Privacy information and choices
Find the information or action you need:
- Feedback and diagnostics privacy — how feedback and optional diagnostics are used.
- Privacy requests — request access, correction or eligible deletion.
- Privacy settings — manage optional diagnostics.
Information needed to provide the service
We collect personal information needed for accounts, registration, guardian permission, course administration, support and payments. This is not a promise that no personal information is collected.
- Submitted forms: learner and guardian names/contact details, address, date of birth, gender, course choices, prior learning and support/allergy information where requested. Optional notes can be left blank.
- Consent and eligibility: guardian relationship, typed signature, the submitted form wording/version and submission time; discount proof where requested. Cover unrelated private details in evidence.
- Enrollment and finance: reserved Student IDs, registration/canonical references, tuition and assistance/review status, original Stripe or verified bank references. Card details are entered at Stripe; we do not store card numbers.
- Project donations: donor email, chosen project, amount, one-time/monthly agreement version and time, hashed browser ownership token, and original Stripe payment/refund/subscription references. These financial records are kept separately from enrollments and do not allocate Student IDs or grant course access. Card data stays with Stripe.
- Administrators: approved account identity, authenticator records, hashed recovery/session tokens, versioned Terms acceptance/Privacy acknowledgement, optional preference and security/change history.
Unsubmitted registration answers stay in page memory. Submitting creates a real saved record. Assistance requires no immediate payment and does not mark tuition paid or grant LMS access. A parent or legal guardian must complete PTIS registrations and the consent for iComp learners under 18; iComp/Sirah eligibility is 15+.
Optional usage diagnostics and feedback
Usage diagnostics is off until you opt in. It counts broad page areas, generic interactions, API success/failure, error occurrences, coarse speed bands and small/large screens. Strict server categories exclude typed text, form content, names, emails, payment details, tokens, precise URLs/query strings, exception messages/stacks, screenshots, replay, keystrokes and fingerprinting. No extra analytics or advertising provider is used.
Diagnostic events are combined into daily counters; the application does not retain a raw event stream or put an account ID in those counts. Your signed-in preference/acknowledgement is account-linked, and provider request information can still be identifying. Pseudonymous hashes are not automatically anonymous. Necessary abuse prevention uses short-lived daily keyed network hashes.
Feedback is separate and voluntary. We save the text you choose to send, category, area, steps/impact, reference, status and timestamps. Signed-in feedback can be account-linked; guest feedback uses a random cookie hash. Please leave out learner details, payment details and secrets. A warning cannot guarantee that submitted text contains no private information.
Declining optional diagnostics does not block browsing, forms, feedback or administrator work. Privacy settings and the feedback panel let you withdraw; this stops future eligible optional transmission. Account withdrawal also blocks it from other signed-in browsers when their next batch reaches the server. Global Privacy Control and Do Not Track take priority. Necessary sign-in, fraud prevention and service/security processing remain active.
Who can see information and providers
Approved Al-Ihsan administrators can review protected forms and feedback; authorized finance/enrollment staff use the canonical master under their existing access controls. Bot content tools do not grant access to learner submissions or consent evidence. Do not copy learner records into content/work reports.
- Cloudflare: website hosting, D1 database, private uploads and operational/security infrastructure. Worker processing is distributed; the database has been observed in western North America. We do not promise Canada-only storage.
- Google: Firebase administrator sign-in; the existing Google Apps Script receiver and Google Sheets canonical enrollment master; internal reference-only notices sent through Google MailApp to the configured Al-Ihsan mailboxes. The master receives identity/contact details, Student IDs, amounts/status and original payment references. Complete form/consent evidence remains in the protected website inbox.
- Stripe: registration and project-donation checkout, customers/subscriptions, payment references and selected payment webhooks. Stripe receives the registration or donation/billing information required for checkout and processes fraud/security/legal information under its own terms.
Hosting and provider systems can process IP addresses, browser/request metadata and security information even before you sign in or make an optional choice. Our application does not log form bodies or tokens; automatic Worker invocation logging is disabled in the deployed configuration. Necessary provider security/operational processing is separate from optional counters.
Provider processing can occur outside Canada, including the United States, and be subject to local laws. See Cloudflare privacy, Firebase privacy, Google privacy and Stripe privacy. External donation, LMS and other sites have their own notices. We do not sell personal information or use this website for advertising tracking.
180-day usage and feedback retention
Application usage counters and feedback reports use a rolling 180-day retention policy. Daily usage buckets expire after 180 calendar days; feedback reports become eligible 180 days after submission. The existing maintenance trigger runs cleanup every 15 minutes, including when nobody visits. It removes eligible active records on the next successful scheduled sweep; service outages can delay a sweep and are operational failures to investigate. It does not recreate data already deleted under an earlier shorter policy.
The application stores no raw usage event stream. Retry deduplication markers and keyed abuse counters expire after up to two days as necessary service controls. Withdrawal stops future optional reporting; it does not automatically remove existing counts or feedback. You can request eligible deletion.
This 180-day policy does not purge enrollment, tuition/tax/payment evidence, coursework, guardian consent, Terms acceptance, security audit records or MFA keys. Those have separate operational/legal retention and manual review. Some records used for a decision directly affecting a person must be retained at least one year under BC PIPA. No automatic business-record deletion is configured here.
Cloudflare’s published Free-plan Worker log retention is currently three days and D1 Time Travel recovery is up to seven days. Other Google/Stripe logs, records, exports and backups follow their own purposes and recovery/retention cycles. We cannot promise that all provider or backup copies disappear exactly on day 180. Restoring a backup requires running applicable retention checks again.
Your choices and privacy requests
Read the Terms and this notice before administrator access. The required unchecked acknowledgement records document versions and server acceptance time; optional diagnostics is a separate unchecked choice. Existing administrators must review the current versions at their next sign-in/use. Public browsing and registration do not require an administrator login.
Ask Administration at info@ihsan.ca for access, correction, withdrawal or eligible deletion. We verify identity proportionately and explain any service effect or lawful restriction. Do not send passwords, MFA codes or card details. See Privacy requests. You may also contact the BC Information and Privacy Commissioner.
We use server-side access controls, MFA, encrypted connections and private upload controls. No service can guarantee absolute security. Effective 20 October 2026 · website-privacy-2026-10-20-v2. Material changes will be explained and renewed acknowledgement/consent obtained as appropriate.