Privacy Policy
Version 1.0 · Last updated: October 30, 2026
This document explains what personal data Daenaly collects from you, what for, who receives it, how long it is kept and what you can do about it. It describes what the app does today.
It covers the Daenaly website and web app at daenaly.ir. The text is published in Persian, English and Arabic, and the three versions are meant to say the same thing.
1.Who is responsible for your data
The controller, meaning the party that decides why and how your data is processed, is: To be announced before launch. Country: To be announced before launch. Postal address: To be announced before launch. For privacy questions and requests, write to admin@daenaly.ir.
Until a company is registered and named here, Daenaly is operated by its owner personally.
No data protection officer (DPO) has been appointed.
Account data is kept on servers in the Netherlands, which we rent from a hosting provider.
2.In short
- We collect only what is needed to run the lessons, Explore, chat with Simorgh, your progress and the forms.
- We do not sell your personal data and we show no advertising. We use no third-party analytics or advertising trackers.
- Our own usage statistics run only after you accept them, and you can change your mind at any time.
- Simorgh's answers are written by artificial intelligence. What you type in a conversation is sent to an AI service to produce the answer.
- A teacher or an institution sees your progress only if you agree.
- You can download your data or delete your account yourself.
- There are no payments, and we do not collect card details.
3.What we collect, what for and on what basis
For each item we name the legal basis (Article 6 GDPR) in plain words: "contract" means we need it to give you the service you asked for; "consent" means you allowed it and can withdraw it at any time; "legitimate interest" means it is needed for a specific reason such as security or preventing abuse; "legal obligation" means the law requires it.
- Account and sign-in
- Data: e-mail, name, password (stored only as a hash), language, learning goal, time zone, reminder settings, your consent choice and when you made it, referral code, trial dates, the link between your account and a teacher or institution (only with your consent), the time you confirmed that you are at least 16 years old (a date of birth is not asked for or stored) and whether you accepted renewal-offer e-mail. If you accept analytics, the source you came to Daenaly from is stored too. Purpose: to create and run your account. Basis: contract; link to a teacher or institution: consent.
- Trial and phone number
- Starting the 7-day trial needs a verified e-mail, a phone number and the age confirmation. We store the phone number only in international format (E.164) and check only its format; we do not text you a code. No other learner, teacher or leaderboard sees the number; our team sees only the last three digits, and every time someone views the full number it is logged. So that each person gets the trial once, we make a one-way keyed code (a hash) from the number and from the normalised e-mail. On its own this code identifies nobody, and it is kept for 24 months after the account is deleted. Basis: contract; preventing abuse of the free offer: legitimate interest.
- Learning progress
- Data: your mastery score and next review time for each concept, the lessons you completed and when, the words you saved or learned, the Explore items you saved and viewed, and which item you shared and by which channel. Purpose: to continue where you stopped and to repeat what is due. Basis: contract.
- Chat with Simorgh
- Data: the messages you write and Simorgh's replies, the character and topic of the conversation, and the end-of-session evaluation (scores and feedback). The conversation text is sent to an AI service to produce the answer (see "Artificial intelligence"). Purpose: conversation practice and evaluation. Basis: contract.
- Streaks, rewards and reminders
- Data: points (XP), your streak of days, badges, daily quests, your rank in the weekly league, in-app notices and, if you allow it, the address for browser push notifications. Other learners in the same league see your display name and weekly points. Purpose: motivation and reminders; you can switch every reminder off. Basis: contract for streaks and rewards; consent for browser push; legitimate interest for in-app notices.
- Feed, likes and follows
- Data: posts a publisher account wrote (title, text, image link, tags), the posts you liked, the accounts you follow and your followers, and an institution's application to publish (name, description, website, review status). A published post is public. Basis: contract.
- Plan, trial and referrals
- Data: your plan and the period and status of your access. If you sign up with someone's referral code, the link between your account and the referrer is stored; the referrer sees only how many people signed up, not your name or progress. For every third sign-up with a person's code, 30 days are added to that person's paid access. Purpose: to run access and the reward. Basis: contract. No payment is taken and no card details are collected.
- Our own usage statistics
- Only if you accept: the event name, the page path, a few small properties, the time, and a random browser ID or your account ID. Purpose: to understand which parts work. A few events needed to run the service, such as the start and end of a trial or joining the waiting list, are recorded without that consent. Basis: consent; events needed for the service: legitimate interest.
- AI usage and cost
- Data: time, call type, model, token counts and estimated cost of each AI call; message text is not part of this record. Purpose: to enforce per-user and monthly spending caps and to detect abuse. Basis: legitimate interest.
- Security log
- Data: e-mail and IP address, the kind of action (such as signing in or changing an e-mail), small details and the time. Purpose: to investigate abuse and to be clear about who did what. Basis: legitimate interest; where the law requires it, legal obligation.
- Technical data when you connect
- Each time you connect to Daenaly, the server and the service in front of it see your IP address and technical request details (browser, page, time). We use them for security, to prevent abuse and to limit the number of requests; the limit counters are short-lived. Basis: legitimate interest.
- Teacher introductions
- If you ask for a teacher introduction: your goal, level, time zone, free times, budget band, the time you consented, the status and the teacher you chose, and any report you may write about a teacher. If you are a partner teacher yourself, your display name, photo and short bio are shown in the teacher directory, and a code (T-XXXXXX) is created for your share links; it holds no learner data. Basis: your consent to send the request to teachers; contract.
- Sending e-mail
- Data: recipient, language, kind, subject and body of each e-mail (it may contain a name or a one-time link), delivery status and number of attempts. Purpose: so service e-mails arrive reliably and are retried if a server stops. Basis: contract; weekly e-mail: consent.
- Support
- Data: your e-mail and name, the subject, the text of each message (from you, from us and internal team notes), attachments you send (png, jpg, pdf or txt) and e-mail headers. If you write to support@daenaly.ir, that e-mail is stored as a support request. Attachments are kept privately, outside the public folder. Purpose: to answer and follow up. Basis: contract (account holders); a visitor without an account: steps at their own request or legitimate interest; a request about data rights: legal obligation.
- Founding-member waiting list
- Data: e-mail, language, your relationship to Persian, the source, the time of consent, the time of confirmation (double opt-in by e-mail link) and the time of unsubscribing. Purpose: to tell you once when the full plan opens. The list takes no payment. Basis: consent.
- Partner enquiries from institutions
- Data: contact person, role, e-mail, phone, website, country, message and, if you wish, optional papers (a registration certificate, an introduction letter or another document as pdf, jpg or png), which are kept privately. Purpose: to answer the enquiry. Basis: legitimate interest or steps at your own request.
- Teacher applications
- Data: full name, public display name, e-mail, phone (optional), country, time zone, languages and levels you teach, specialties, experience, short bio, links, the three declarations with their time, status and the reason for the decision; and the documents you upload (degree or teaching certificate, CV, reference letter; pdf, jpg or png up to 8 MB). Documents are kept privately, outside the public folder, and only the reviewing team opens them with a short-lived link. An application is not read until you confirm your e-mail. Basis: steps at your request before a contract; processing the documents: your consent.
- Institution teams
- If you are on an institution's team: your role (owner, admin, editor or viewer), who added you and when, the e-mail the institution invited, and the institution's legal details (name, country, registration number, website, contact e-mail, logo). The institution's owners and admins see your name and role. Basis: steps at your request or contract; an invitation the institution sent to an address: legitimate interest.
- Link to an admin account
- If you are a main administrator of Daenaly and link your app account to an admin-panel account, we record which account it is linked to, how this was proven, when and by whom. Purpose: so the app recognises you as a super user. Basis: legitimate interest (securing the operator's own accounts).
- Campaigns, codes and renewal offers
- Data: which campaign you joined by link or code, how and when, whether you saw the banner, and a snapshot of the benefit (for example extra trial days or a discount); and a discount offered to you before a plan or trial ended (percentage, dates, whether you accepted, through which channel). Purpose: to give a benefit only once and to count the results. Basis: contract for a benefit you asked for; legitimate interest for the in-app notice; consent for the offer e-mail.
Accounts of the staff of the admin panel (e-mail, name, password hash, role) are not learner data and are not described here.
4.Artificial intelligence
- Simorgh, the chat companion in Daenaly, is artificial intelligence, not a person. The app labels it "AI tutor online"; when the AI service is not available, Simorgh answers from the lesson notes and the chat page labels that "Curriculum tutor (offline mode)".
- An AI answer can be wrong. Do not use it in place of a teacher's opinion or a reliable source.
- The text you type and the history of that conversation are sent to our AI gateway (an OpenAI-compatible service) and the models behind it. We do not add your e-mail or name to the request; whatever you type is sent as you typed it. Do not type passwords, health information or identity documents in the chat.
- For pronunciation, the text of the phrase you want to hear (from a lesson or Explore) is sent to a text-to-speech service; your identity does not go with it.
- Some Explore pictures are AI-generated illustrations and are labelled "AI-generated illustration". Persian literary text in Daenaly is quoted as it appears in its source; AI does not write or change it.
5.Sharing with teachers and institutions
- Teacher introduction
- Only after you send the request and tick the consent box. A member of our team reads the request and chooses up to 3 partner teachers. Those teachers see the details you wrote in the form (goal, level, time zone, free times, budget). When you choose one teacher, your name and e-mail go to that one teacher only, and one introduction e-mail goes to both of you. A report you write about a teacher stays with us.
- Link with your own teacher or institution
- A teacher or institution sees nothing about you until you agree. If you agree, they see your name, e-mail and learning progress (words mastered, lessons completed). You can leave at any time with one click in your profile; from that moment they no longer see your progress or personal details, and only an anonymous count ("students so far") remains. Members of an institution's team with the editor or viewer role do not see any student's name, e-mail or progress.
- Referral codes and teacher share links
- The person who gave you their referral code does not see your progress or personal details. If you sign up through a teacher's share link, the sign-up is attributed to that teacher, but the teacher does not see your name or progress unless you agree to the link described above.
6.Who receives data
We do not sell your personal data and we do not share it for advertising. Only these recipients and processors receive data, to run Daenaly:
- Hosting (a virtual server in the Netherlands)
- Runs the database, the backend, the files and the backups. All the data above is on it.
- AI gateway and the models behind it
- An OpenAI-compatible service that produces Simorgh's answers, the end-of-session evaluation and text-to-speech. It receives the text of your conversation and its history. We do not add your e-mail or name to what it receives.
- Sentry (error monitoring)
- Receives reports of application errors: the stack trace and the context of the failed request (it may include the page address and a user ID). E-mail addresses and tokens are removed from the report texts.
- E-mail provider (SMTP)
- Sends verification and password-reset e-mails, replies to forms and the optional e-mails; it sees the recipient address, the name and the text of the e-mail.
- Content-delivery and protection service (CDN)
- A CDN and proxy service may sit in front of the site; it sees the IP address and technical request details of every visitor.
- Browser push services (Google, Mozilla, Apple)
- Only if you allow notifications: they deliver the notice to your device and see the notification address and its text.
- Speech services (the gateway and Microsoft Edge TTS)
- They turn the text of a phrase you want to hear into sound. If the main engine is off or fails, a Microsoft Edge TTS voice takes over. Only the text of the phrase is sent, not your identity.
- Public image archives (Wikimedia, Metropolitan Museum, Unsplash)
- Some Explore pictures are loaded directly from an archive. In that case your browser connects to that site, and the site sees your IP address and browser details, but nothing from your account.
- Partner teachers (with your consent)
- What the section "Sharing with teachers and institutions" describes, and no more.
If a court or authority lawfully requires data from us, we hand over only what the law requires.
7.Where data is processed and transfers outside the EU
Our servers are in the Netherlands, inside the European Union. Where the AI gateway and the models behind it, Sentry, the e-mail provider and the CDN process data is decided by those providers, and it may be outside the European Union and the European Economic Area. We are confirming the location and the transfer safeguards of each and will update this section when they are confirmed.
If you do not want your messages to go to such a service, do not use the chat with Simorgh; the lessons and the rest of the app work without it.
8.How long we keep data
A nightly job applies these periods. Anything not listed stays until you delete your account.
- Usage statistics events
- 14 months.
- Chat messages
- 12 months, then the messages are deleted. The session itself and numeric scores remain.
- Security log
- 12 months, then the e-mail, IP address and account number are removed from the rows (the row itself stays).
- In-app notices
- 12 months.
- Teacher-introduction requests
- 12 months after the request is closed.
- Waiting list
- An address that is never confirmed: 14 days. After you unsubscribe: 24 months.
- Record of e-mails sent (with their text)
- 90 days after sending; e-mails that could not be delivered, 180 days.
- Anti-abuse code of the trial
- 24 months after the account is deleted.
- Support requests
- 24 months after closing; an open request until it is handled.
- Teacher applications
- An e-mail that is never confirmed: 7 days. A declined or withdrawn application: 12 months after the decision. Documents: 6 months after the decision, unless you ask us to keep them. An approved application: as long as the teacher profile exists.
- Papers sent with an institution enquiry
- 12 months after the enquiry is closed.
- Campaign and renewal-offer records
- 24 months, then their link to you is removed.
- Backups
- Database backups are kept for 30 days; data you deleted leaves them as the backups expire. If we ever restore an old backup, we repeat the deletion requests that were not yet carried out.
9.Your rights and how to use them
You can do most of this yourself, instantly, in your profile. The full description is on the page Your Data Rights.
- Access and a copy of your data
- In your profile, press "Download my data". You get one JSON file with your profile, progress, vocabulary, chat history, notifications and the rest of your data, in a form you can move to another system. You can do this once per hour.
- Correction
- Change your name, language, learning goal, reminders and time zone in your profile. You can change your e-mail there too: a confirmation link goes to the new address and it replaces the old one only after you open it.
- Deletion
- In your profile, press "Delete account" and confirm. Your account and the data linked to you are erased right away and all your sessions are signed out. This includes progress, vocabulary, chat history, notifications, analytics, saved items, posts, teacher requests and reports, and waiting-list or institution-form entries made with the same e-mail.
- What remains after deletion
- Cost records of AI usage with no link to you; security-log rows that no longer carry your e-mail, IP address or account number; and, only if you used the free trial, the one-way code of your phone number and e-mail for up to 24 months, which names nobody. Backups for up to 30 days.
- Restriction and objection
- In your profile, press "Pause optional processing" to switch off analytics, reminder and win-back messages, the weekly e-mail, browser push and teacher suggestions in one step. Your account and progress keep working.
- Withdrawing consent
- Use "Cookie & privacy settings" in the footer at any time to stop analytics; collection stops from that moment. Leave the waiting list and the optional e-mails with the unsubscribe link in each e-mail.
- Complaint
- You may lodge a complaint with the data protection authority of your own country.
- If you cannot do it yourself
- Write to admin@daenaly.ir, or open "Help & support" and choose the topic "My data and privacy". We answer within the time required by law.
11.E-mails we send
- Service e-mails are always sent: welcome, e-mail verification, password reset, a warning when your e-mail is changed, replies to forms and support, and a notice about your plan.
- The weekly progress e-mail is optional, and its box is unticked by default at sign-up and in your profile.
- The renewal-offer e-mail is optional too. No such e-mail is sent while paid plans are not open.
- The waiting list uses double opt-in: you are not on it until you open the link in the e-mail.
- Every optional e-mail carries a one-click unsubscribe link and a List-Unsubscribe header.
12.Minimum age
Daenaly is for people who are at least 16 years old. At sign-up there is a box you must tick ("I am at least 16 years old"). We do not check your age; we store only the time of this confirmation, not a date of birth.
We do not knowingly collect data from anyone under this age. If we learn that an account belongs to someone under this age, we delete it. If you are a parent or guardian and think your child has signed up, write to admin@daenaly.ir.
13.Security
- Passwords are stored only as hashes.
- The sign-in session is in an httpOnly cookie, and the service is used over HTTPS.
- Files that must not be public (support attachments and the documents of teachers and institutions) are kept outside the public folder, have no direct address and are opened only with a short-lived link that authorised staff create; each such link is logged.
- Staff have only the access their role needs, and actions in the admin panel are logged.
- No system is completely free of risk. If a data breach affects you, we will tell you as the law requires.
14.Payments
No payment is made in Daenaly at present. We do not ask for or store card or bank details from you, and the trial needs no card. If real payments are added one day, we will update this document and name the payment provider in it before any payment is taken.
15.Changes to this document
The version and date at the top of the page change with every change. We announce important changes in the app or by e-mail before they take effect.
16.Contact
For any question about this document or your data, write to admin@daenaly.ir. For other problems, see the help centre.