1. Who We Are
Hadithne Storytelling ("we", "us") operates the Hadithne Schools platform. We are committed to protecting the privacy of schools, teachers, parents and the children who read with us. This policy explains what data we collect, why, how we use it, and your rights over it.
Privacy enquiries: hello@hadithne.com
2. Data We Collect and Legal Basis
The school is the controller of its students' and staff data; we process it on the school's behalf only to provide the reading programme.
Adult account data (name, email address, hashed password, role in the school) — basis: contract.
Student data (name or nickname, grade, stage, optional reading level and avatar, optional PIN stored hashed, and reading events such as starting and finishing a story, reviewing words and answering the reflection question) — basis: the school's instructions. We do not ask for a child's email, phone number, date of birth or location. This platform stores no audio recordings; it records only that a narration activity was completed.
Parent data (email, name and link to their child after a school invitation) — basis: contract and the school's instructions.
Payment and billing data — handled entirely by Paddle.com Market Limited as our Merchant of Record. We do not store card numbers or full payment details; Paddle shares only what we need to activate the subscription (status, plan and billing email). Paddle's processing is governed by the Paddle Privacy Policy.
Usage data (IP address, browser type, pages and timestamps in server logs) — basis: legitimate interests in security, fraud prevention and improving the Service.
Support communications — basis: legitimate interests in responding to your enquiries.
3. How We Use Your Data
We use data strictly for the following purposes. We do not use it for advertising or sell it to anyone:
- Signing in and managing accounts and permissions within each school
- Delivering stories and assignments and showing participation to teachers, the school and parents
- Sending service emails (invitations, password resets, subscription notices)
- Managing the subscription through Paddle
- Keeping the platform secure
No public rankings of children, no automated AI assessment, no voice recognition, and no marketing messages to children.
4. Third-Party Processors
Paddle.com Market Limited — payment processing and Merchant of Record.
Google Cloud Platform — hosting, database and secret management. Data is stored in the European Union (Firestore multi-region eur3, Cloud Run in europe-west1, Belgium).
one.com — transactional email delivery from hello@hadithne.com.
Google / Apple — sign-in only for users who choose it; we receive the verified name and email.
You may request the full list of sub-processors at hello@hadithne.com.
5. International Data Transfers
School and student data is stored in the European Union. We do not transfer it to other countries except as described in Section 4 (such as Paddle's billing processing) and under appropriate contractual safeguards.
6. Data Retention
- Reading events: 730 days
- In-app notifications: 180 days
- Archived students: 365 days after archiving
- School audit log: 1095 days
When a school requests deletion, its data is permanently deleted after a 30-day grace period, except records we must keep by law (such as financial records).
7. Your Rights
Under the GDPR and similar laws, you have the right to:
- Access your data and receive a copy
- Correct inaccurate data
- Erase your data
- Restrict or object to processing
- Data portability (school export is available from settings)
For requests about a student, please contact the school first as the controller. To exercise any right, email hello@hadithne.com. We will respond within 30 days. You also have the right to complain to your data protection authority.
8. Cookies
We use only essential cookies: session, request-forgery protection (CSRF) and language preference. We use no tracking, advertising or analytics cookies, and no third-party cookies.
9. Security
- Encryption in transit over HTTPS
- Encryption at rest in Google Cloud Firestore
- Passwords and PINs hashed with Argon2
- Secrets kept in Google Secret Manager; the service runs under a dedicated identity with no downloadable keys
- Strict separation between schools, with role-based access within each school
No system is perfectly secure. Please report security concerns to hello@hadithne.com.
10. Children's Privacy
Children use Hadithne Schools under their school's direction through a class code, without email accounts. The school enters and manages student data under its own data protection policies, and we process it as a processor on its instructions.
11. Saudi Personal Data Protection Law (PDPL)
Where we process personal data of residents of Saudi Arabia, we comply with the Personal Data Protection Law: we process data only for the stated purpose, apply the safeguards in Section 9, and use contractual safeguards when it is transferred outside the Kingdom. Rights can be exercised by emailing us.
12. Data Processing Agreement
Schools that need a formal Data Processing Agreement may request one at hello@hadithne.com.
13. Changes to This Policy
We may update this policy periodically and will notify registered users of material changes at least 30 days in advance. The "last updated" date above reflects the latest revision.
14. Contact
Privacy questions or data requests: hello@hadithne.com
Payment data: Paddle Privacy Policy