Privacy policy

Who is responsible for your data

Each daara registered on Alluwa is responsible for the data it records: that of its pupils, their families and its staff. For any question about this data, contact the daara first.

Oumar DIOP publishes Alluwa and has it hosted. This data is processed on behalf of each daara, following its instructions, and only to run the service.

For requests sent from the “Register my daara” page, the controller is Oumar DIOP.

The data concerned

• pupils’ identity and schooling: name, date of birth, class, attendance, marks, report cards, Quran progress;
• contact details of parents and staff: name, phone, email;
• school fee instalments and payments;
• health information the daara chooses to record;
• photos, videos and texts published on the daara’s public page;
• pre-registration requests for a child and registration requests for a daara, sent from the public pages.

What it is used for

Only to run Alluwa: managing the daara, following pupils, informing families and sending the daara’s emails. Alluwa shows no advertising.

Never sold, never shared

The data is never sold, rented or given away. It is only passed to the providers the service needs:

• the host of the Alluwa server;
• the email delivery service;
• the daara’s payment provider (PayTech), if the daara turns on online payment;
• Google’s artificial intelligence service (Gemini), when AI advice and the AI assistant are turned on: it receives the information needed to answer.

Where and for how long

The data is hosted on a server dedicated to Alluwa, rented from a hosting provider established in the European Union. Each daara only sees its own data.

It is kept for as long as the daara uses Alluwa. A daara can ask at any time for an export, then for the deletion of its data.

Backups

The database is backed up automatically every night. Copies are kept for thirty days, then erased. They are only used to restore the service after a failure.

Security

Access requires a username and a password. Each user only sees what their role allows: management, teacher or parent. Exchanges with the server are encrypted (HTTPS).

To limit abuse, each daara registration request keeps a fingerprint of the sender’s IP address, computed with a secret key: the address itself is not recorded. This fingerprint is only used to limit requests sent from the same connection to three in 24 hours.

Cookies and browser storage

Alluwa keeps in your browser what it needs to work: your login session, your language and your display preferences (theme, selected daara, list layout).

On the device of a teacher who uses Quran follow-up, the follow-up pages and a copy of their circle and of the records they opened are kept so they can work offline. Entries made offline stay there until they are sent.

Alluwa sets no advertising or audience measurement cookies.

Google content on a daara’s public page

A daara’s public page can show a Google Maps map and YouTube videos, if the daara adds them. When a visitor opens a page that contains them, their browser loads this content from Google’s servers. Google then receives their IP address and the usual browser information, and processes them under its own rules. Google may also set its own cookies.

Videos play in YouTube’s privacy-enhanced mode (youtube-nocookie.com).

Your rights

You can ask to access your data, to correct it or to delete it. Contact your daara first, as it manages your data; you can also write to the Alluwa team.

These rights are set out in Senegalese law no. 2008‑12 of 25 January 2008 on the protection of personal data. You can also refer the matter to the Personal Data Protection Commission (CDP).