Privacy Policy

• Account data: name, email, phone, country, role and password (stored hashed by our auth provider).
• Teacher and seller data: qualifications, profile text, photos, identity documents and payout details. Bank account numbers are encrypted.
• Children's data: a child's name, subject, grade and lesson progress, provided by their parent or guardian. We collect it only from the parent.
• Payment data: transaction records, reference codes and the proof of payment you upload (screenshots or receipts). Card details are handled by Stripe and never stored by us.
• Orders and messages: gig requirements, deliveries, AI Studio inputs and outputs, and messages sent on the platform.
• Video sessions: live lessons run over video. Recordings are made only when the feature is enabled, and participants are told when recording is on.
• Technical data: device, browser, IP address and usage logs.

• To run the platform: accounts, bookings, lessons, orders, escrow and payouts.
• To verify teachers, sellers and payments, and to prevent fraud and abuse.
• To resolve disputes and provide support.
• To send service emails such as receipts, renewal reminders and order updates.
• To generate AI Studio outputs and power in-app assistants.
• To improve security and performance. We do not sell personal data.

We share data only with providers that help us run Hayesh:

• Supabase for database, authentication and file storage.
• Stripe for card payments.
• LiveKit for video lessons.
• Anthropic and OpenRouter for AI features. AI Studio inputs are sent to them to generate your output.
• Resend for sending email.

These providers may process data outside Pakistan. We may also disclose data when required by law or to protect people's safety.

We keep account data while your account is open. Transaction and payment records are kept for as long as needed for accounting, tax and dispute purposes. Payment proofs and recordings are kept only as long as necessary for verification, disputes and safety, then deleted. When you delete your account we remove or anonymise personal data, except what we must keep by law.

Data is stored with access controls so people only see what they should: payment proofs are in private storage, bank account numbers are encrypted, and connections use HTTPS. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

You can ask to access, correct or delete your personal data, and to withdraw consent. Parents can do this for their children's data, and can ask us to delete it at any time. Contact us using the details below and we will respond within a reasonable time. Some data we must keep by law, and deleting data needed to deliver an active order or plan may end that service.

We use essential cookies and similar storage to keep you signed in and remember preferences. We do not use advertising cookies. You can block cookies in your browser, but sign-in will not work without them.

For privacy requests or questions, use the Contact page. We may update this policy; the date at the top shows the current version.