Privacy Policy

Last updated: 3 July 2026

1. Who we are & how to contact us

USP Media Design — email info@uspmediadesign.com. If your child attends a madrasah that uses IlmFlow, that madrasah is the controller of your child’s records; please contact them for requests about that data, and we will assist them as their processor.

2. Information we handle

Depending on your role, this may include:

• Students: name, date of birth, gender, class, attendance, Qur’an/Hifz progress, exam results, fee records, and parent/guardian contact details.
• Parents/guardians: name, email, phone, and the link to your children.
• Staff: name, contact details, and payroll information (tax code, National Insurance number, pay, pension, bank details) needed to run UK payroll.
• Account & usage: login email, password (stored hashed), and basic technical logs to keep the service secure and working.
• Website enquiries: details you submit when booking a demo or contacting us.

3. Why we use it (lawful basis)

• To provide the madrasah management service the madrasah has engaged us for (contract / legitimate interests, and the madrasah’s own lawful basis as controller).
• To send attendance and account notifications to parents and staff.
• To process fee payments and run staff payroll, including submissions to HMRC where required (legal obligation).
• To respond to demo requests and enquiries (legitimate interests / consent).
• To keep the service secure and to comply with law.

4. Service providers we use

We share data only as needed with trusted providers who process it on our instructions:

• Hosting — our own UK server infrastructure.
• Email — Resend, to send notifications and transactional email.
• Payments — Stripe, for online fee payments (money goes to the madrasah’s own bank; we do not store card numbers).
• Payroll / HMRC — payroll data is submitted to HM Revenue & Customs where legally required.
• AI features — where a madrasah uses AI exam-paper generation, the content provided for that feature is processed by our AI provider (Anthropic) solely to generate the requested output.
• Analytics — our public marketing website uses privacy-friendly analytics only after you accept cookies; the logged-in app is not tracked.

5. Children’s data

IlmFlow holds records about children on behalf of the madrasah. We handle this data only to provide the service, apply appropriate safeguards, and never sell it or use it for advertising. The madrasah, as controller, is responsible for the lawful basis for holding pupil data.

6. How long we keep it

We keep data for as long as the madrasah’s account is active and as needed to provide the service, then delete or anonymise it in line with the madrasah’s instructions and legal retention requirements (for example, payroll records must be kept for the periods HMRC requires).

7. Security

Passwords are stored hashed, access is restricted by role, each madrasah’s data is kept separate from every other madrasah’s, and payments are handled by Stripe. We take reasonable technical and organisational measures to protect personal data.

8. Your rights

Under UK GDPR you have the right to access, correct, delete or restrict your personal data, to object to certain processing, and to data portability. For a child’s or pupil’s records held in IlmFlow, please contact the madrasah (the controller); we will support them in responding. For our website/enquiry data, contact us directly. You may also complain to the Information Commissioner’s Office (ico.org.uk).

9. Cookies

The public website uses only essential cookies plus optional analytics cookies that load solely if you accept them. The IlmFlow app uses cookies necessary to keep you securely signed in.

10. Changes

We may update this policy from time to time; the “last updated” date above shows the latest version.

Questions about this policy? Email info@uspmediadesign.com.