Privacy Policy

Last updated: October 2026

1. Who we are

Nanour ("we", "us", "our") is a managed Arabic tutoring service for children. We are based in the United Kingdom. If you have questions about this policy, contact us at ahlan@nanour.co.

Nanour is operated by [COMPANY_NAME_TODO], registered in England and Wales under company number [COMPANY_NUMBER_TODO].

2. What data we collect

We collect the following personal data:

Parent account data: name, email address, phone number, country.
Child profile data: first name, date of birth, Arabic language level, learning goals, preferred days and times, learning notes.
Tutor profile data: name, bio, languages spoken, teaching specialism, experience, lesson price.
Lesson data: booking details, lesson notes (submitted by tutors), AI-drafted parent-facing lesson summaries (reviewed and approved by the tutor before sending), and — from public launch — lesson recordings (see section 8 for the timing).
Lesson playback data: so you can revisit a lesson, we record which slides your child's tutor showed, how long each was on screen, and your child's answers on the activity slides. This is not video or audio. We keep it for 90 days after each lesson, then permanently delete it (see section 8).
Tutors' lesson notes: We keep lesson notes entered by tutors, including internal notes for the Nanour team. Internal notes are not routinely sent to parents, but notes about your child form part of their personal information. You or your child can request access. We handle requests in accordance with data protection law, including your child's rights and any applicable restrictions. These notes follow the retention periods explained below.
Spoken homework answers: When this optional feature becomes available, you will be able to switch it on so that your child can record short spoken answers to their homework for their tutor, and you can switch it off again at any time. Each recording is up to 10 seconds. Recordings are not marked by AI, used for voice analysis or used to identify your child by their voice. They can be heard by you, your child's current tutor and Nanour staff if needed for safeguarding. We delete each recording 90 days after it is made, or sooner if you request deletion, unless it must be retained for a specific safeguarding concern. Any such retention is restricted to what is necessary and reviewed regularly.
Payment data: payment amounts, Stripe payment references. We do not store card numbers — payments are processed securely by Stripe.
Technical data: authentication tokens, session cookies.

3. Why we collect this data

We use your data to:

Create and manage your account.
Match your child with a suitable Arabic tutor.
Schedule and deliver live tutoring lessons.
Generate post-lesson summaries to keep you informed of your child's progress.
Process payments for lessons.
Send you important notifications about bookings and lessons.
Improve our service.

Our legal basis for processing your data is the performance of our service contract with you (GDPR Article 6(1)(b)), and your consent where applicable (GDPR Article 6(1)(a)).

4. Children's data

Nanour's lessons are built for children aged 5 to 17. A child's profile details (first name, date of birth, learning information) are provided through the parent's account. We do not ask children to create accounts or to give their own registration details. Children's data is used solely to deliver and improve the tutoring service.

5. AI-generated content

We use artificial intelligence (AI) for three things:

Parent lesson summaries. Your tutor's structured notes are used to draft a parent-friendly summary. The tutor reviews and approves (or edits) the draft before it is sent to you.
Tutor pre-lesson briefings. Your child's recent lesson summaries and the next lesson's objectives are used to prepare a one-page briefing for the tutor before each lesson.
Progress reports. Every 10 lessons, the lesson summaries the tutor has already approved are used to prepare a short report on your child's progress.

When information is sent to our AI service provider, we limit it where we can. We replace the child's name with a placeholder, use an age band rather than the child's date of birth, and do not send free-text notes written by parents. Recommendations, such as flagging a skill that has not progressed after several lessons, are set by fixed rules and do not use AI. AI is not used to make high-stakes educational decisions, formally assess children, or choose tutors. A tutor reviews every lesson summary before it is sent to you.

6. Who we share data with

We share data with the following third parties:

A database and sign-in provider — storing your account and lesson data, and handling sign-in.
Stripe — payment processing.
An AI service provider — drafting lesson summaries, tutor briefings and progress reports.
A video-lesson provider — running the live video lessons and their recordings.
An email service — sending email notifications.
A text-message service — sending text-message reminders, only if you choose to receive them.
A website host — hosting the website and app.
An error-reporting service — recording technical errors so we can fix them.

We do not sell your data to third parties. We do not use your data for advertising.

7. How we store and protect data

Most account and lesson data is stored with our database provider in the EU/UK region. Some support services, logs or backups may be processed in other countries with appropriate safeguards. Access to data is controlled by row-level security policies — parents can only see their own data, tutors can only see their assigned students, and administrators have full access for service management.

All connections are encrypted via HTTPS. Passwords are hashed and never stored in plain text.

8. How long we keep data

We keep your account and your child's learning records while your account is open. If you close your account, we keep them for a further 12 months — so that you can come back, ask us for a copy, or settle anything outstanding — and then we delete them. We keep them for longer only where we have to: a safeguarding concern, a legal claim, money still owed, or a specific legal requirement.

You can also ask us to delete your data at any time, without closing your account first. Account deletion is handled by the Nanour team — to request it, email us at ahlan@nanour.co. Once your request is verified, your personal data and your children's data will be deleted within 30 days. Some limited records are kept even then, where we must keep them for legal, accounting, dispute or safeguarding reasons; we will tell you which ones and why. Anonymised lesson data may be retained for service improvement.

Lesson recordings. From the point Nanour goes live with paying families, lessons (including the free trial) are recorded as standard for safeguarding, quality assurance, tutor support, and lesson continuity, in line with the recording terms set out in our Terms of Service. Recordings are stored securely, and access is limited to the parent account holder and authorised Nanour staff whose role requires it. Tutors cannot view lesson recordings. Recordings are deleted 90 days after the lesson, automatically. That is the whole of it: they are not kept for as long as your account is open, and closing your account does not make them last longer or disappear sooner. Where we are required to keep a specific recording to defend or pursue a legal claim — a safeguarding investigation, for example — that one recording is held past 90 days, and we record why.

Lesson playback. The slide-playback data described in section 2 (which slides were shown, how long each was on screen, and your child's answers on the activity slides — no video or audio) is automatically deleted 90 days after each lesson.

Spoken homework answers. When this optional feature becomes available, each recording described in section 2 is deleted 90 days after it is made, or sooner if you request deletion, unless it must be retained for a specific safeguarding concern. Any such retention is restricted to what is necessary and reviewed regularly.

Records of messages we send. We keep a limited record of important emails and text messages we send, including who they were sent to, when, the language, the type and version of message, and sending status where available. We keep this so we can evidence notices, reminders and account communications.

9. Your rights

Under UK GDPR, you have the right to:

Access your personal data.
Correct inaccurate data.
Delete your data ("right to be forgotten").
Restrict or object to processing.
Data portability — receive your data in a common format.
Withdraw consent at any time.

To exercise any of these rights, email ahlan@nanour.co.

10. Cookies

We use essential cookies only — authentication session cookies required for the service to function. We do not use tracking cookies, analytics cookies, or advertising cookies.

11. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email or through the service. The "last updated" date at the top shows when the policy was last revised.

12. Contact

If you have questions about this privacy policy or how we handle your data, contact us at ahlan@nanour.co.

Safeguarding concerns: safeguarding@nanour.co

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

13. Languages

This Privacy Notice is available in English, Arabic and French. If anything in a translation is unclear or appears inconsistent, please contact us. We will interpret the notice in the way that best protects your privacy and data protection rights.