هدهدو Hudhudo
The generation of tomorrow
Privacy policy
Your child's privacy and the security of their information are our top priority at Hudhudo.
1. Information we collect
We collect only the minimum information needed to give the child a safe, personalized learning journey:
- Basic account information for the parent or teacher (name, email address, payment details).
- The child's profile (nickname, age, learning progress, and Hudhudo character customizations).
- Usage data from the interactive sections, used to track achievements and progress on the Hudhudo map.
- If you link your child to an independent teacher's halaqa: your child's first name, homework and attendance per session (present/late/absent, with date). Only you and the teacher see this; it is deleted when you unlink and after 13 months at the latest.
- If you are a halaqa teacher: we check your identity by viewing your ID in a video call; we keep no copy and no BSN. We only record that we saw the ID and the VOG or certificate of good conduct, with its issue date, plus the name, type, full address and official contact (email or phone, never a person's name) of the place where you teach, your phone number (and whether it is on WhatsApp), a short reviewer note and that you accepted the code of conduct. The address and phone numbers are used only for checking and contact; parents never see them. A parent sees only your name, the name and city of the teaching place, whether we checked your identity in a video call or in person, and the kind of certificate (the VOG's issue month or the certificate's country). We also use your e-mail address for a daily e-mail with the number of new submissions in your halaqa, without names; you can turn it off with the link in the e-mail.
- Only with your consent: visit statistics on the public pages before login via Google Analytics (by Google) — never after login, never in the children's area. See the cookie policy.
- When you sign up: how you found us (for example a Google ad, a Facebook post or another website), taken only from the campaign tags in the link you opened and the name of the site you came from. We set no cookies for this and store nothing in your browser; it only appears in the signup notice we receive.
2. Voice-check and Quran data
Our features include a "voice check" that helps children improve their Quran recitation and Arabic pronunciation. The microphone only works after a parent has given explicit permission for each child. During recitation the recording is converted to text on our own servers inside the European Union; it is not sent to any external party and is deleted as soon as the conversion is finished. We keep only the text result (which words were right or wrong), for at most 90 days, to follow the child's progress. The only voice recordings we do keep are homework recordings for a halaqa: encrypted, playable only by you and the teacher, and deleted after 90 days. We do not sell this data and do not use it to train AI models. A parent can withdraw permission at any time, and the child's stored recitation results are then deleted as well.
3. Where your data lives and who helps us
Hudhudo runs on its own server in Germany, and children's data never leaves the European Union. The parties that help us run the service, and what each of them sees:
- Hetzner Online GmbH (Germany): hosting of the server, file storage and encrypted backups — all in data centres in Germany.
- Scaleway SAS (EU): management of the encryption keys we protect sensitive data with (Amsterdam). Scaleway does not see the content of encrypted data.
- Mailgun (Sinch, EU region): sending account emails only, such as email verification, halaqa invitations and renewal notices; Mailgun receives only the email address and the message content.
- Mollie B.V. (Netherlands): payment processing. We do not store card or bank details on our servers.
- Apple and Google: for a purchase in the app, the store handles the payment itself. We receive only details of the purchase (product, time, order number), not payment details.
- Zoho Corporation B.V. (Netherlands, data centres in the EU): our mailbox info@hudhudo.com, where your messages to us arrive.
- Google Ireland Ltd.: only with your consent, visit statistics of the public pages before login (Google Analytics, without advertising features). Google may also process this data outside the EU, under the EU-US Data Privacy Framework and standard contractual clauses. Data of children and signed-in users never goes to Google.
- If your child uses Hudhudo through their school account, the school is responsible for that data and we process it on the school's behalf under a data processing agreement; only what is needed to learn and follow progress reaches Hudhudo.
4. Protecting children
Hudhudo is made for children, but the account always belongs to a parent or guardian (or to the school). For children under 16, the parent or guardian gives the consent the law requires. There are no ads and no links to advertisers, and children cannot publicly share their personal information or communicate with strangers on the platform. We do not sell data and do not use it to train AI models.
5. Who is responsible
The data controller is MoskeeTaal; Hudhudo is one of its trade names: MoskeeTaal · KvK 98694189 · BTW NL823807071B01 · info@hudhudo.com. For privacy questions or a request about your data, write to info@hudhudo.com. If your child uses Hudhudo through their school, the school is responsible (see section 3).
6. What we use data for, and on which legal basis
- Providing the account, the lessons and the progress: performance of the contract (Art. 6(1)(b) GDPR).
- Payments and bookkeeping: legal obligation (Art. 6(1)(c)).
- Voice check with the microphone and homework recordings for a halaqa: your consent as a parent (Art. 6(1)(a)), given per child and withdrawable at any time.
- Visit statistics with Google Analytics on the public pages: your consent through the cookie banner (Art. 6(1)(a)).
- Knowing where a signup came from, to judge our ads: legitimate interest (Art. 6(1)(f)).
- Security, preventing abuse and fixing faults: legitimate interest (Art. 6(1)(f)).
- Checking halaqa teachers: legitimate interest in protecting children (Art. 6(1)(f)), and the teacher's consent for us to contact the place where they teach.
- Service emails such as email verification, halaqa invitations and expiry notices: performance of the contract. We do not send marketing emails.
7. How long we keep data
- Account and learning data: as long as the account exists. After a deletion request we erase it within one month.
- Recitation results (text and score, no sound): at most 90 days.
- Homework recordings for a halaqa: 90 days. Who played a recording (internal ids only): 12 months.
- Halaqa attendance: until the link ends, at most 13 months.
- Halaqa teacher verification data: up to 12 months after the account is closed. Join requests that are not accepted: 6 months.
- Security logs: 12 months.
- Payment records: 7 years, because Dutch tax law (art. 52 AWR) requires it.
- Encrypted backups: overwritten after at most 6 months.
8. Your rights and complaints
You have the right to access, correct and erase your data and your child's, to restrict processing, to receive a copy in a common format (portability) and to object. You can withdraw any consent at any time. Send your request to info@hudhudo.com; we reply within one month. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).