1. Introduction
Qallam (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Qallam platform at qallam.ai (“Service”, “Platform”).
Qallam is operated by Shayan Faisal, located at SNOCHS Phase 1, Lahore, Pakistan. By using our Service, you consent to the data practices described in this policy.
2.1 Information you provide directly
When you create an account or use the Platform, you may provide:
- Account information: Full name, email address, password (for email registration)
- Profile information: Phone number (optional), city, school name, grade/class level, board (Federal, Cambridge, AKU-EB, etc.)
- Educational preferences: Target university, intended major, target exam (LCAT, NET, etc.)
- Feedback and communications: Feedback submissions, support messages, and any other information you voluntarily provide
2.2 Information collected through Google OAuth
If you sign in using Google, we receive the following from your Google account:
- Full name
- Email address
- Profile picture URL
We do not access your Google contacts, calendar, drive files, or any other Google services data beyond what is listed above.
2.3 Information collected automatically
As you use the Platform, we automatically collect:
- Learning activity data: MCQ responses and answers, quiz and unit test attempts and scores, practice session data, mastery scores and progress metrics, time spent on questions
- University tracking data: Which universities and deadlines you choose to track
- Technical data: Browser type, device information, IP address, pages visited, and basic usage patterns
We use the information we collect for the following purposes:
- Provide and operate the Service: Create and manage your account, deliver course content, process payments, and enable core platform features
- Personalize your learning experience: Track your mastery across subjects and topics, recommend practice areas, and display relevant progress metrics
- Send transactional communications: Account verification, payment confirmations, subscription activation notices, and important service updates
- Improve the Platform: Analyze usage patterns to identify areas for improvement, fix bugs, and develop new features
- Provide support: Respond to your inquiries, feedback, and support requests
- Ensure security: Detect and prevent fraud, abuse, and unauthorized access
We do not sell your personal information to third parties. We do not use your data for targeted advertising.
4. Data Storage & Security
Your data is stored in Supabase, a PostgreSQL-based database platform hosted on Amazon Web Services (AWS) infrastructure. We implement the following security measures:
- Row-Level Security (RLS): Database-level access controls ensure users can only access their own data
- Encrypted connections: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
- Secure authentication: Passwords are hashed and salted. Session tokens are securely managed through NextAuth
- Payment security: Payment card details are processed by SafePay and are never stored on Qallam servers
While we take reasonable measures to protect your data, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee absolute security.
5. Third-Party Services
We use the following third-party services that may collect or process your data. Each operates under its own privacy policy:
- Supabase, Database hosting, authentication infrastructure, and file storage
- SafePay, Payment processing for one-time purchases (processes payment card information)
- Resend, Transactional email delivery (receives your email address to send account-related emails)
- Google, OAuth authentication (receives authentication tokens; provides name, email, and profile picture)
- Vercel, Platform hosting and deployment
We do not share your learning data (MCQ responses, quiz scores, mastery metrics) with any third party.
6. Cookies & Local Storage
We use the following browser storage mechanisms:
- Session cookies: Essential cookies managed by NextAuth for authentication and session management. These are required for the Service to function and cannot be disabled.
- localStorage: Used to store non-sensitive user preferences on your device
- sessionStorage: Used to store temporary quiz and test session state while you are actively taking a practice session. This data is cleared when you close the browser tab.
We do not use third-party advertising cookies or tracking pixels. We do not participate in cross-site tracking or retargeting networks.
7. Data Sharing
We do not sell, rent, or trade your personal information. We may share your data only in the following limited circumstances:
- Service providers: With the third-party services listed in Section 5, solely to the extent necessary to operate the Platform
- Legal requirements: If required by law, regulation, legal process, or governmental request under the laws of Pakistan
- Protection of rights: To protect the rights, property, or safety of Qallam, our users, or the public
- Business transfers: In connection with a merger, acquisition, or sale of assets, in which case you will be notified
8. Your Rights
Regardless of your location, we provide all users with the following data rights:
- Right to access: You may request a copy of all personal data we hold about you
- Right to correction: You may request correction of any inaccurate or incomplete personal data. You can also update most profile information directly through your account settings.
- Right to deletion: You may request deletion of your account and all associated personal data
- Right to data portability: You may request your data in a structured, commonly used format
- Right to withdraw consent: You may withdraw consent for data processing at any time by deleting your account
- Right to object: You may object to specific processing activities
- Right to unsubscribe: You may unsubscribe from marketing or non-essential communications at any time
To exercise any of these rights, contact us at support@qallam.ai. We will respond to your request within 30 days.
9. Data Retention
We retain your data according to the following guidelines:
- Account data: Retained for as long as your account remains active. If you request account deletion, we will remove your personal data within 30 days.
- Learning and practice data: MCQ logs, quiz attempts, test scores, and mastery metrics are retained while your account is active to provide continuous mastery tracking and progress history.
- Payment records: Transaction records may be retained for up to 7 years as required by Pakistani tax and financial regulations.
- Anonymized analytics: Aggregated, anonymized usage data that cannot identify individual users may be retained indefinitely for platform improvement purposes.
Upon account deletion, we will delete or anonymize your personal data, except where retention is required by applicable law.
10. Children's Privacy
The Qallam platform is designed for students aged 16 and above who are preparing for university admissions. We do not knowingly collect personal information from children under the age of 13.
If you are between the ages of 13 and 18, you should use the Platform only with the knowledge and consent of a parent or legal guardian.
If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that information promptly. If you believe that a child under 13 has provided us with personal information, please contact us immediately at support@qallam.ai.
Please read this section carefully.
Qallam displays university admissions dates, test schedules, application deadlines, and related information that is sourced from publicly available data. This information is provided for convenience and reference purposes only.
We do not guarantee the accuracy, completeness, or timeliness of any university information displayed on the Platform. Universities may update their schedules, requirements, and procedures at any time without notice to us. You must verify all university-related information directly with the respective institutions before making any decisions or taking any actions based on information shown on Qallam.
Qallam accepts no liability for any consequences arising from inaccurate, outdated, or incomplete university information displayed on the Platform.
12. International Data Considerations
Qallam is based in Pakistan and primarily serves Pakistani students. Your data may be processed and stored on servers located outside of Pakistan (including AWS infrastructure in various regions). By using the Service, you consent to the transfer of your data to these locations.
While Pakistan does not currently have comprehensive data protection legislation equivalent to the EU's GDPR, we voluntarily implement GDPR-compatible data rights for all users as described in Section 8 of this policy.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
- Update the “Last updated” date at the top of this page
- Notify you via the email address associated with your account for significant changes
- Display a prominent notice on the Platform when applicable
Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you should stop using the Service and may request account deletion.
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
For data access, correction, or deletion requests, please include “Data Request” in your email subject line. We will respond within 30 days.