Privacy Policy

1. Who we are

Alif Cloud is school management software operated by TayoPro LLC, a Minnesota limited liability company doing business as Alif Cloud, from Minnesota, United States.

Registered address: 4951 W 77th St Suite 133, Edina, MN 55435. Privacy contact: privacy@alifcloud.com.

This policy covers our website at www.alifcloud.com, our web application, and our mobile applications for iOS and Android.

2. Our two roles: controller and processor

This is the most important distinction in this policy.

3. Where the Service is offered

The Service is offered to schools in the United States and Canada only. It is not directed at, offered to, or intended for individuals located in the United Kingdom, the European Union or European Economic Area, Switzerland, Australia, or elsewhere outside the United States and Canada. We do not target those markets, price in their currencies, or provide localized versions for them.

All personal information we hold is stored and processed in the United States. By using the Service you understand that your information will be handled in the United States, which may have different data protection rules than your own location.

If you are located outside the United States and Canada, please do not use the Service or submit personal information to us.

4. Information we collect as controller

5. How we use information we control

• To provide, operate, secure, maintain and improve the Service.
• To create and administer accounts, authenticate users, and verify sign-ins from new locations.
• To process payments, issue invoices and manage subscriptions.
• To respond to enquiries and provide support.
• To send service and administrative messages — billing notices, security alerts, and notice of changes to these documents. You cannot opt out of these while you hold an account, because they are part of the Service.
• To send marketing emails about Alif Cloud, where you have subscribed or are an existing customer. Every marketing email includes an unsubscribe link.
• To detect, investigate and prevent fraud, abuse, security incidents and violations of our Acceptable Use Policy.
• To produce aggregated, de-identified analytics about how the Service is used, in a form that cannot reasonably identify an individual or a school.
• To comply with law and to establish, exercise or defend legal claims.

6. What we do not do

• We do not sell personal information, and we have not sold it in the preceding 12 months.
• We do not share personal information for cross-context behavioural advertising.
• We do not use student data for advertising of any kind.
• We do not build a profile of a student for any purpose other than providing the Service to that student's school.
• We do not use school or student data to train machine-learning models for the benefit of anyone other than the school it came from.
• We do not use automated decision-making that produces a legal or similarly significant effect on any individual.

7. When we share information

We do not disclose personal information except as described here.

8. How long we keep information

• Account and contact information: for as long as the account is active, and then as described in our Terms of Use.
• School and student data: as directed by the school. After termination we retain it for 90 days to allow retrieval, then delete or de-identify it, except for routine backups running out their normal cycle and anything we must keep by law.
• Billing and tax records: as long as required by tax and accounting law.
• Security, audit and sign-in logs: for a limited period appropriate to their security purpose.
• Marketing contact details: until you unsubscribe, plus a suppression record so we do not contact you again.
• Support and chat records: for a reasonable period after the matter is closed.

9. Student and family data

Schools use Alif Cloud to hold records about students and their families. Depending on what the school chooses to collect, this can include name, date of birth, place of birth, nationality, gender, photograph, health notes, home address, guardian contact details, attendance, grades, Quran and Arabic curriculum progress, behavior and disciplinary records, pickup arrangements, invoices and payments, signed documents, and SMS conversations.

The school decides which of these fields to enable and which to require. We do not choose, and we do not add fields of our own.

We use student data only to provide the Service to the school that supplied it, to keep it secure, to support the school, and where the law requires. We do not use it for any independent purpose.

If you are a parent, guardian or student: your school is the right place to ask about the records held about you. It controls them and can correct or delete them. If you contact us directly, we will refer you to your school and let the school know.

10. FERPA

Where a school is subject to the Family Educational Rights and Privacy Act, the school designates Alif Cloud as a "school official" with a legitimate educational interest in the education records we process, under 34 C.F.R. § 99.31(a)(1).

In that role we use education records only for the purposes the school authorizes, remain under the school's direct control as to their use and maintenance, do not redisclose them without the school's authorization except where the law requires, and delete or return them at the school's direction.

Our Student Data Privacy Addendum sets these obligations out in full and is the operative document for a school's procurement review.

11. Children's privacy

Alif Cloud is not offered directly to children. Accounts are created by schools, and any access a student has comes from their school.

Where a school uses the Service with children under 13, the school is responsible for providing the notices and obtaining the consents required by the Children's Online Privacy Protection Act and by its own policies. Many schools rely on the school-consent mechanism, under which the school consents on behalf of parents for a service used solely for an educational purpose. Because that mechanism depends on the school's own circumstances, the school must satisfy itself that it applies, and we recommend the school also inform parents directly.

We collect personal information about children only as the school directs, use it only to provide the Service to that school, never use it for advertising, never condition a child's participation on collecting more information than is reasonably necessary, and delete it at the school's direction or when it is no longer needed for the purpose the school gave it to us for.

A parent who wants to review or delete information about their child should contact their school. A school that wants us to delete a child's information should contact privacy@alifcloud.com.

12. State student privacy commitments

Many US states impose obligations on providers of school services. We commit to the following across all schools we serve, regardless of state:

• We do not sell student data.
• We do not use student data to serve targeted advertising, on or off the Service.
• We do not use student data to create a profile of a student except in furtherance of the school's educational purposes.
• We use student data only for the educational purposes authorized by the school, and for maintaining, supporting and securing the Service.
• We delete or return student data at the school's request.
• We maintain administrative, technical and physical safeguards designed to protect student data.
• We notify the school of a security incident affecting student data as described in Section 15.
• We require our subprocessors to accept equivalent obligations.

13. Security

We take reasonable and appropriate measures designed to protect personal information against unauthorized access, disclosure, alteration and destruction. These include:

• Encryption of data in transit using industry-standard TLS.
• Encryption of data at rest using industry-standard encryption, provided at the platform level by our managed hosting provider, Cloudways.
• Password hashing — we cannot read your password.
• Role-based access control, so each user sees only what their role permits.
• An emailed verification code when an account is accessed from an unrecognized country or city, and one-time codes for phone-based parent sign-in.
• An audit log recording who took which action on which record, and when.
• Restriction of internal access to personnel who need it for a defined purpose.

14. Your choices and rights

15. Security incidents

If we become aware of a security incident that has compromised personal information we hold, we will notify the affected school without undue delay and in any event within seven days of confirming the incident. We will describe what we know, what we are doing, and what we recommend.

The school, as controller, is responsible for determining whether it must notify individuals, regulators or others, and for making those notifications. We will provide the information the school reasonably needs to do so.

16. Changes to this policy

We may update this policy. The "Last updated" date above shows when it last changed.

For a change that materially reduces your rights or materially expands how we use personal information, we will give at least 30 days' notice by email to account administrators or by prominent notice on the Service before it takes effect. Other changes take effect when posted. We will not materially reduce the protections applying to student data already collected without the school's consent.

17. How to contact us

Privacy enquiries and requests: privacy@alifcloud.com

TayoPro LLC (doing business as Alif Cloud), 4951 W 77th St Suite 133, Edina, MN 55435

Phone: (612) 293-0636

We aim to acknowledge privacy enquiries within five business days.