Privacy Policy — Tarteeb

Last updated: 3 September 2026

NOT YET REVIEWED BY A LAWYER. This describes what the system actually does with data, verified against the live schema on 3 Sep 2026. It is accurate, not authoritative. It must be reviewed by a qualified lawyer before Tarteeb takes on a paying customer — particularly the sections on children and on the controller/processor split.

Tarteeb is a platform that lets teachers and coaching centres publish recorded lessons to their own students. This policy explains what we collect, why, and who else can see it.

1. Who is responsible for your data

This matters and it is easy to get wrong, so it is stated first.

• If you are a student, the coaching centre or teacher who enrolled you decides what data about you exists here. They added you, they set your access, and they can remove it. Tarteeb stores and processes that data on their instructions. Requests to see, correct, or delete your data should go to them first; we will act on their instruction and will also act on a direct request where the law requires it.
• If you are a teacher or a coaching centre, you are responsible for the student data you enter, including having a lawful basis to enter it.
• Tarteeb is responsible for its own account records, security, and the operation of the service.

2. What we collect

Everything below is stored in our database. Nothing else about you is collected by us.

Account (everyone with a login)

• Name, email address, phone number, and an optional avatar image
• A hashed password — we never store or see your actual password
• Two-factor authentication settings, if you enable them

Students

• Name, email address, phone number
• Which centre enrolled you, which subjects you can access, and when that access starts and ends
• A student record can exist before you ever create a login. A centre may add you by name, email and phone so they can enrol you; the record links to a login only when you sign in for the first time.

Learning activity

• Which lesson you watched, how far through it you got, its length, and when you finished it
• This is visible to the teacher who owns the subject and to staff at your centre. It is used to show progress. It is not sold, and it is not used for advertising.

Join requests

• If you ask to join a centre using a join code: your name, email, phone, and any message you write, plus whether the request was approved

Centres

• Centre name, logo, description, contact email and phone, and brand colours

Operational records

• An audit log of significant actions — who did what, to which record, and when
• Standard server logs kept by our infrastructure providers

We do not collect payment card details, location data, contacts, biometrics, or advertising identifiers. There are no third-party advertising or analytics trackers in the student app.

3. Video and lesson content

Lesson videos are uploaded by your teacher or centre, not by us. They are stored encrypted at rest in private storage and are never publicly listable. Playback requires a short-lived signed link issued only after we check that you are enrolled and that your access has not expired or been withdrawn.

4. Who else processes your data

We use a small number of service providers. They process data on our instructions and are not permitted to use it for their own purposes.

Your data is stored primarily in Japan and may be processed in the United States by the providers above.

We do not sell personal data. We do not share it with advertisers.

5. Children

Tarteeb is used by coaching centres whose students are frequently under 18.

• Students do not sign themselves up. A centre enrols them, or they request to join a specific centre using a code that centre gave them.
• We rely on the centre to obtain any consent required from a parent or guardian before entering a child's details.
• A parent or guardian may ask the centre to remove a child's record at any time. The centre can do this itself; if they do not, contact us.
• We do not knowingly collect data from a child who has no connection to a centre using Tarteeb.

Flagged for legal review. The consent chain above is a design decision, not yet a verified legal position under Pakistani law or any other regime Tarteeb may operate in.

6. How long we keep it

• Account records — while your account exists, and for a short period after deletion so we can honour audit and legal obligations.
• Student records and enrolments — until the centre deletes them.
• Learning activity — kept alongside the enrolment it belongs to.
• Audit logs — kept for security and dispute resolution.
• Lesson videos — belong to the teacher or centre and are removed when they remove them.

When a centre's account is closed, its data is scheduled for deletion.

7. Your rights

You can ask to access, correct, or delete your data, or to object to how it is used. Students should ask their centre first, because the centre controls that data and can act immediately.

Where we hold data as the responsible party — your own account record — contact us directly and we will respond.

8. Security

• All traffic is encrypted in transit.
• Videos are stored in private storage and served only through short-lived signed links.
• Access is enforced at the database level, so one centre cannot read another centre's data even if the application has a bug.
• Two-factor authentication is available and is required for staff accounts.

No system is perfectly secure. If we discover a breach affecting your data, we will tell you and any regulator we are required to notify.

9. Changes

If we change this policy in a way that materially affects you, we will say so in the app before the change takes effect.

10. Contact

Email: privacy@tarteebedu.com

If you are a student, contacting your coaching centre will usually be faster.