ELAF Privacy Policy

Last updated: 2 September 2026

Who we are

ELAF is operated by Hantoush Inc., a company incorporated in Ontario, Canada. Hantoush Inc. is the organisation responsible for the personal information described in this policy, and is who you are dealing with when you use ELAF. Where this policy says "we" or "us", it means Hantoush Inc.

ELAF is an Arabic language learning service for children ("ELAF", "we", "us"). This policy explains what we collect, why, who we share it with, how long we keep it, and how you can see or delete it. It applies to the ELAF website at elaf.ca and to the ELAF learning application.

Accounts belong to parents, not to children

Only a parent or guardian creates an ELAF account. A child never creates an account, never signs in with an email address or password, and never signs in with Google. A parent adds each learner to their own account, and authorises the specific device the child uses. The child then reaches their learning profile on that authorised device without entering any credentials.

Every decision about a child's information on ELAF is made by the parent who holds the account.

What we collect from the parent

First and last name
Email address
Phone number
Relationship to the learner, for example mother, father or sibling
Country, state or province, city and local time zone
A password, if you choose to create one. Passwords are never stored as written; only an irreversible cryptographic hash is kept.
Your Google account identifier and email address, if you choose to sign in with Google. See "Signing in with Google" below.
The dates you signed in, and the consents you gave with the date you gave them

What the parent tells us about each learner

First and last name, in English and where given in Arabic
Date of birth, which we use to set the age-appropriate content level
Gender
The Arabic variant the family speaks, and the associated country of heritage
City, region, country and time zone, either inherited from the parent or set separately
A learner email address and phone number, only if the parent chooses to give them

Photographs and avatars

ELAF lets a parent create a cartoon avatar for themselves and for each child from a photograph. This is optional. ELAF works without it, and no photograph is ever required.

If you choose to use it:

You take or choose a photograph of the person, using your device's camera or photo library.
You are asked to confirm you consent before the photograph is used, and that confirmation is recorded.
The photograph is sent to OpenAI, which uses it to generate a cartoon avatar. It is used for that purpose and no other.
Both the original photograph and the generated avatar are stored by ELAF while your account is open, so the avatar can be regenerated or replaced without asking you for the photograph again.

A photograph of a child is personal information about that child. Only the parent holding the account can add one, and only after confirming consent. You can ask us to delete a photograph at any time, on its own, without closing the account. Email hisham@elaf.ca.

What ELAF records as the child learns

The child's spoken and typed answers during learning and assessment activities, kept as text
Progress, mastery and pronunciation scores, and which activities were completed
Session records showing when learning took place and for how long

ELAF does not keep recordings of a child's voice. Speech is converted to text as the activity happens, and the audio is not stored.

Signing in with Google

Signing in with Google is optional. You can always create an ELAF account with an email address and a password instead, and nothing in ELAF requires a Google account. Children never sign in with Google.

When a parent chooses it, Google gives ELAF only:

Your Google account's permanent identifier
Your email address, and Google's confirmation that the address is verified
Your first and last name

Google's basic profile also includes the picture and language setting on your Google account. ELAF does not store either of them.

We use what we do keep for one purpose: to create or recognise your ELAF parent account and sign you in. Because Google has already confirmed you control that mailbox, we do not send you a separate verification code.

ELAF does not receive your Google password, your contacts, your calendar, your files, or any other Google data. We request no Google permissions beyond your basic profile and email address.

We do not sell Google user data. We do not share it with data brokers. We do not use it for advertising, for credit assessment, or to train artificial intelligence or machine learning models. ELAF's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect ELAF from your Google account at any time at myaccount.google.com/permissions. That stops future Google sign-ins. To remove your ELAF information, use the deletion request below.

Voice and the AI conversation

ELAF's learning conversations use artificial intelligence. To generate a reply, what the child says or writes and the surrounding lesson context are sent to OpenAI, which processes them and returns a response. Under OpenAI's API terms, content sent through the API is not used to train OpenAI's models. ELAF does not use children's answers to train any model of its own.

A parent must accept the Voice Interaction and AI Learning consents before a child uses these features.

Who else receives information

Stripe processes subscription payments. Card numbers are entered directly with Stripe and never reach ELAF's systems. ELAF stores only a Stripe customer reference and the subscription status.
OpenAI processes learning conversations, generates lesson imagery, and generates avatars from any photograph you choose to provide, as described above.
Our email provider delivers account emails such as verification, password reset and progress summaries to the parent's address.
Hostinger hosts the ELAF website, servers and database on our behalf.

We do not sell personal information. We do not share it for advertising. We disclose it otherwise only where the law requires it.

Where information is held

ELAF's servers and database are hosted in the United States. Our processors, including Stripe and OpenAI, may process information in other countries. Information stored in another country may be accessible to the courts and authorities of that country under its laws.

How long we keep it

Account and learner records are kept while the account is open.
Learning history and progress are kept while the account is open, so a parent can follow their child's progress over time.
Photographs and generated avatars are kept while the account is open, or until you ask us to delete them.
Internal diagnostic snapshots of learning turns are removed once they are more than 30 days old, and cancelled learning sessions once they are more than 7 days old.
When you ask us to delete your account, we delete your information and your children's information within 30 days, except anything we are required by law to keep, such as billing records.

Cookies and browser storage

ELAF stores a small amount of information in your browser to make the service work: your sign-in session so you are not asked to sign in on every page, and your place in registration so you can pick it up where you left off.

ELAF does not use advertising cookies, analytics services, or third-party tracking of any kind. We do not track you across other websites, and nothing on ELAF reports your behaviour to an advertising network.

Clearing your browser's storage signs you out and clears any saved registration progress.

Your rights as a parent

You may ask us to:

Show you the information we hold about you and your children
Correct anything that is wrong
Delete your account and your children's information
Stop using your children's information for a particular feature, by withdrawing a consent

Email hisham@elaf.ca from the address on your ELAF account. We will respond within 30 days.

You may withdraw the Voice Interaction, AI Learning or Child Data consents at any time. Withdrawing a consent stops the feature it covers.

Children's privacy

ELAF is made for children to use, and it is built so that a parent stands between the child and the service at every point. A parent creates the account, adds each learner, authorises each device, and accepts the consents covering the child's information, the use of artificial intelligence in learning, and voice interaction. Each consent is recorded with the date it was given.

We collect from a child only what the learning activity needs, and only after their parent has agreed to it. We do not show children advertising, and we do not build advertising profiles. We do not ask children for information about themselves beyond what the lesson requires, and we do not let children publish or share information publicly.

A parent may review, correct or delete their child's information at any time using the contact address above, and may refuse any further collection by closing the account.

ELAF does not knowingly collect information from a child except through the account of their parent or guardian. If you believe a child's information has reached ELAF without a parent's involvement, email hisham@elaf.ca and we will delete it.

How we protect information

Traffic between your device and ELAF is encrypted in transit, and connections between ELAF and its database are encrypted. Passwords are stored only as irreversible hashes, never as written text. Access to production systems is limited to authorised personnel. Payment card details never reach ELAF, because Stripe collects them directly.

No service can promise perfect security. If a breach affects your information, we will tell you and the relevant authority as the law requires.

Changes to this policy

If we change this policy we will update the date at the top, and where the change is significant we will tell account holders by email.

Contact

Hantoush Inc.
ELAF, Ontario, Canada
Email: hisham@elaf.ca