Privacy Policy

Project Talab

Last updated: 18 May 2026

Effective from: 18 May 2026

1. Introduction

This Privacy Policy explains how Project Talab ("we", "us", "our") collects, uses, stores, shares, and protects your personal information when you use our platform.

We take your privacy seriously. Project Talab is built on principles of trust (amaanah) and we hold the information you provide to us as a responsibility, not just as data.

This Privacy Policy should be read together with our Terms and Conditions and Code of Conduct, which together govern your use of the platform.

If you do not agree with how we handle your personal information as described in this Privacy Policy, please do not create an account or use the platform.

2. Who We Are

2.1 Data Controller

Project Talab is operated by [YOUR FULL LEGAL NAME], an Australian sole trader trading as "Project Talab", based in Sydney, New South Wales, Australia. We are the "data controller" for the personal information we collect about you, meaning we decide how and why your information is processed.

2.2 Privacy Contact

For all privacy-related queries, requests, complaints, or notices, you can reach us at:

Email: admin@projecttalab.com

We will respond to privacy requests within 30 days of receipt. We do not currently have a formally appointed Data Protection Officer, but the email address above is our designated privacy contact.

3. What Information We Collect

3.1 Information You Provide Directly

When you register and use Project Talab, we collect:

Account registration information:

  • Full name
  • Email address
  • Password (stored in encrypted form)
  • Gender
  • Country of residence
  • Preferred language
  • Time zone
  • Currency preference
  • Whether you are registering on behalf of a child

Student profile information:

  • Date of birth
  • City and address
  • Phone number with country code
  • Profile photo (optional)
  • Short bio and learning goals
  • Languages spoken with proficiency levels
  • Government-issued identification (image or PDF)
  • For students under 18: parent or guardian name, identification, contact number, and parental consent record

Teacher application and profile information:

  • General information including nationality, address, contact details, languages
  • Subjects taught, qualifications, certificates, Ijazahs, and supporting documents
  • Educational and work history
  • CV (optional)
  • Application video (internal, not public)
  • Public profile photo and introductory video
  • Bio, teaching methodology, scholars who have impacted you
  • Course details, descriptions, prerequisites, and pricing
  • Weekly availability and schedule

Booking and payment information:

  • Lessons booked, completed, cancelled, and rescheduled
  • Pack purchases and balances
  • Payment details (full card numbers are handled by Stripe and are never stored by Project Talab)
  • Payout details for teachers (bank, Payoneer, Wise or PayPal account details, encrypted at rest and used only to pay the teacher)
  • Identity verification results from Didit (see “Identity verification” below). We do not store identity document images or photographs.
  • Transaction history

Communication and platform activity:

  • Messages exchanged between users on the platform
  • Reviews and ratings submitted
  • Support tickets and correspondence with Project Talab admin

3.2 Information Collected Automatically

When you use the platform, we automatically collect:

  • IP address
  • Browser type and version
  • Device type and operating system
  • Pages visited, time spent on each page, and click activity
  • Referring URL (the page that brought you to the platform)
  • Cookies and similar technologies (see Section 11)

3.3 Information from Third Parties

We receive information about you from third parties in limited circumstances:

  • Stripe (our payment processor): payment status, transaction outcomes, and fraud signals
  • Didit (our identity verification provider): whether verification passed, the document type and issuing country, and the checks performed
  • Email service provider: delivery status, bounce records, and engagement signals from emails we send you
  • Google Analytics: aggregated and anonymised usage statistics

We do not currently use a third-party identity verification service. Identity verification is handled manually by our admin team.

3.4 Special Category Data

Project Talab is a platform for Islamic studies education. By registering on the platform, you understand and consent that your registration implies you are seeking or providing Islamic studies education within the mainstream Sunni tradition. This may be considered information about your religious beliefs under data protection laws.

We process this information on the basis of your explicit consent, given at registration, and only for the purposes of providing the service you have requested.

4. Why We Collect Your Information (Legal Bases)

We collect and process your personal information on the following legal bases under the EU General Data Protection Regulation (GDPR), UK GDPR, the Australian Privacy Act 1988, and other applicable privacy laws:

Contract — we need certain information to provide the service you have signed up for, including processing bookings, taking payments, and facilitating lessons. Without this information, we cannot provide the service.

Legal obligation — we are required by law to retain certain information for tax, financial, regulatory, and safeguarding purposes. This includes financial transaction records (typically 7 years) and identity verification records.

Legitimate interest — we collect and use some information to operate, secure, and improve the platform. This includes detecting fraud, preventing abuse, debugging issues, and providing customer support. We only rely on legitimate interest where we have determined that our interests do not override your fundamental rights and freedoms.

Consent — for some processing, we rely on your explicit consent. This includes:

  • Marketing emails — you may opt in to receive marketing emails at registration. You can withdraw your consent at any time.
  • Religious-affiliation context — by registering on a platform for Islamic studies education, you consent to your registration data being processed for this purpose.
  • Non-essential cookies (such as analytics cookies) — collected only with your explicit consent through our cookie banner.

5. How We Use Your Information

We use the information we collect to:

  • Create and operate your account
  • Match students with teachers (within the gender hard rule)
  • Process and confirm bookings
  • Take and release payments via Stripe, and pay teachers directly via their chosen payout method
  • Verify the identity of teachers, adult students and the guardians of students under 18, via Didit
  • Send transactional communications (booking confirmations, payment receipts, password resets)
  • Verify your identity and the authenticity of submitted documents
  • Verify the gender hard rule is being respected
  • Operate the messaging system between users
  • Investigate and resolve disputes
  • Detect, prevent, and respond to fraud, abuse, and security incidents
  • Comply with our legal and regulatory obligations
  • Improve the platform based on usage patterns and feedback
  • Send marketing emails (only where you have explicitly opted in)

6. Who We Share Your Information With

6.1 Service Providers

We share information with trusted service providers who process data on our behalf to operate the platform. These providers are bound by contract to handle your data securely and only for the purposes we direct.

Our key service providers include:

  • Stripe — payment processing (sees: name, email, payment details, transaction history). Stripe operates under its own Privacy Policy.
  • Wise and PayPal — receive teacher payout details (name, payout method details, amount) only when a payout is made to a teacher using that method. Each operates under its own Privacy Policy.
  • Didit — identity verification (sees: your identity document, a live photograph of your face, and the personal details printed on the document). Didit operates under its own Privacy Policy.
  • [EMAIL SERVICE PROVIDER — TBC] — transactional and notification emails (sees: email address and email content).
  • [HOSTING PROVIDER — TBC] — hosting and storage of platform data.
  • Google Analytics — aggregated and anonymised usage statistics (with your consent through our cookie banner).

This list may be updated from time to time as our service infrastructure evolves. Material changes will be notified to you in accordance with Section 13 of this Policy.

6.2 Other Users on the Platform

Some information is visible to other users as a necessary part of the platform's operation.

Teachers' public profiles are visible to all eligible logged-in students of the same gender. Public profile information includes name, photo, intro video, bio, teaching methodology, scholars who have impacted them, course offerings, pricing, availability, and reviews.

Female teacher profiles include modesty-preserving placeholders in public-facing card listings and are only fully visible to authenticated female students.

Students' identities are not displayed publicly. Within a booked teacher-student relationship, the teacher sees the student's first name and (if uploaded) profile photo. Profile photos are not displayed to other students.

Reviews submitted by students are displayed publicly on the teacher's profile with the student's first name and last initial (for example, "Aisha M."). Full names, email addresses, and contact details are never shown publicly.

Messages exchanged on the platform are visible only to the two parties in the conversation. Project Talab admin does not actively monitor messages but may access them where required, as described in our Terms and Conditions and Section 6.3 below.

6.3 Legal and Regulatory Disclosures

We may disclose your personal information where we are legally required or permitted to do so, including:

  • To comply with a court order, subpoena, or legal process
  • In response to a valid request from law enforcement or a regulatory authority
  • To enforce our Terms and Conditions or Code of Conduct
  • To protect the rights, property, or safety of Project Talab, our users, or the public
  • To investigate and prevent fraud, abuse, or illegal activity
  • To comply with tax reporting obligations under Australian or other applicable law

6.4 Business Transfers

If Project Talab is ever sold, merged, restructured, or has its assets acquired, your personal information may be transferred to the new owner as part of that transaction. We will notify you in advance and you will have the opportunity to close your account if you do not wish your data to be transferred.

6.5 With Your Consent

We may share your information with other parties where you have given us specific consent to do so.

7. International Data Transfers

Project Talab is based in Australia, and our service providers (including Stripe, Wise, PayPal, Didit and our hosting provider) may be located in Singapore, the United States, the European Union, the United Kingdom, or other countries.

When your personal information is transferred outside your country of residence, we put in place appropriate safeguards to protect it, including:

  • Standard Contractual Clauses approved by the European Commission, for transfers from the EU to third countries
  • UK International Data Transfer Agreements, where applicable
  • Equivalent safeguards for transfers under the Australian Privacy Act

By using the platform, you understand that your information may be transferred internationally and you consent to such transfers, subject to the safeguards described above.

8. How Long We Keep Your Information

8.1 Active Accounts

We keep your personal information for as long as your account remains active, plus the periods set out below.

8.2 After Account Closure

When your account is closed (whether by you or by Project Talab):

  • Within 30 days, your personally identifiable information is anonymised — your name, email, address, phone number, ID documents, profile photos, and other directly identifying data are removed or replaced with anonymous placeholders.
  • Aggregate, anonymised activity data (such as lesson counts, platform-wide statistics) may be retained for analytical purposes.
  • Within 12 months of account closure, your account record is fully deleted, except where retention is legally required (see Section 8.3).

8.3 Legally Required Retention

Certain information must be kept longer than the standard retention period to comply with legal obligations:

  • Financial transaction records: 7 years from the date of the transaction (Australian Taxation Office requirement)
  • Messages exchanged on the platform: up to 7 years for safeguarding, dispute resolution, and legal compliance purposes
  • Identity verification documents: 7 years after account closure, for fraud investigation and regulatory purposes
  • Records of accounts terminated for breach of Terms or Code of Conduct: kept indefinitely to prevent re-registration of banned users

9. Your Rights

Subject to applicable law, you have the following rights in relation to your personal information:

9.1 Right of Access

You may request a copy of the personal information we hold about you. We will respond within 30 days. The first request in any 12-month period is free; for further requests, we may charge a reasonable administrative fee.

9.2 Right to Rectification

You may ask us to correct inaccurate or incomplete information. Most personal information can be updated directly through your account settings.

9.3 Right to Erasure

You may ask us to delete your personal information (the "right to be forgotten"). We will comply with such requests unless we have a legal obligation, contractual obligation, or legitimate interest to retain the information. Note that even after deletion, some information may persist in backups for a limited time before being overwritten.

9.4 Right to Restrict Processing

You may ask us to pause certain uses of your information while we investigate a complaint or correct inaccurate data.

9.5 Right to Data Portability

You may request to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format, and you may ask us to transmit this information to another data controller where technically feasible.

9.6 Right to Object

You may object to our processing of your personal information where we rely on legitimate interest as the legal basis. We will stop processing your data unless we have compelling legitimate grounds that override your interests, or where processing is necessary for legal claims.

9.7 Right to Withdraw Consent

Where we rely on your consent to process your information (such as marketing emails or analytics cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority. In Australia, this is the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au. In the European Union, this is the data protection authority of your country of residence. In the United Kingdom, this is the Information Commissioner's Office (ICO) — www.ico.org.uk.

9.9 How to Exercise Your Rights

To exercise any of these rights, please contact us at admin@projecttalab.com. We may need to verify your identity before responding to your request to protect the security of your information.

10. Children and Minors

Project Talab is not intended for children under 13 years of age. Users under 13 are not permitted to register an account under any circumstances. If we become aware that we have collected information from a user under 13, we will delete that information promptly.

Users aged 13 to 17 may register only with the active consent and identification of a parent or legal guardian. We collect the following additional information for users under 18:

  • Parent or guardian's full name
  • Parent or guardian's government-issued identification
  • Parent or guardian's contact number
  • A record of parental consent to the minor's use of the platform

Parents and guardians of users under 18 have additional rights, including:

  • To access and review their child's account information
  • To request correction or deletion of their child's account at any time
  • To withdraw consent to the minor's use of the platform

To exercise these rights, parents and guardians should contact us at admin@projecttalab.com.

11. Cookies and Tracking Technologies

11.1 What Cookies Are

Cookies are small text files that are stored on your device when you visit a website. They allow the website to recognise your device and remember information about your visit, such as your preferences or whether you are logged in.

11.2 How We Use Cookies

We use cookies for the following purposes:

Essential cookies — necessary for the platform to function. These keep you logged in, protect against security attacks, and maintain your session as you navigate. Essential cookies do not require your consent.

Functional cookies — remember your preferences such as currency, language, and time zone. These improve your experience but are not strictly necessary.

Analytics cookies — used by Google Analytics to help us understand how users interact with the platform. These cookies collect information in aggregated and anonymised form. Analytics cookies are only set with your explicit consent through our cookie banner.

We do not currently use marketing or advertising cookies on the platform.

11.3 Your Cookie Choices

When you first visit the platform, you will see a cookie banner asking for your preferences. You may:

  • Accept all cookies (including analytics)
  • Reject all non-essential cookies (essential cookies will still be set, as they are necessary for the platform to work)
  • Customise your choices for different cookie categories

You can change your cookie preferences at any time by clicking "Cookie Settings" in the footer of the platform.

11.4 Browser Controls

Most browsers allow you to block or delete cookies through their settings. Please note that blocking essential cookies may prevent the platform from functioning correctly.

12. Security

We use industry-standard technical and organisational measures to protect your personal information, including:

  • Encryption of data in transit using TLS/SSL
  • Encryption of sensitive data at rest
  • Secure password storage using one-way hashing
  • Access controls limiting who can access your data
  • Regular security reviews and updates
  • Secure handling of identity documents and uploaded files

Payment information is processed and stored by Stripe in accordance with industry standards (PCI DSS). Project Talab does not store full payment card details. Teacher payout details are encrypted at rest in our systems, and are decrypted only to make a payout.

No system is completely secure. While we take reasonable precautions to protect your information, we cannot guarantee absolute security. If we become aware of a data breach that affects your personal information and is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant authorities in accordance with applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service evolution.

For material changes — defined as changes that affect the categories of data we collect, how we use your data, who we share it with, or your rights — we will notify you by email at least 30 days before the updated Policy takes effect.

For non-material changes — such as typographical corrections, formatting updates, or clarifications — updates may take effect immediately upon publication.

The "Last updated" date at the top of this Policy will always reflect the most recent version.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal information, please contact us:

  • Email: admin@projecttalab.com
  • Operator: [YOUR FULL LEGAL NAME], trading as Project Talab
  • Location: Sydney, New South Wales, Australia

We aim to respond to all privacy queries within 30 days.

— End of Privacy Policy —