Draft v0.1 · 7 September 2026 · to be reviewed by counsel before public launch

Privacy Policy

ParentHub is operated by Wise Networks (Dubai, UAE). This policy explains what we collect, why, where it is kept, and how you stay in control. It is written to comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

1. What we process

• Account data: your email, password hash, language, subscription status.
• Child data: first name, school, grade/year group. We do not collect date of birth, photos or health records; if a school email mentions health (e.g. a clinic visit), we extract only the notice itself.
• Mail and portal content: only messages identified as coming from your child's school or a platform the school uses. Other mail is discarded and never stored.
• Credentials: OAuth refresh tokens, IMAP app passwords and (if you connect one) parent-portal passwords — encrypted in a sealed vault (see §5).
• Usage data: which screens you open and when reports are read. Never message content.

2. Why (legal bases)

To provide the service you asked for (contract); with your explicit consent for reading your mailbox, logging into a portal on your behalf, and processing your child's data; and to keep the service secure (legitimate interest). You can withdraw consent at any time by disconnecting a source or deleting your account.

3. Automated processing

School messages are classified, summarised and translated by an AI language model. Every extracted item keeps the original sentence as evidence; uncertain items are flagged "Please check". During the pilot the model is provided by OpenAI and processed outside the UAE under a data-processing agreement; at launch we intend to move model processing to a UAE region. Model providers do not use your data to train their models. We will update this section when the arrangement changes.

4. Where data lives and for how long

• Database and files: servers located in the UAE. Traffic passes through Cloudflare's edge network for security.
• Raw mail and attachments: 30 days, then deleted automatically.
• Extracted items and reports: for the life of your subscription plus 30 days.
• Credentials: until you disconnect the source — deleted immediately — or 37 days after a failed renewal payment.
• Account deletion: connections are cut at once; all personal data is erased within 7 days (you can undo during that window). Invoices are retained as required by tax law, with personal data minimised.

5. Security

Credentials are encrypted with per-record keys wrapped by a master key held outside the database; only the background worker can open them, only while a run is in progress, and every access is logged. Administrators see metadata (counts, statuses), not content; content access requires a written reason and is logged and shown to you in the app under "Data & privacy". Portal logins happen once a day, read-only. We never send anything to your child's school.

6. Sharing

We do not sell or rent data. Processors: our hosting provider (UAE), Cloudflare (edge security), the AI model provider (§3), Stripe (payments; card numbers never touch our servers), and email delivery infrastructure. Extra recipients you add (e.g. a partner) receive the report by email only.

7. Your rights

Access, correction, deletion, restriction and portability — all available in the app (Settings → Data & privacy) or by writing to [email protected]. We respond within 30 days. You may also complain to the UAE Data Office.

8. Children

ParentHub is used by parents and guardians. We process a child's data only on the instruction and consent of that parent, and only to the extent it appears in the school's own communications to the parent.

9. Changes

Material changes are announced in the app and by email; consent is asked again where the law requires it.

Wise Networks · Dubai, United Arab Emirates · [email protected]