اAlif Ba Ta Tha

Privacy — for families in the European Union

An addendum to the privacy policy, which still applies in full. Last updated 18 September 2026.

The main policy says what we collect, why, and for how long, in the same words the app asks you to agree to. This page adds what the GDPR asks us to tell you on top of that: who is responsible, where the data is, on what legal basis each thing is done, and what you can ask for. Where we cannot yet state something — a region, a representative — this page says so rather than filling the gap with a guess.

Who is responsible

Barro Services LLC, trading as Alif Ba Ta Tha — the controller.

Established in the United States. Contact: privacy@alifbataza.com.

Representative in the Union (Article 27). We have not yet appointed a representative in the Union under Article 27. Until we do, write to the controller directly at the address below; we answer within 30 days.

Where your family's data is

Three places hold it. The region beside each is the one this deployment has stated; where it has not, the line says not stated by this deployment yet, and you should read the transfer paragraph below as applying.

Supabase — the database — your child's name, birth year, progress, the teacher's notes, your consents, and the ops log of each lesson; sign-in; file storageus-east-1 (N. Virginia)

LiveKit — the live audio and video of a lesson while it is happening, and the recording while it is being writtennot stated by this deployment yet

Lesson recordings — the finished recording of each one-to-one lesson, for the retention period in the main policyus-east-1 (N. Virginia)

Until every region above is stated, assume your family's data may be stored or processed outside the European Union, including in the United States. Where it is, the transfer rests on the European Commission's standard contractual clauses in our agreements with the providers named, and on the EU–US Data Privacy Framework where a provider is certified under it.

The companies in the main policy's 'Who else sees it' are our processors under Article 28. We do not add one without saying so on that page first.

On what basis

Your child's name, birth year, riwayah and primer; their progress and the teacher's notes

Performance of the contract with you, the guardian (Art. 6(1)(b)). Where your child is below your country's digital age of consent, your consent as their parent (Art. 8) is asked before any of it is collected.

Recordings of one-to-one lessons

Your consent (Art. 6(1)(a)), asked before the first lesson and withdrawable at any time. Recording is our safeguarding rule for every lesson with a minor, so withdrawing it pauses live lessons rather than continuing them unrecorded.

Short recitation clips to improve the assistant

Your consent (Art. 6(1)(a)), off unless you turn it on, and withdrawable — clips already used are removed at the next training run.

Your name, email and payment record

Performance of the contract, and our legal obligation to keep accounting and VAT records (Art. 6(1)(c)) for the period the law where we are registered requires.

The teacher's identity, credentials and audition

Our legitimate interest in vetting adults who teach children (Art. 6(1)(f)), which we judge to outweigh a teacher's interest in not being checked — and we tell every teacher what is checked before they apply.

Children, and the age that applies where you live

GDPR Article 8 lets each member state set the age from which a child may consent for themselves to an online service, between 13 and 16. Below that age we ask you, the parent or guardian, before we collect anything about your child — the main policy’s “Children under 13” section is the United States’ number, and in the Union the number is your country’s:

13BE · DK · EE · FI · LV · MT · PT · SE

14AT · BG · CY · ES · IT · LT

15CZ · FR · GR · SI

16DE · HR · HU · IE · LU · NL · PL · RO · SK

27 member states. Read live from the table the app itself consults, so a member state that changes its law changes this page the same day. Where we do not know which country you are in we use 16, the highest, and asking you where you are may mean we ask you for less. Only a birth year is ever stored, so a child is treated as under the age for the whole calendar year in which they reach it.

Two things do not move with this number. Every one-to-one lesson with anyone under 18 is recorded, with your permission, in every country — that is our own safeguarding rule, not Article 8’s. And no child has an account here: the guardian’s session is the only session.

Paying from the Union

Live Lessons are bought on our website, in your browser, not through the App Store; Apple is not part of the purchase. The person buying is always you, the guardian — no child has an account here, so no purchase is ever offered to a child, which is also how we meet Apple’s rule for purchases made outside its store. The price you are shown is the price you pay: VAT on our service fee — the part of the price that is ours, not the teacher’s — is charged at your member state’s standard rate and is inside that price rather than added to it, and your receipt shows the amount and the rate. Rates are refreshed by hand (last checked 18 September 2026). We keep the payment record for as long as tax law requires, and nothing else about your family that long.

What you can ask for

Access — a copy of everything we hold about your family · Art. 15

Write to privacy@alifbataza.com. Within 30 days, in a form you can read.

Rectification · Art. 16

Your child's name, birth year and riwayah you can change yourself in the Family tab; anything else, write to us.

Erasure · Art. 17

Remove a child in the Family tab, which deletes their profile and everything in it; or write to us for the whole family. Payment records are kept for the period tax law requires and nothing else is.

Restriction and objection · Arts. 18 and 21

Write to us. Where processing rests on our legitimate interest, we stop unless we can show a ground that overrides yours.

Portability · Art. 20

The copy under Art. 15 is machine-readable (JSON) on request.

Withdraw a consent · Art. 7(3)

Family tab, any time. Withdrawal does not affect what was lawful before it.

Complain to a supervisory authority · Art. 77

You may complain to the authority in your own member state, whatever we have or have not done about your request first.

Lesson recordings are deleted 12 months after the lesson whether or not you ask. We do not make decisions about your family by automated means alone, and we do not profile children.

Schools, masjids and other organisations

A school, a masjid or any other organisation that buys seats for children it is responsible for is a controller in its own right, and we are its processor for that data. We sign a data processing agreement under Article 28 on request — write to the address below and say which organisation you are.

How to reach us

Write to privacy@alifbataza.com — a person reads that address, and answers within 30 days. You may also complain to the supervisory authority in your own member state at any time.

Barro Services LLC · Alif Ba Ta Tha · privacy@alifbataza.com