Effective date: September 18, 2026

AZ Software ("we", "us", or "our") provides the Madaris parent mobile application (the "App") to participating schools and their authorized parents or guardians. This policy explains how information is processed when you use the App.

1. Who controls the information

The participating school is responsible for the school, family, and student records it enters or imports and for deciding which authorized users may access them. AZ Software operates the App and its technical services on the school's behalf. Questions about the accuracy of school records should first be directed to your school.

2. Information we process

• Account and authentication data: parent or guardian phone number, family access code, account identifiers, authentication tokens, preferred language, and login/session timestamps.
• School and student data: school, family and student identifiers; student and family names; grade, class, gate, and related school assignments.
• Educational and administrative records: timetable, subjects, teacher names, marks, activities, notices, student-pickup information, and appointment information.
• School messages and photo delivery: message text, captions, links, photos sent by authorized school personnel, recipient-account associations, and download or receipt status and timestamps. Photos may contain students, schoolwork, or school activities.
• Delivery and local-storage identifiers: an app-generated installation identifier, message identifiers, and file integrity information used to complete photo delivery, prevent duplicate delivery to the same account, and manage retries. These are not advertising identifiers.
• Payment records: school-entered descriptions, amounts, balances, currency, and due dates. The App does not process card payments and does not collect card or bank-account details.
• Information you submit: appointment requests and notes, appointment responses, student pickup calls, and notification-deletion choices.
• Device and technical data: device platform, device name, application version, push-notification token, language, request timestamps, security events, and limited diagnostic information such as error or correlation identifiers.

3. How we use information

• Authenticate authorized parents and maintain secure sessions.
• Display information for students and schools linked to the parent account.
• Deliver school notices, marks, payment records, activities, schedules, and appointment updates.
• Download and display school photos, confirm successful local saving, and open school links when you choose them.
• Download and locally retain the logo of the selected student's school for display on the home screen.
• Send and manage student pickup requests.
• Send push notifications when the user grants notification permission.
• Protect accounts, prevent misuse, troubleshoot errors, and maintain service reliability.
• Comply with applicable legal obligations and valid requests from authorized schools or authorities.

4. Push notifications

If you enable notifications, the App registers a device token and uses Firebase Cloud Messaging to route notifications to Android and Apple devices. The token, device platform, language, notification text or previews, and notification-routing information may be processed for delivery by these providers. Depending on your device settings, notification previews may appear on the lock screen. Photo files are retrieved separately through authenticated Madaris requests when you open the photo feature. You may disable notifications in your device settings. Logging out deactivates the current device registration in the App.

5. Sharing and service providers

Information is available only to the relevant school, authorized school personnel, linked parent accounts, AZ Software personnel who require access for support or operations, and contracted infrastructure providers that process data to operate the service. Firebase Cloud Messaging is used for push delivery. Apple and Google may also process platform data under their own privacy policies.

We may disclose information when required by law, to protect users or the service, or as part of a business transfer subject to appropriate confidentiality and legal safeguards.

6. Device storage, permissions, links, and advertising

Photos and storage: school photos you download are saved in the App's local storage so you can view them again on that device. Receiving these photos does not require camera access or permission to browse your personal photo library. The App does not scan or upload your personal photo library and does not automatically save received images to your public gallery.

School logos: the App downloads and reuses public school-logo images in local storage, showing the logo for the selected student's school. Logos are separate from private school-message photos.

Your choices: you choose whether to open a photo or link, and you can manage notification permission in device settings. Clearing the App's data or uninstalling it may remove local photos and logos.

External links: when you choose a link or link attachment, the App opens it using your device's browser or link handler. The destination website or app operates under its own privacy policy and may receive normal browsing information, such as your IP address, browser information, and information included in the link. Madaris does not control that destination's cookies or data practices. Links may appear in school notifications, message text, or attachments.

The App contains no third-party advertising and does not use personal information to track you across apps or websites owned by other companies. We do not sell or rent personal information.

7. Retention and deletion

Photo delivery: each school photo message is delivered once per parent account, even if more than one selected child is linked to that account. Different parent accounts linked to the same child receive separate deliveries. Interrupted downloads or receipt confirmations can be retried.

The parent app verifies and saves a downloaded photo locally before sending a receipt confirmation. After receiving that confirmation, the server marks the account's delivery as received and attempts to delete its server copy; temporary deletion failures are retried by cleanup processing. Reading the notification text alone does not confirm photo receipt. Photos not downloaded expire after the school's configured retention period, which defaults to 30 days from publication, and are then removed by cleanup processing.

Local copies: a downloaded photo remains in the App's storage for the account that received it. Signing out does not itself delete that photo. Deleting the corresponding notification in the updated App also removes its associated local photo. If you delete the notification before downloading its photo, the pending server delivery copy is marked for cleanup. After delivery is confirmed, the service does not provide the same photo again to another device using that parent account. If the local copy is deleted, app data is cleared, the App is reinstalled, or the device is changed, you may lose access to that photo and need to ask the school to send a new message.

Removal from active server storage does not remove a downloaded copy on another recipient's device, screenshots, or any separately held backups. Device backups and copies saved outside the App are governed by the device settings or the party holding those copies. Public school logos may remain cached until app data is cleared or the App is removed.

School and student records are retained according to the participating school's operational, academic, contractual, and legal requirements. Authentication, device, security, audit, pickup, appointment, message text, links, recipient, and delivery records may be retained for security, support, accountability, and legal purposes.

The App allows a parent to remove selected notifications from that parent's view. This does not necessarily delete the school's original record or records that must be retained for audit or legal reasons. To request access, correction, restriction, or deletion of your account and associated data, contact the participating school or AZ Software at the address below. We may need to coordinate the request with the school and verify your identity. Removing the App or signing out does not by itself delete your account or the school's records.

8. Security

We use reasonable administrative and technical safeguards, including encrypted network connections, access controls, scoped school accounts, protected authentication tokens, and server-side security monitoring. No system can guarantee absolute security.

9. Children's and student privacy

The App is intended for parents and legal guardians, not for independent use by children. It necessarily processes student information supplied by participating schools or authorized guardians to provide educational and pickup services. Schools and guardians are responsible for providing appropriate notices and permissions where required, including for photographing students and sharing their images with the intended parent recipients.

10. International processing

Service and push-notification providers may process information in countries other than your own. Where required, we and participating schools use appropriate contractual and legal safeguards for such processing.

11. Changes to this policy

We may update this policy to reflect changes to the App, legal requirements, or service providers. The revised policy becomes effective when posted with a new effective date.

12. Contact us

For questions about school or student records, contact your school. For technical privacy questions about the App, contact AZ Software at tariq@azayed.me.