Privacy Policy
Effective date: · Last updated: · Version: 1.9
1. Who we are
Haske is an online Islamic school offering live one-to-one classes in Quran, Hadith, and Arabic to the Nigerian Muslim community, accessible at haskehq.com. Haske is a product operated by Flexigrid Solutions Ltd (“we”, “us”, “our”, or “Haske”), a company registered in Nigeria with registration number RC 8642152, at Plot 1366, Edmund Madani Crescent, Abuja, FCT, Nigeria.
For the purposes of the Nigeria Data Protection Act 2023 (the “NDPA”), we are the data controller of the personal data described in this Policy — meaning we determine how and why your personal data is processed — and we process personal data in accordance with the NDPA. Flexigrid Solutions Ltd is registered with the Nigeria Data Protection Commission (the “NDPC”) as a data controller of major importance, registration number NDPC/DCP/14276.
This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your data. It applies to everyone who uses Haske — guardians and their children, teachers, publishers, and reviewers.
2. A note for parents and guardians (plain language)
Because Haske teaches children, we have written this section in plain language so that both parents and older children can understand it. The rest of this Policy gives the full detail.
- A child cannot open a Haske account on their own. A parent or guardian opens the account and adds their child as a “learner”.
- We ask the parent or guardian to give consent before we collect any information about their child, and we keep a record of that consent.
- The parent or guardian stays in control — they book the classes, make payments, receive the class links, and can ask us to correct or delete their child’s information at any time.
- We only collect the information we need to run the classes. We do not sell anyone’s data, and we do not show advertising.
3. The personal data we collect
We collect the following categories of personal data, depending on who you are and how you use Haske.
| Category | What it includes |
|---|---|
| Account & identity | Your name, email address, password (stored only in encrypted/hashed form, never in plain text), profile photograph, and timezone. For family accounts, the country and state or region you live in, and the account holder’s phone number. We use the phone number only so that Haske staff can call or message you about your classes, bookings and account. It is never shown to teachers, and we do not collect a phone number for a child. |
| Learner (child) records | For a child added by a guardian: the child’s first and last name, date of birth, and gender. We use gender, together with age, only to match a learner with a suitable teacher — a boy under 18 may be taught by a male or a female teacher, as his parent or guardian chooses, and a male learner aged 18 or over is shown and taught only by male teachers — and it is never shown to other families or published anywhere. A child is a record under the guardian’s account, not a separate login. |
| Teacher & publisher applications | If you apply to teach or publish: your full name, phone number, gender, country and city, home address, qualifications, and the documents you upload to prove them (degree and course certificates, ijazah certificates, introductory video, writing samples). We ask for proof of every credential you claim, so that families can trust what a teacher’s profile says. |
| Teacher identity checks | Once a teaching application is approved, we ask that teacher for a government-issued ID (such as a National ID or NIN slip, international passport, driver’s licence or voter’s card) before any family can book them. We do this because our teachers work one-to-one with children. We keep the document — we may need to look at it again to investigate a safeguarding concern involving a child, to resolve a dispute about a class or a payment, or to investigate suspected fraud or impersonation. Only our administrators can open it; it is never shown to families or to other teachers, it is stored so that it cannot be opened without our authorisation, and every time an administrator opens it we record who did so and when. We keep it for as long as the teacher works with Haske and for 24 months after they leave, after which it is deleted automatically — unless we still need it for an open safeguarding or dispute case, in which case it is kept until that case is resolved. We also keep a record of which type of document we saw, when it was checked and who checked it. If an application is not approved, we never ask for this at all. |
| Financial | For teachers, publishers, and reviewers who receive payments: your bank name, account name, and a secure payment token from our payment processor. We do not store your full bank account number — only the last four digits, for your reference. For guardians who make payments: transaction records (amounts, dates, and a payment-provider reference). |
| Live class audio and video | While a class is taking place, the audio and video from your device are carried between you and your teacher so the lesson can happen. Your teacher may also show their own screen during a class — for example, a page of the Quran — as a picture only, without sound. A student’s screen is never shared. This is live only — we do not record classes, and neither we nor our video provider keep a copy of the lesson afterwards. |
| Consent & agreement records | Records of parental consent (the time given, the version of this Policy consented to, and the method). When you sign an agreement with us, we also record the IP address and device/browser information at the moment of signing, as evidence that the agreement was made. |
| Content you provide | Biographies, learning goals, feedback on classes, reviews, and (for reviewers) notes about applications. |
| Technical & usage | A pseudonymous visitor identifier and limited information used to understand which of our free articles lead to class bookings (see Section 8). We also record the date and time you last signed in to your account, so that our staff can see whether an account is in use and follow up with families who may need help getting started. While you are signed in and using the site, we also record the time you were last active, so that our staff can see who is online at the moment and help in real time. For each, we keep only the most recent time, not a history, and we do not record which pages you visit or what you do while signed in. We do not run third-party advertising or analytics trackers. |
4. How we collect your data
We collect personal data:
- directly from you — when you register, add a learner, apply to teach or publish, complete your profile, make a booking or payment, sign an agreement, or contact us;
- from a guardian — in the case of a child’s information, which is provided by the parent or guardian who holds the account; and
- automatically — limited technical information when you use the site, as described in Sections 3 and 8.
5. Why we process your data, and our lawful bases
Under the NDPA we must have a lawful basis for processing personal data. We rely on the following:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account; delivering classes; processing bookings, payments, and payouts | Performance of a contract with you (our Terms of Service). |
| Processing a child’s personal data | The consent of the child’s parent or guardian, obtained before processing and recorded by us. |
| Keeping financial and transaction records; complying with data-protection and other legal duties | Compliance with a legal obligation. |
| Keeping your account secure, preventing fraud and abuse, and improving the service | Our legitimate interests, balanced against your rights. |
| Optional communications you ask to receive | Your consent, which you may withdraw at any time. |
6. Children’s data
Haske is designed so that a child is never the account holder. We treat everyone under 18 as a child for the purposes of the NDPA.
- The guardian is the account holder. A parent or guardian registers, and is the person we contract with, bill, and communicate with.
- A child is a “learner” record under the guardian’s account, not an independent login. The guardian provides the child’s name, date of birth and gender, and manages the child’s classes. Gender, together with age, is used only to match the child with a suitable teacher.
- We obtain and record parental consent before processing a child’s data. We record an explicit consent action together with the version of this Policy consented to, the date and time, and the method. We never assume or pre-tick consent.
- A person who registers and indicates they are under 18 is directed to have a parent or guardian create the account instead.
A parent or guardian may review, correct, or request deletion of their child’s personal data at any time using the contact details in Section 13. Where we later make material changes to how we handle children’s data, we will seek renewed consent as appropriate.
9. Transfers outside Nigeria
Some of the service providers in Section 7 (for example, our file storage, email, and video providers, including LiveKit, which carries live class video) operate on infrastructure that may be located outside Nigeria. Where your personal data is transferred outside Nigeria, we take steps consistent with the NDPA to ensure it remains protected, including relying on providers that offer an adequate level of protection or contractual safeguards. By using Haske you understand that your data may be processed outside Nigeria for these purposes.
10. How long we keep your data
We keep personal data only for as long as we need it for the purposes set out in this Policy, and to meet our legal obligations. In general:
- Account and learner data — for as long as your account is active, and for a reasonable period after the account is closed, as required to meet our legal and operational obligations.
- Teacher identity documents — for as long as the teacher works with Haske and for 24 months after they leave, after which they are deleted automatically. Where a safeguarding or dispute case is still open, the document is kept until that case is resolved. See Section 3.
- Financial and transaction records — retained for as long as required by applicable Nigerian tax and financial law, even after an account is closed.
- Signed agreements and parental-consent records — retained as evidence for as long as necessary to establish, exercise, or defend legal claims.
- Backups — personal data may persist in secure backups for up to 7 days after deletion, until the backup cycle rotates.
11. Your rights
Under the NDPA you have the right to:
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- request deletion of your personal data (“erasure”), subject to the exceptions below;
- object to or restrict certain processing;
- withdraw consent where we rely on it (this does not affect processing already carried out);
- data portability — to receive certain data in a usable format; and
- lodge a complaint with the NDPC.
A guardian may exercise these rights on behalf of their child.
Please note that some data cannot always be fully erased. Where we are legally required to keep certain records (for example, financial and transaction records), we will remove or de-identify your personal information while retaining the minimum records the law requires. We will tell you when this applies to a request.
12. Exercising your rights, and how we protect your data
Making a request
You can request erasure of your account from within the Haske app, or exercise any of your rights by contacting us using the details in Section 13. An administrator reviews and actions erasure requests. We aim to respond within a reasonable time and in accordance with the timeframes required by the NDPA.
How we protect your data
- Passwords are stored only in hashed form; we never hold them in plain text.
- Full bank account numbers are held by our payment processor, not by us — we keep only a secure token and the last four digits.
- Access to personal data is restricted to the roles that need it, and sensitive operations run on our secured servers.
- Data is encrypted in transit, and we take reasonable technical and organisational measures to protect it.
- A teacher’s identity document is held under stricter controls than anything else on the platform: it cannot be opened from a link alone, each viewing has to be separately authorised by us and expires within minutes, only administrators can request one, and every request is recorded against the administrator who made it. See Section 3.
If something goes wrong
No organisation can promise that a system will never be compromised, and we do not make that promise. What we can commit to is what happens next. If a personal data breach occurs, we will investigate it, take steps to contain it, and notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the NDPA requires. Where a breach is likely to result in a high risk to your rights and freedoms, we will also tell you directly and without undue delay, and explain what has happened and what you can do about it. Where the data affected concerns a child, we will tell the parent or guardian on the account.
13. Contact us about your data
If you have any question about this Policy, or wish to exercise any of your rights, please contact us:
Flexigrid Solutions LtdEmail: info@flexigridsolutions.comAddress: Plot 1366, Edmund Madani Crescent, Abuja, FCT, Nigeria
You also have the right to lodge a complaint directly with the Nigeria Data Protection Commission if you believe your personal data has been handled unlawfully.
14. Changes to this Policy
We may update this Policy from time to time. When we do, we will change the “Last updated” date and version above, and, where a change materially affects how we handle personal data — particularly children’s data — we will take appropriate steps to notify you and, where required, seek renewed consent. The version recorded against your consent tells you which version of this Policy you agreed to.
Questions about this Policy?
Write to us at info@flexigridsolutions.com, read our Terms of Service, or visit the Help Center for answers to common questions about bookings, payments, and classes.