Privacy Policy

1. Who is responsible for your data

Thalhaa Hussain, trading as Iktisaab, a sole trader in the United Kingdom, is the data controller for personal data collected through iktisaab.com ("the Service").

Trading address: 253 Brook Lane, Birmingham, B13 0TL, United Kingdom
Contact for privacy matters: [email protected]

2. What we collect

Information you give us

• Email address and password (stored hashed) when you create an account
• Any display name you choose
• Messages you send us for support

Information created by your use of the Service

• Videos you have watched or imported, and your position in them
• Words you have looked up and saved
• Flashcard decks, review history and scheduling data
• Learning progress, streaks and completion records
• Account and subscription status

Information collected automatically

• IP address, browser type, device type and operating system
• Pages visited, features used, and timestamps
• Error and diagnostic logs

Information from Paddle
When you buy a subscription, Paddle processes your payment and shares limited information with us: your email address, country, subscription tier and payment status. We never see or store your full card details.

3. Why we use it, and our legal basis

You can withdraw consent at any time. Withdrawing consent does not affect processing that already took place.

4. Who we share it with

We share personal data only with service providers who process it on our behalf, under written contracts, and only to the extent they need it to run the Service. The categories of recipient are:

• Payment processing — Paddle, our online reseller and Merchant of Record, handles all payments, subscriptions and billing enquiries
• Cloud hosting and database services — hosting of the application and its database
• Email delivery — SendGrid (Twilio), for transactional and account email
• Automated language processing — Google (Gemini API), for subtitle correction, diacritization and translation
• Automated speech transcription — third-party speech-to-text services
• Usage analytics — tools that help us measure how the Service is used

We will tell you the identity of any provider in these categories on request. Email [email protected].

We do not sell your personal data, and we do not share it for advertising purposes.

We may disclose data where required by law, or to establish or defend legal claims.

Third-party video playback

Videos are played through YouTube's embedded player. We use YouTube's privacy-enhanced (nocookie) mode, which limits tracking, but YouTube and Google may still collect data about your interaction with the player. This is governed by Google's Privacy Policy, not ours.

5. Automated language processing

Subtitle text from videos is sent to third-party AI providers for correction, diacritization and translation. This text comes from publicly available video content, not from your personal data. Words you look up are sent as part of the surrounding sentence, without any information identifying you.

6. International transfers

Some of our providers are based outside the UK, including in the United States. Where data is transferred outside the UK we rely on UK adequacy regulations or on the International Data Transfer Agreement / Addendum, together with appropriate safeguards.

7. How long we keep it

• Account data — while your account is active, and for 30 days after deletion
• Learning progress and flashcards — while your account is active
• Payment and transaction records — 6 years, as required by UK tax law
• Support correspondence — 2 years
• Server and security logs — 90 days

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted
• Restrict or object to how we process your data
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent

To exercise any of these, email [email protected]. We will respond within one month.

You can delete your account at any time from your account settings, which removes your personal data subject to the retention periods above.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

9. Security

We protect your data using encryption in transit (HTTPS), hashed password storage, access controls, and regular software updates. No system is completely secure, but we take reasonable steps to protect your information, and we will notify you and the ICO of any breach where required.

10. Children

The Service is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact [email protected] and we will delete it.

11. Cookies

See our Cookie Policy at https://iktisaab.com/cookies.

12. Changes

We may update this policy. Material changes will be notified by email or in-app at least 30 days in advance. The date at the top shows when it was last revised.