Privacy Policy | Al-Fajr Academia

Last updated 10 September 2026

1. Who I am

Al-Fajr Academia is not a company. It is one person teaching: Saeed Zafar, who runs the courses, holds the student records, and is personally responsible for everything described on this page. Students come from many countries and the courses are taught entirely online.

Responsible: Saeed Zafar, teaching as Al-Fajr Academia
Email: info@alfajr.se
Phone / WhatsApp: +46 72 761 87 66
Post: A postal address is given on request.

Because this is one person and not an organisation, there is no department to be passed between. Write to the address above and I answer it myself.

2. The short version

I collect the least I can get away with: enough to answer you, enrol you and teach you. The courses are free, so there is no billing and no payment data at all. I do not sell it, I do not advertise on it, I do not track you around the internet, and I delete it when it has done its job. Whatever country you live in, you can ask me what I hold, ask me to fix it, and ask me to delete it.

The rest of this page is the detail behind those sentences. If anything in it is unclear, that is a fault in the writing — ask, and I will explain it and then fix the page.

3. What I collect, and why

Every item below exists for a stated reason. If something is not needed for the purpose next to it, I do not ask for it.

When you send an enquiry

What: Your name, your WhatsApp number, and what you write in the message.
Why: To reply, send the reading list and session times, and work out whether a course suits you.
Where: Straight to my own mailbox on my own hosting. No form service, no third company in between.
Optional?: The whole form is optional, but without a name and a number I have no way to answer.
Kept: 24 months after your last message, then deleted.

When you message on WhatsApp

What: Your number, your WhatsApp display name and photo, and the conversation itself.
Why: The same — answering questions and coordinating with students.
Note: You choose this channel. Email works just as well if you would rather not use WhatsApp.
Kept: 24 months after the last message, then the chat is deleted.

When you enrol and hold an account

What: Your name, email, phone number, which courses you are enrolled in, a scrambled version of your password, and login timestamps.
Why: To give you an account, let you into the right recordings and materials, and run the course.
Passwords: Stored only as a bcrypt hash, which cannot be turned back into your password. I cannot see it, and I will never ask you for it.
Kept: While you are enrolled, then 12 months after your last course ends. Ask sooner and I will close and delete it.

Your coursework

What: The work you hand in, my feedback on it, and your progress through the modules.
Why: To teach and assess you, and to give you a record of what you completed.
Publishing: Your work goes on the Student Projects page only if you say yes in writing, each time. Saying no changes nothing about your course, and you can have it taken down later.
Kept: 3 years after the course ends. Published work stays up until you ask me to remove it.

Live sessions and recordings

What: Your name as it shows in the meeting, your voice if you speak, your face if your camera is on.
Why: So your cohort can review a session and anyone who missed it can catch up. The recording is part of the course.
Your control: You are told before recording starts. You may attend with camera and microphone off and take part by text instead, and you may ask me to cut any passage you appear in.
Who sees it: Only students on that course, only through their own login. Never public, never sold.
Kept: 12 months after the course ends, then deleted.

Server logs

What: Your IP address, the time, the page requested, and your browser's identifier. Written automatically by the web host.
Why: Keeping the site working and secure — finding faults, and spotting attacks and password-guessing attempts.
Not used for: Profiling you, or recognising you between visits.
Kept: Up to 90 days, then overwritten.

Your colour theme

What: One word, light or dark, saved by your own browser when you press the theme button.
Why: To show the site the way you left it.
Note: It never leaves your device and never reaches me. Clearing your browser data removes it.

4. What I never do

I never sell, rent or trade your personal data. Not to anyone, at any price.
I never ask you for card, bank or billing details. The courses are free, nothing here charges you, and so I hold no payment data of any kind.
I run no advertising, no ad pixels, and no third-party trackers on this site.
I run no analytics that follow you between visits.
No decision about you — your place, your work, your progress — is made by software alone. A person makes it, and that person is me.
I send no marketing you did not ask for.
I do not use your coursework, your writing or the session recordings to train machine-learning models, and I do not let anyone else do so.

5. Who else sees your data

Running a course online means using other people's services. Each of these sees a specific slice, and only in order to do its job for me. None of them may use your data for their own ends.

Simply.com: Hosts the website, its database and email. Holds student accounts and everything stored on the site.
Zoom: Runs the live classes and makes the recordings. Sees your display name, and your audio and video if you switch them on.
YouTube (Google): May host recordings as unlisted videos. Nothing is requested from YouTube until you press play — the still image and play button before that come from my own server.
WhatsApp (Meta): Only if you choose to message me there. Sees your number and the conversation.

Beyond these, I disclose personal data only when the law compels it — a court order or a lawful demand from an authority — or where it is genuinely necessary to bring or defend a legal claim. If I am ever compelled to hand over your data, I will tell you unless I am legally forbidden from doing so.

6. Data crossing borders

The providers in section 5 operate internationally, so your data may be processed in a country other than your own. This is unavoidable for a course taught online to students on several continents, and it is worth being plain about what it means: wherever data sits, some government may in principle compel access to it.

What I do about that:

I use providers that publish a data protection agreement and commit to recognised contractual protections for international transfers, and I hold such an agreement with each of them.
I keep what crosses a border to a minimum — the enquiry form and the class recordings, not the whole student record.
Where a provider that keeps data closer to you exists and works, I prefer it. The fonts and icons on this site, for instance, come from my own server rather than a global content network, so opening a page sends your address to nobody at all.

Ask, and I will tell you which provider holds what, and on what terms.

7. How long I keep things

Each retention period is stated in section 3 beside the data it applies to. The principle behind all of them is the same: data is kept for as long as it is doing the job it was collected for, and then deleted. There is no exception to that: the seven-year records tax law usually forces on a business are payment records, and I hold none.

8. Your rights

Different countries grant people different rights over their data. Rather than make you work out which set applies to you, I extend the following to everyone, wherever you live. Exercising them is free, and I will not treat you differently for it.

Know: Ask what I hold about you and what I do with it, and get a copy.
Correct: Have anything wrong put right, and anything incomplete completed.
Delete: Have your data erased, except records the law requires me to keep. Enrolled students do not need to ask: the student portal has a Delete my account button on the account page, and it takes effect at once.
Take it with you: Get the data you gave me in a common machine-readable format, to keep or to pass to someone else.
Object: Tell me to stop a particular use. For anything resembling marketing, I stop immediately and without argument.
Withdraw: Take back any permission you gave — publishing your project, for instance — at any time.
Complain: Raise it with a regulator. Section 11 says where.

Write to the email in section 1. I answer within 30 days, and usually far sooner. I may ask you to confirm who you are first, so that I do not hand your data to somebody pretending to be you.

9. How your data is protected

The whole site is served over an encrypted connection, and browsers are told never to load it unencrypted.
Passwords are stored only as bcrypt hashes with an individual salt.
Recordings and materials are served only to a logged-in student enrolled in that course, never from a folder anyone could stumble on.
Repeated failed logins are throttled, so passwords cannot be guessed at speed.
My own administrative accounts and my hosting account use two-factor authentication.
Nobody but me has access to student records.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If data of yours is exposed in a way that could realistically harm you, I will tell you directly and promptly, describe what happened and what I am doing about it, and notify the relevant regulator within whatever deadline applies.

10. Children

These courses are written for adults. I do not knowingly collect data from children under 13, and anyone under 18 should be enrolled by a parent or guardian, who takes on the agreement. Some countries set a higher age for a young person to agree to online services on their own; where you live in such a country, that higher age applies instead.

If you believe a child has given me personal data without a parent's involvement, tell me and I will delete it.

11. If you want to complain

Come to me first. It is nearly always the fastest way to get something fixed, and I would rather know. But you never have to, and you can go to a regulator at any point:

Most countries have a privacy or data protection regulator, and you are entitled to complain to yours. You do not need my permission and you do not need to have raised it with me first. If you tell me you intend to complain, I will give you whatever you need to make it properly rather than get in the way of it.

12. Cookies and browser storage

This site sets no cookies and runs no tracking, which is why you are not shown a consent banner. Fonts and icons come from my own server rather than an outside network, so opening a page contacts nobody but me.

The one thing written to your browser is the colour theme from section 3, stored because you pressed a button asking for it. When the student portal opens it will add a single sign-in cookie, which exists solely to keep you logged in. If I ever add anything beyond that, I will ask your permission first, and refusing will be exactly as easy as agreeing.

13. Changes to this page

When how I handle data changes, this page changes and the date at the top moves. If a change actually affects you — a new purpose, a new company seeing your data, a longer retention — I will email enrolled students before it takes effect rather than leave you to spot it.

14. Contact

Any question about this page, and any request under section 8, goes to info@alfajr.se. It reaches me, not a queue.