Nejah

Privacy Policy

Last updated: July 12, 2026

Nejah Online Quran Center ("we", "us", "our") operates the Nejah platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, including any Zoom integration features.

1. Information We Collect

Account Information

  • Name and email address (used for authentication and communication)
  • Role (teacher, student, parent, or administrator)
  • Password (stored securely using industry-standard hashing)

Zoom Integration Data

When a teacher connects their Zoom account via OAuth, we store the following information to enable live class functionality:

  • Zoom User ID — to identify the teacher's Zoom account
  • Zoom email address — to link the Nejah account to the correct Zoom user
  • OAuth access token (encrypted) — to create and manage meetings on behalf of the teacher
  • OAuth refresh token (encrypted) — to obtain new access tokens when they expire
  • Token expiration time — to know when to refresh the access token

Class Session Data

  • Scheduled and actual class times
  • Meeting links and meeting IDs (generated via Zoom)
  • Student attendance records (join time, leave time, duration)
  • Teacher attendance status
  • Session notes and evaluations

Zoom Webhook Data

We receive event notifications from Zoom (via webhooks) to track live session activity. This includes:

  • Meeting start and end events
  • Participant join and leave events (names, join/leave timestamps, duration)
  • Meeting IDs and UUIDs for event correlation

2. How We Use Your Information

  • To provide live Quran classes: We use Zoom integration data to create, manage, and join Zoom meetings for scheduled class sessions.
  • To track attendance: Webhook data allows us to automatically record which students attended a class, when they joined and left, and for how long.
  • To authenticate users: Account information is used to verify identity and control access to different features based on role.
  • To communicate: We may use your email to send session reminders, notifications, and important updates about the Service.
  • To improve the Service: Aggregated, anonymized usage data may be used to improve our platform.

3. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

  • Zoom Video Communications, Inc.: When you connect your Zoom account, your data is processed in accordance with Zoom's Privacy Policy.
  • Service providers: We use third-party hosting and database providers (e.g., Render, Vercel, Neon, Cloudflare) to operate the Service. These providers process data on our behalf under strict data protection obligations.
  • Legal compliance: We may disclose information if required by law, regulation, or valid legal process.

4. Data Retention

  • Account data is retained as long as the account is active or as needed to provide the Service.
  • Zoom OAuth tokens are deleted when a teacher disconnects their Zoom account.
  • Class session and attendance records are retained for educational record-keeping purposes.
  • Webhook event deduplication data is automatically purged after 30 days.

5. Zoom Data Disconnect and Deletion

Teachers can disconnect their Zoom account at any time from the Settings > Integrations page. Upon disconnection:

  • All stored OAuth tokens (access and refresh) are permanently deleted.
  • The Zoom User ID link is removed from the teacher's profile.
  • No further Zoom API calls will be made on behalf of the teacher.
  • Existing class session records are retained for attendance history but are no longer linked to the Zoom account.

To request a complete deletion of all your data (including attendance records and class history), please contact us at support@nejahquran.com. We will process your deletion request within 30 days.

6. Data Security

  • OAuth tokens are encrypted at rest using AES-256-GCM encryption.
  • All data in transit is protected by TLS encryption.
  • Webhook endpoints verify Zoom's cryptographic signatures to prevent tampering.
  • Access to the platform is controlled via role-based authentication.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your personal data.
  • Object to or restrict certain processing of your data.
  • Data portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, please contact us at Nejahquranc@gmail.com.

8. Children's Privacy

The Service is used in the context of Quran education for students of various ages. For students under 13 (or the applicable age of digital consent in your jurisdiction), a parent or guardian must create and manage the account. We do not knowingly collect personal information directly from children without parental consent.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date above.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us at: