Privacy Policy

1. Introduction

Qallam (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Qallam platform at qallam.ai (“Service”, “Platform”).

Qallam is operated by Shayan Faisal, located at SNOCHS Phase 1, Lahore, Pakistan. By using our Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information you provide directly

When you create an account or use the Platform, you may provide:

• Account information: Full name, email address, password (for email registration)
• Profile information: Phone number (optional), city, school name, grade/class level, board (Federal, Cambridge, AKU-EB, etc.)
• Educational preferences: Target university, intended major, target exam (LCAT, NET, etc.)
• Feedback and communications: Feedback submissions, support messages, and any other information you voluntarily provide

2.2 Information collected through Google OAuth

If you sign in using Google, we receive the following from your Google account:

• Full name
• Email address
• Profile picture URL

We do not access your Google contacts, calendar, drive files, or any other Google services data beyond what is listed above.

2.3 Information collected automatically

As you use the Platform, we automatically collect:

• Learning activity data: MCQ responses and answers, quiz and unit test attempts and scores, practice session data, mastery scores and progress metrics, time spent on questions
• University tracking data: Which universities and deadlines you choose to track
• Chat conversations: Messages you send to Qallam Tutor and Qallam Guide, the assistant's replies, and any feedback (thumbs up / thumbs down) you give on a reply. Stored under your user id (or, if you're not signed in, a rotating salted hash of your IP address) so we can show your chat history and review quality.
• Technical data: Browser type, device information, IP address, pages visited, and basic usage patterns. For unauthenticated chat users we never store the raw IP. We compute a salted, rotating SHA-256 hash of it so we can rate-limit abuse without retaining the address itself.
• Analytics and marketing identifiers: Google Analytics 4 (GA4) and Meta Pixel set cookies and pseudonymous identifiers (e.g. _ga, _fbp, _fbc) to measure page views, conversions, and aggregate audience behaviour. See Section 7 for details and opt-out options.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and operate the Service: Create and manage your account, deliver course content, process payments, and enable core platform features
• Personalize your learning experience: Track your mastery across subjects and topics, recommend practice areas, and display relevant progress metrics
• Send transactional communications: Account verification, payment confirmations, subscription activation notices, and important service updates
• Improve the Platform: Analyze usage patterns to identify areas for improvement, fix bugs, and develop new features
• Provide support: Respond to your inquiries, feedback, and support requests
• Ensure security: Detect and prevent fraud, abuse, and unauthorized access

We do not sell your personal information to third parties. We do not use your data for targeted advertising.

4. Data Storage & Security

Your data is stored in Supabase, a PostgreSQL-based database platform hosted on Amazon Web Services (AWS) infrastructure. We implement the following security measures:

• Row-Level Security (RLS): Database-level access controls ensure users can only access their own data
• Encrypted connections: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
• Secure authentication: Passwords are hashed and salted. Session tokens are securely managed through NextAuth
• Payment security: Payment card details are processed by SafePay and are never stored on Qallam servers

While we take reasonable measures to protect your data, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee absolute security.

5. AI Features (Qallam Tutor & Qallam Guide)

Qallam offers two AI-powered chat features: Qallam Guide (a free assistant available on every page) and Qallam Tutor (a progress coach available on course pages for signed-in users). The replies are generated by Google Gemini (gemini-2.5-flash-lite). To make the replies useful and accurate we include the following information in the prompt we send to Google:

• The message you typed.
• Recent message history in the current conversation.
• The page you are viewing (course, topic, subtopic names) so the assistant can answer questions like “what's my mastery here?”
• Your progress summary (Tutor mode only): your latest diagnostic score, mastery per topic for the current course, and recent MCQ activity. We do NOT send your name, email, phone number, or any other personally identifying information to the AI provider.
• Aggregate platform data (course list, pricing, upcoming university deadlines).

Google's privacy and data-handling terms for the Gemini API apply to this processing. Per Google's policy for the paid Gemini API, your prompts and replies are not used to train Google's foundation models. Conversations are also stored on our own infrastructure so you can see your chat history, and so we can review and improve answer quality.

You can clear a Qallam chat conversation at any time from the chat widget's overflow menu. To request deletion of your full chat history, contact us at support@qallam.ai.

6. Third-Party Services

We use the following third-party services that may collect or process your data. Each operates under its own privacy policy:

• Supabase, Database hosting, authentication infrastructure, and file storage
• SafePay, Payment processing for one-time purchases (processes payment card information; PCI compliance handled by SafePay)
• Resend, Transactional email delivery (receives your email address to send account-related emails)
• Google OAuth, Sign-in (receives authentication tokens; provides name, email, and profile picture)
• Google Gemini API, AI provider that powers the Qallam Tutor and Qallam Guide chat features. Receives the data described in Section 5.
• Google Analytics 4 (GA4), Aggregate page-view and event analytics. See Section 7.
• Meta Pixel (Facebook Pixel), Conversion measurement for our marketing campaigns on Meta platforms. See Section 7.
• Vercel, Platform hosting and deployment
• WhatsApp (Meta), Used only when you explicitly tap a “Message us on WhatsApp” link to contact a Qallam counselor. Meta receives whatever you choose to send in the conversation.

We do not sell your learning data (MCQ responses, quiz scores, mastery metrics) to any third party. The aggregate identifiers used by GA4 and Meta Pixel are described in the next section so you understand what they are and how to opt out.

7. Analytics & Marketing Pixels

We use two third-party analytics / marketing pixels to understand how the Platform performs and which marketing channels actually help students find us:

7.1 Google Analytics 4 (GA4)

GA4 captures pseudonymous page-view and event data (which pages are visited, in what order, how long each session lasts, basic device and country info derived from IP). GA4 sets first-party cookies on the qallam.ai domain (typically named _ga and _ga_*) which expire after up to 2 years. We do NOT send your name, email, or phone number to GA4.

Opt out: install Google's GA opt-out browser add-on or use a tracker-blocking browser extension.

7.2 Meta Pixel (Facebook Pixel)

Meta Pixel measures conversions from our paid campaigns on Facebook and Instagram. When you take a meaningful action on Qallam (sign-up, plan purchase, completing the diagnostic) we fire a corresponding event via Meta Pixel and via our first-party Conversions API mirror. Meta Pixel sets third-party cookies (typically _fbp and _fbc). For conversions where you signed up with an email, we send a SHA-256 hash of your email to Meta's Conversions API so Meta can match the conversion to its records. We never send the raw email.

Opt out: you can opt out of Meta's ad personalisation via your Facebook ad preferences or by blocking third-party cookies in your browser.

7.3 First-party event log

We also mirror conversion events into our own database table (user_events) so we have analytics independent of any third-party pixel. This first-party log contains the event name, your user id (if signed in), and basic event metadata only. It is governed by the same retention rules as the rest of your account data.

8. Cookies & Local Storage

We use the following browser storage mechanisms:

• Authentication cookies (essential): NextAuth session cookies and CSRF tokens. Required for the Service to function; cannot be disabled.
• Checkout cookie (essential): A short-lived HttpOnly cookie (sfpy_ck_tracker) carries the SafePay payment tracker through the payment redirect round-trip so we can confirm your purchase. Deleted automatically after activation.
• Analytics cookies: Google Analytics 4 first-party cookies (e.g. _ga, _ga_*) for aggregate page-view analytics. See Section 7.1.
• Marketing cookies: Meta Pixel cookies (e.g. _fbp, _fbc) for conversion measurement on Meta-platform ads. See Section 7.2.
• localStorage: Non-sensitive preferences and state, including the active chat conversation id, notification-dismissal flags, and minor UI preferences. None of this is shared with any third party.
• sessionStorage: Temporary quiz and test session state while you are actively taking a practice session. Cleared when you close the browser tab.

If you wish to block analytics and marketing cookies, configure your browser's cookie settings or install a tracker-blocking extension. Essential cookies cannot be blocked without breaking sign-in and checkout.

9. Data Sharing

We do not sell, rent, or trade your personal information. We may share your data only in the following limited circumstances:

• Service providers: With the third-party services listed in Sections 5, 6, and 7, solely to the extent necessary to operate the Platform
• Legal requirements: If required by law, regulation, legal process, or governmental request under the laws of Pakistan
• Protection of rights: To protect the rights, property, or safety of Qallam, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, in which case you will be notified

10. Your Rights

Regardless of your location, we provide all users with the following data rights:

• Right to access: You may request a copy of all personal data we hold about you
• Right to correction: You may request correction of any inaccurate or incomplete personal data. You can also update most profile information directly through your account settings.
• Right to deletion: You may request deletion of your account and all associated personal data
• Right to data portability: You may request your data in a structured, commonly used format
• Right to withdraw consent: You may withdraw consent for data processing at any time by deleting your account
• Right to object: You may object to specific processing activities
• Right to unsubscribe: You may unsubscribe from marketing or non-essential communications at any time

To exercise any of these rights, contact us at support@qallam.ai. We will respond to your request within 30 days.

11. Data Retention

We retain your data according to the following guidelines:

• Account data: Retained for as long as your account remains active. If you request account deletion, we will remove your personal data within 30 days.
• Learning and practice data: MCQ logs, quiz attempts, test scores, and mastery metrics are retained while your account is active to provide continuous mastery tracking and progress history.
• Payment records: Transaction records may be retained for up to 7 years as required by Pakistani tax and financial regulations.
• Anonymized analytics: Aggregated, anonymized usage data that cannot identify individual users may be retained indefinitely for platform improvement purposes.

Upon account deletion, we will delete or anonymize your personal data, except where retention is required by applicable law.

12. Children's Privacy

The Qallam platform is designed for students aged 16 and above who are preparing for university admissions. We do not knowingly collect personal information from children under the age of 13.

If you are between the ages of 13 and 18, you should use the Platform only with the knowledge and consent of a parent or legal guardian.

If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that information promptly. If you believe that a child under 13 has provided us with personal information, please contact us immediately at support@qallam.ai.

13. University Information Disclaimer

Please read this section carefully.

Qallam displays university admissions dates, test schedules, application deadlines, and related information that is sourced from publicly available data. This information is provided for convenience and reference purposes only.

We do not guarantee the accuracy, completeness, or timeliness of any university information displayed on the Platform. Universities may update their schedules, requirements, and procedures at any time without notice to us. You must verify all university-related information directly with the respective institutions before making any decisions or taking any actions based on information shown on Qallam.

Qallam accepts no liability for any consequences arising from inaccurate, outdated, or incomplete university information displayed on the Platform.

14. International Data Considerations

Qallam is based in Pakistan and primarily serves Pakistani students. Your data may be processed and stored on servers located outside of Pakistan (including AWS infrastructure in various regions). By using the Service, you consent to the transfer of your data to these locations.

While Pakistan does not currently have comprehensive data protection legislation equivalent to the EU's GDPR, we voluntarily implement GDPR-compatible data rights for all users as described in Section 8 of this policy.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Notify you via the email address associated with your account for significant changes
• Display a prominent notice on the Platform when applicable

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you should stop using the Service and may request account deletion.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

• Email: support@qallam.ai
• Address: SNOCHS Phase 1, Lahore, Pakistan
• Contact page: qallam.ai/contact

For data access, correction, or deletion requests, please include “Data Request” in your email subject line. We will respond within 30 days.