This page explains what information we collect when you use Hunarzai, why we need it, and who we share it with. In this policy, “Hunarzai”, “we” and “us” mean Hunarzai (SMC-Private) Limited, a company incorporated in Pakistan under the Companies Act, 2017 (SECP CUIN 0365425), whose registered office is at Balar Khel, P.O. and Village Marghuz, Swabi, Khyber Pakhtunkhwa, Pakistan.
What we collect
When you create an account
- Your name and email address.
- A password, stored securely by our login provider. We can’t see it.
- If you sign in with Google, your name and email from your Google account.
When you pay
- Your phone number and, if you add it, your city.
- For JazzCash, Easypaisa and bank transfers: the receipt you upload and its transaction ID (required). If you ask for a refund, the account title and number you give us to send it to (seen only by our refunds team).
- For card payments (coming soon): Stripe will handle your card details. We only get a confirmation that you paid, the amount and the limited details Stripe shares with us. We never see your full card number.
When you learn
- Which courses you’re enrolled in, which lessons you’ve finished, and when you complete a course.
- Questions and answers you post on a course. Others on that course see them with your first name and the first letter of your surname.
- The devices you watch paid lessons on (for example “Chrome on Android phone”) and when you last used each one.
When you teach on Hunarzai
- Your teacher profile: the name, headline, bio and photo students see.
- To verify who you are: your CNIC number, a photo of your CNIC, your WhatsApp number, your qualification and a link to a sample lesson. These are stored privately and only the Hunarzai team can see them.
- Where to send your earnings: your JazzCash, Easypaisa or bank details.
When you join the affiliate programme
- Where to send your commission: your JazzCash, Easypaisa or bank details.
- Before your first payment: your CNIC number and a photo of your CNIC, so we can check the payout account is in your own name. These are stored privately and only the Hunarzai team can see them.
- To stop people earning commission on their own purchases or on their own courses, we compare the phone numbers, devices, payout and refund account numbers and CNIC numbers on different Hunarzai accounts. We use this only to decide whether a commission is paid.
When you follow a teacher
- Which teachers you follow. With an account, it’s linked to your account. Without one, we keep the email address you give us, the date, and the IP address the request came from, and nothing counts until you confirm with the link we email you.
- Teachers see only how many people follow them, never who.
When you sign up for a free webinar
- Your name and email, your WhatsApp number only if you choose to give it, where you came from (for example a Facebook ad), when you signed up and whether you clicked Join. We use them to send your Join link, reminders and the recording, and to count how well our ads work. The IP address the sign-up came from is checked to stop spam.
- We contact you on WhatsApp only about that webinar, and only if you gave your number.
When you contact us
- Your name, email, phone number if you give it, and your message.
- Help requests and replies, and any receipt photo or PDF you attach to them.
- Questions you ask Noor, our help assistant, and its answers. If you’re signed in and 18 or older (or a verified teacher), you can see your own Noor chats from the last 30 days under “Past chats” and carry one on. Only you and our team can read them.
- Questions you ask a teacher about a course before joining, and the replies. Only you, the teacher (who sees your first name) and our team can read them. If the teacher makes one an FAQ, the question and answer show on the course page without your name.
Why we use it
- To create your account and let you log in.
- To check your payment and unlock your course.
- To save your progress and issue your certificate.
- To email you about your payments and courses, for example when your receipt is approved.
- Only if you tick the box (18 or older): to email you about new courses, offers and webinars. You can stop any time in Your account or with the unsubscribe link in those emails.
- To reply to your messages.
- For teachers: to confirm your identity before your courses go live, to contact you, and to pay you.
- To keep the website secure and stop fraud, such as fake receipts.
- To help teachers and our team write faster with AI drafts. A person always checks a draft before it’s saved or sent.
- To answer questions in Noor, our help assistant (AI answers for visitors who aren’t signed in and for accounts 18 or older; under-18 accounts get answers from our help pages).
We don’t sell your information. Apart from the Meta Pixel described below, which helps us show our ads on Facebook and Instagram, we don’t use it for advertising on other websites, and never for under-18 accounts.
Who we share it with
We use a small number of trusted services to run Hunarzai. They only get the information they need to do their job:
- Supabase stores our database, your login and the files you upload, such as receipts, identity documents and help request attachments.
- Bunny.net stores and plays uploaded course videos. When you watch one, Bunny sees your device’s connection details, and your email is shown faintly over the video to discourage copying.
- Stripe will process card payments once they open.
- Resend sends our emails and tells us whether each one was delivered, bounced or marked as spam.
- Google, only if you choose to sign in with Google.
- YouTube or Vimeo may host some lesson videos. When you play one, that service can see that a video was played from your device.
- Vercel hosts the website.
- Google Gemini (an AI service), only when AI help is switched on. Teachers use it to draft course descriptions, lesson notes, quizzes and answers to questions on their course; our team uses it to check courses before review and to draft replies to help requests and contact messages. It receives only the text needed for the draft, such as the course details, lesson notes, or the question or message being answered. We don’t attach the sender’s name, email or phone number. Noor, our help assistant, sends it the question you ask, the recent messages in that chat (including earlier ones when you carry on a past chat) and our help pages; for teachers also a short summary of their own account (never their CNIC, phone, email, payment details, earnings or anything about students). ID, phone and account numbers and email addresses in a question are hidden before it’s sent. Visitors who aren’t signed in get AI answers too: Noor sends their question, the recent messages in that chat and our help pages, never who they are. Our payments team can also send it a receipt you uploaded, to read the amount, date and transaction ID; a receipt can show the payer’s name and account details. Questions, help requests and receipts from under-18 accounts, or accounts that haven’t told us their age, are never sent to it. AI never approves a payment, a course or a teacher: a person decides.
- Cloudflare Turnstile checks that the sign-up, log-in, password-reset, contact and waitlist forms are used by a person and not a bot. It sees your device and browser details while you use those forms.
- Your browser’s push service (from Google, Apple or Mozilla, depending on your browser) delivers phone and browser notifications, only if you switch them on. The notification is sent to it encrypted.
- GitHub, when switched on, keeps an encrypted backup copy of our database for 30 days so we can recover from a fault. It can’t read the copy.
- Sentry, when switched on, records technical error reports so we can fix faults. A report can include the page address and your browser and device type.
- Google Tag Manager loads the analytics and advertising tools below across the website (not in the admin area).
- Google Analytics shows us how people find and use the site: pages viewed, the link or ad you came from, your device, browser and approximate location (city or country), and actions such as joining the course list or creating an account. We don’t send it your name, email, phone number or payment details.
- Meta (Facebook and Instagram), through the Meta Pixel, records the same kind of visit and action information so we can show our ads to people likely to be interested and see which ads work. Meta can link this to your Facebook or Instagram account if you have one, under Meta’s own privacy policy. When we approve your payment for a course, we also tell Meta about the sale, so we can see which ads lead to sales: the course (its name, page and code), the amount, our order reference, Pakistan as the country, and your email address, phone number and account number in hashed form (turned into a code that Meta can compare with the details it already has, to match the sale to a Facebook or Instagram account). With it go the Meta cookies, internet (IP) address and browser name from when you sent your receipt, which we keep only until the sale is sent to Meta, the payment is rejected, or 30 days have passed. We don’t send Meta your name or payment details, and nothing is kept or sent for under-18 accounts or for courses for Nursery and KG to Class 8.
Some of these services store data outside Pakistan. We may also share information if the law requires it.
Cookies
We use cookies to keep you logged in, and to remember for 30 days which teacher’s link or affiliate link you arrived from, so the right teacher or affiliate is credited if you buy a course. Affiliates only see the course and the price of sales made through their link, never who bought it. We also give each browser a random ID so paid lessons play on a limited number of devices (you can see and remove your devices in your account), and remember the last class, exam or skill you looked at for 90 days so the home page can show you matching courses. Course pages count visits, free previews opened and taps on “Enrol now” so each teacher can see how their course is doing: your browser keeps a note that it was counted today, and we keep only the daily totals per course, never who visited. Google Analytics and the Meta Pixel also set cookies to recognise a returning browser and to measure our ads. You can block or delete cookies in your browser settings, use Google’s Analytics opt-out add-on, and choose which ads you see in Facebook or Instagram under Settings, Ad preferences.
How long we keep it
- Your account, enrolments and certificates: for as long as your account is open, so your courses and certificates keep working.
- Payment records (amount, date, reference and transaction number): kept for our accounts, as tax and accounting rules require. Receipt images you upload: for 6 years from the payment, then deleted automatically. Until then a receipt may show your name and account details. If you delete your account, the payment records are no longer linked to you and any notes on them are removed.
- Messages and help requests you send us: until we’ve dealt with them, plus a reasonable time in case you get back in touch. Help requests, and messages sent from your account’s email address, are deleted if you delete your account.
- Teachers’ and affiliates’ CNIC details and photo: for as long as the account is open. They’re deleted when the account is deleted.
- Which lessons you’ve opened: for as long as you have the course. We use this to show your progress, to issue certificates and to decide refund requests fairly.
- “Notify me” sign-ups: until we’ve told you courses are open and your waitlist offer has ended, or until you ask us to remove you or delete your account. An email sign-up we can’t email (no account and not confirmed as 18 or older) is deleted 30 days after it was made.
- Your email choices, and a record of when you said yes, changed them or stopped (proof of what you agreed to): until you delete your account, or for waitlist-only sign-ups until you ask us to remove you. Addresses whose emails bounced or were marked as spam stay on a do-not-email list so they never get marketing emails.
- Teachers you follow: until you stop following or delete your account. Email follows that are never confirmed are deleted after 7 days, and the record of each “new course” email after 90 days.
- The account you give us for a refund: 90 days after we decide the refund, then deleted automatically.
- Questions you ask Noor and its answers: kept so we can improve our help pages. Deleted if you delete your account. Questions from visitors who aren’t signed in aren’t linked to an account.
- Whether your account is under 18, and for an under-18 account the date you turn 18 (worked out from the month and year of birth you give us; we don’t keep the month and year themselves): for as long as your account is open. The date is removed when you turn 18.
- Free webinar sign-ups: 180 days after the webinar, then deleted automatically. You can cancel your place from your webinar link before it starts.
- Questions you ask about a course before joining, and the replies: until you delete your account, which also removes any FAQ made from them.
Job applicants
When you apply for a role at Hunarzai or send us your CV, we collect what you give us on the form: your name, email, phone number, city, any links, your CV, your answers and your note, and the IP address and browser you applied from (to stop spam). We use them to consider you for the role and, only if you agree, for future roles; to arrange interviews; and to make and record an offer. A person reads every application: we don’t use AI to screen CVs. Your CV and any files you send are stored privately, and only the members of our team who handle hiring can open them. We email you about your application through our email provider. You must be 18 or over to apply.
- If we don’t offer you a role, your details and CV are deleted automatically 6 months after our decision, or 12 months if you agreed we can keep them for future roles. A CV sent for future roles is kept for 12 months.
- You can withdraw and ask us to delete your details at any time, using the link in our emails.
- When you sign an offer online, we keep the name you typed, the time and your IP address with the letter, as a record of the agreement.
- If you join us, your application and signed offer become part of your employee record.
Children and students under 18
Many of our students are at school. If you’re under 18, a parent or guardian must agree to our terms and this policy before you create an account or pay. For a child under 13, a parent or guardian signs up, ticks the box for a parent or guardian and gives the child’s month and year of birth; the account is then treated as a child’s account. Children under 13 can’t make their own account with an email address; an account that signs in with Google and gives an age under 18 is looked after as an under-18 account. When you sign up we ask for your month and year of birth and keep only the date you turn 18 (accounts that haven’t told us are asked once). An under-18 account becomes an adult account on that date; if it says it’s 18 or older before then, our team checks first. We email an address without an account (the “courses are open” email, and marketing emails if you ticked that box) only after it’s confirmed as belonging to someone 18 or older; an address that belongs to an account follows that account’s age. If you’re under 18, Google Analytics and the Meta Pixel are not used on the browser you signed up or log in with. They are also not used on our pages for Nursery and KG to Class 8, or on courses for those classes. We only collect what we need to run your courses, we don’t show your email or phone number to teachers or other students, and in questions and answers only your first name and first initial are shown. A parent or guardian can ask us to see or delete a child’s information through a help request.
Your choices
You can update your name and phone number any time on your account page. You can also ask us to:
- send you a copy of the information we hold about you
- correct anything that’s wrong
- delete your account (we keep payment records and receipts for our accounts, without your name, for the time shown above)
To do any of these, open a help request or email support@hunarzai.com.
Keeping it safe
Your connection to the website is encrypted. Receipts are stored privately and only you and our admin team can open them. Only staff who need your information to help you can see it.
Changes
If we change how we use your information, we’ll update this page and change the date at the top. For big changes, we’ll tell you by email.