in with Google, your Google account name and email address are shared with us via OAuth. Google's privacy policy applies to data held by Google.
• Apple Inc. — if you choose to sign in with Apple, your Apple ID email address (or relay address if you chose to hide your email) is shared with us via OAuth. Apple's privacy policy applies to data held by Apple.
• Anthropic (Claude) and OpenAI — our AI service providers, used to power the AI features described in Artificial Intelligence Features below.
• Google Drive, Dropbox, and Zoom — if you choose to connect one of these, as described in Third-Party Integrations below.
• OpenTimestamps — a free, decentralised timestamping service used to anchor certificate fingerprints to the Bitcoin blockchain, as described in Certificate Verification and Blockchain Anchoring below. OpenTimestamps never receives your personal information, only the anonymous cryptographic fingerprint.
• We do not sell, rent, or share personal data with third parties for marketing purposes.

Labbaik includes optional artificial intelligence ("AI") features that help admins, teaching staff, and parents work with information already held on the platform — for example, answering questions about a student's attendance, progress, or exam results, generating reports, drafting class or event materials, and providing in-app support. AI features are only available to admin, teacher, and parent accounts — children do not have access to any AI feature.

The AI tools available to each role are deliberately narrow and scoped to your own organisation's data — an admin's AI assistant cannot see or act on another organisation's records, and the tools available to a parent are limited to their own children's records. Most AI tools are read-only: looking up and summarising attendance, academic progress, exam results, payment status, and (for admins) organisational revenue. A small number of tools can take action on your behalf where you explicitly ask them to in the conversation — for example, approving a pending student enrolment (which creates the student's record and sends a payment link to the parent), recording a manual payment, applying a family fee discount, or pausing/cancelling a Stripe subscription. The more sensitive of these require you to confirm a preview before anything is actually written. Our in-app AI support assistant can also escalate your query to a member of Labbaik's engineering/support team when it cannot resolve it itself.

When you use an AI feature, the information you submit, together with any account or student data the feature is authorised to access in order to respond to your request, may be securely transmitted to one of our AI service providers for processing:

• Anthropic (Claude) — powers our in-app and WhatsApp AI assistants, used to answer questions about attendance, progress, exam results, payments, and class/enrolment records, and to escalate unresolved queries to our support team.
• OpenAI — used only for generating class-structure suggestions and event posters/copy. For poster and event-copy generation, only the event or class details you provide and your organisation's logo are sent to OpenAI — no student or parent personal data is involved.

We do not use customer, student, parent, certificate, or organisation data to train our own AI models. Data submitted through Labbaik's AI features is not used by our AI service providers to train their general-purpose AI models by default under their commercial/API services.

AI providers may temporarily retain requests and responses for security, abuse prevention, legal compliance, and service operation in accordance with their applicable commercial terms, data processing agreements, and retention policies. We aim to minimise the personal information transmitted to AI providers and only provide information reasonably necessary to perform the requested task.

AI-generated responses may occasionally be inaccurate or incomplete. Users should review AI-generated information before relying on it for important administrative, educational, safeguarding, financial, or legal decisions.

Labbaik offers optional connections to Google Drive, Dropbox, and Zoom via OAuth — an industry-standard authorisation protocol. You connect these yourself from your account settings, authorising access directly with the provider; Labbaik never sees or stores your password for these services, and you can revoke access at any time, either in Labbaik or directly with the provider.

Each connection only ever sees what it needs to:

• Google Drive — connected using Google's per-file (drive.file) scope. Labbaik can only see files it creates on your behalf or that you explicitly select through the connection. We cannot browse, list, or access the rest of your Drive.
• Dropbox — connected with "App Folder" access. Labbaik's connection is confined to its own dedicated folder inside your Dropbox. We cannot see or access any other files in your account.
• Zoom — used only to create and manage video meetings for your classes and events on your organisation's behalf. It does not give us access to files, recordings, or any other Zoom account data beyond the meetings Labbaik creates.

In every case, the file or meeting data Labbaik can see is limited to what you've explicitly shared with or created through the connection — we have no visibility into anything else in your Google Drive, Dropbox, or Zoom account. Access tokens for these connections are encrypted at rest, transmitted over TLS, and refreshed automatically without your login credentials ever passing through or being stored by Labbaik. See our Security page for more detail.

Labbaik charges a platform fee on Stripe transactions processed through the platform. Maktabs and parents are informed of this fee at the point of payment setup. This fee is deducted automatically at the point of payment and varies by payment type:

• Class/admission fees: charged on a graduated scale based on the organisation's trailing 30-day payment volume, from 1.5% on the first £3,000/month down to 0.35% above £50,000/month (unless an individually negotiated rate applies) — see our Terms of Service for the full schedule.
• Donations (Sadaqah): a flat 1% fee on all donations, except donations designated as Zakat, which carry no fee (0%). For non-Zakat donations, whether this fee is paid by the donor or deducted from the organisation's receipt depends on whether the donor opts to cover transaction fees at the point of giving. For Zakat-designated donations, Stripe's processing fee is always added on top of the donor's stated amount, never deducted from it — a mandatory (non-optional) surcharge so that the full amount designated as Zakat reaches the cause, consistent with Zakat fiqh requirements.
• Certificates (e.g. Nikah): a fixed 1% fee on the full certificate payment.

An organisation may choose to pass some or all of this fee on to the student or parent, rather than absorbing it itself. Where an organisation does this, it is disclosed to the student/parent at the point of payment setup — before the student/parent enrols or pays — in accordance with applicable law.

When a certificate (for example, a Nikah certificate) is issued through Labbaik, we generate a unique cryptographic fingerprint ("hash") of the certificate's core details, and — once the organisation uploads a signed copy of the physical document — a separate fingerprint of that signed document. These fingerprints are recorded on the Bitcoin blockchain via a service called OpenTimestamps. This is a public, permanent, and free record that allows anyone to independently confirm a certificate's contents have not been altered since the date it was issued.

Important points about this process:

• The fingerprint itself is a scrambled code. It does not contain your name or any other personal information, and cannot be reversed to reveal your personal details.
• Your actual personal information (name, date of birth, address, etc.) is never published on the blockchain. It is stored securely by Labbaik and by the organisation that issued your certificate, exactly as described elsewhere in this policy.
• The public verification page (verify.uselabbaik.com) shows only the certificate type, the issuing organisation's name, and the date of issue. It does not display the names or personal details of the people involved.
• Records on the Bitcoin blockchain are permanent and cannot be edited or deleted by Labbaik, the issuing organisation, or you. If you later ask us to delete your personal data, we will delete or anonymise your personal information from our own systems, but the underlying fingerprint will remain on the blockchain indefinitely. Because the fingerprint alone cannot identify you or reveal any personal information, we do not consider this to conflict with your right to erasure — but we want you to be aware of it before you apply for a certificate.

• Active student/parent records: retained for the duration of the institution's subscription plus 2 years.
• Payment records: retained for 7 years in compliance with HMRC requirements.
• Attendance and progress records: retained for 3 years after a student leaves.
• Deleted accounts: personal data is anonymised or erased within 30 days of a verified deletion request.
• Certificate records: currently retained indefinitely, as we have not yet set a fixed automatic deletion schedule for this data. You may request erasure of your personal information from a certificate record at any time using the process described in Your Rights (UK GDPR) and Data Deletion Requests below; we will action verified requests within 30 days, consistent with our other data. (The underlying blockchain fingerprint is unaffected by this — see Certificate Verification and Blockchain Anchoring above.)

You have the right to: access your data, correct inaccurate data, request erasure ("right to be forgotten"), restrict or object to processing, data portability, and to withdraw consent at any time. To exercise any of these rights, email privacy@uselabbaik.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

To request deletion of your personal data or your child's data, email privacy@uselabbaik.com with the subject line "Data Deletion Request" and include the name, email address, and institution associated with the account. We will confirm deletion within 30 days.

We use essential session cookies for authentication. We do not use third-party advertising or tracking cookies. Analytics are limited to anonymised, aggregated usage data.

All data is encrypted in transit (TLS) and at rest. Access is controlled via row-level security (RLS) policies in our database. Staff access is role-scoped and audited. We follow responsible disclosure practices for security vulnerabilities.

Many of our users are children under 13. We collect children's data only at the direction of the maktab institution, which acts as data controller for its students. We process this data as a data processor under a Data Processing Agreement with each institution. Parents may request access to or deletion of their child's data at any time. Children do not have access to any AI feature — see Artificial Intelligence Features above.

We will notify active users of material changes via email or in-app notice at least 14 days before they take effect.

Labbaik Labs Ltd, Unit 21 Walker Avenue, Milton Keynes, MK12 5TW. Email: privacy@uselabbaik.com.