Privacy policy
What Arabic Tools collects, why, how long it is kept and what you can ask us to do about it. Most of the tools send nothing anywhere at all.
In short
- 48 of our tools run entirely inside your browser. What you type into them never reaches us, or anyone else. There is nothing for us to store, lose or hand over.
- The other 12 are AI tools. Those send the text you submit to our specialist language-processing provider to be processed, and nothing else about you goes with it.
- We never store your IP address. Where we need to tell visitors apart, we store a salted hash instead.
- We do not sell your data, and we do not send marketing email unless you ask for it.
1. Who is responsible for your data
For the personal data described here, the controller is Arabic Tools, who operates Arabic Tools.
We are based in the United Kingdom. A postal address for correspondence is available on request by email.
For anything to do with privacy or your data, write to contact@arabic-tools.com. A person reads it.
2. The tools that send nothing anywhere
Most of this site — 48 tools — is written to run in your browser and nowhere else. The worksheet generator, the handwriting sheets, the seating plan, the timetabler, the marksheet, the whiteboard and the rest do all their work on your own machine.
This is not a promise about how carefully we handle your data. It is a statement that there is no data to handle: the text, the class lists and the pupil names you type into those tools are never transmitted to this website, and they are never transmitted to anyone else. They stay in the page, and in your browser’s own storage if the tool saves your work.
Two consequences worth knowing. Anyone else who uses that browser profile can see the saved work, so a shared staffroom computer is a shared file. And because we hold no copy, clearing your browser data deletes it for good — export or print anything you need to keep.
We still log that a tool page was viewed, as described in section 4. That log records the tool, not what you did with it.
3. The AI tools, and what leaves your device
The AI tools cannot work locally, so the text you submit is sent to our specialist language-processing provider, which returns the result. We pass on what you typed and the instructions for the task. We do not pass on your name, your email address, your account or any identifier that ties the request to you.
The tools that do this, in full:
- Arabic Diacritiser
- Arabic Grammar Drill
- Arabic Proverb Explorer
- Arabic Text Leveller
- Arabic Verb Conjugator
- Arabic Vocabulary Builder
- Arabic Writing Feedback
- Guided Writing Builder
- Qur'an Verse Explorer
- SEND Support Plan Architect
- Student Work Corrector
- YouTube Lesson Generator
Every other tool on the site is one of the browser tools in section 2.
We keep the result for 1 week so that submitting the same text again returns the same answer without paying for it twice. The cache is stored on our server and keyed by a hash of the request, so your text cannot be read out of the key — but the stored answer can itself contain your text, for instance when a tool returns a corrected version of what you wrote. It is deleted automatically when it expires.
Do not put personal data about a pupil into an AI tool. Use initials or a made-up name. The AI tools were not designed to carry pupil data, and none of them needs a real name to do its job. The tools that are meant to hold class lists are all browser tools, precisely so that this problem never arises.
Our provider processes the request on our behalf under their own terms, does not use it to train their models, and holds it only briefly for abuse monitoring. Processing may take place outside the United Kingdom; where it does, the transfer relies on the UK International Data Transfer Addendum or an adequacy decision.
4. What we collect, and why
This is the complete list. Nothing is collected that is not in this table.
| What | Specifically | Why | Lawful basis | How long |
|---|---|---|---|---|
| Account details | Your email address, a username, and a password we only ever store hashed. | To give you an account and let you sign in. | Performance of our contract with you. | Until you close your account, then 30 days. |
| Subscription and payment records | What you bought, when, how much, and the reference our payment provider gives the transaction. Not your card number — we never receive it. | To take payment, give you what you paid for, and keep our accounts. | Contract, and legal obligation for the tax records. | Six years after the end of the tax year, because HMRC requires it. |
| Usage events | That a tool was viewed or run, which tool, which plan, how long it took, and how many tokens it cost us. Tied to your account id if you are signed in, or to a salted hash if you are not. | To enforce the free allowance, stop abuse, and see which tools are worth keeping. | Legitimate interests: running the service and not being bankrupted by it. | 180 days, then deleted automatically each night. |
| Recommendation clicks | That someone clicked a book or classroom-supplies link, which link, and from which tool. The visitor is recorded as a salted hash that changes every day. | To know whether the recommendations are any use. | Legitimate interests. | Kept as aggregate counts; the daily hash cannot be linked across days. |
| Emails you send us | Whatever you write, and your address. | To answer you. | Legitimate interests. | Two years, so we can pick up a thread later. |
| Server logs | Standard web-server records kept by our host, which do include IP addresses. | Security, and diagnosing faults. | Legitimate interests. | Kept and rotated by our host on their schedule, typically a few weeks. |
5. Why we do not keep IP addresses
To give visitors without an account a fair daily allowance, we have to be able to tell one visitor from another. The obvious way is to store the IP address. We do not do that.
Instead we store a 32-character hash. It is produced from your IP address and browser identification, mixed with a secret key held on our server, and the original values are discarded immediately. The same visitor produces the same hash, which is all the allowance needs; the hash cannot be turned back into an IP address.
We put that hash in a first-party cookie so that the next visit is recognised by the cookie instead — which means a changing mobile IP address does not cost you your allowance. If you refuse cookies the hash is recalculated each time and the tools still work.
To be accurate about it: because the secret key exists, this is pseudonymised data rather than anonymous data, and we treat it as personal data throughout this policy. It is a deliberate reduction in what we hold, not a claim that we hold nothing.
6. Cookies and third parties
The cookies we set, and the ones other people set, are listed individually in our cookie policy.
The kinds of company that receive data because of how the site is built are:
- Our hosting provider — the servers the site itself runs on.
- our specialist language-processing provider — processes the text submitted to the AI tools, and only that.
- Our payment provider — takes card payments. They receive your card details directly; we never do.
- Google, through AdSense — chooses and measures the adverts. Its script is told before it runs that it may not store anything, read an advertising identifier or personalise what it shows, and only your acceptance lifts that. How Google uses advertising cookies · Google Ad Settings
- Content delivery networks — serve the fonts and icons the interface is drawn with.
Loading a font or an icon set from another company’s network means your browser asks them for the file, and they see your IP address in the course of answering. We mention it because that is true of almost every site that does it, and most do not say so.
If you need these named individually — for a school procurement check or a security review — email us and we will confirm them in writing.
We do not sell personal data, and we have never shared it for anyone else’s marketing.
7. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct it if it is wrong;
- delete it;
- stop or restrict what we do with it;
- hand it over in a portable form;
- stop relying on legitimate interests, where that is our basis.
Email contact@arabic-tools.com and we will deal with it within one month, free of charge. We may ask you to confirm who you are first, so that we do not hand your data to someone else.
One limitation on deletion. We can delete your account and everything attached to it. We cannot delete work saved inside a tool on your own device, because we never held it — clearing your browser data removes that. We must also keep payment records for six years, as tax law requires.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
8. Children
This site is for teachers and adult learners. We do not market to children, we do not knowingly create accounts for anyone under 16, and no tool asks a pupil for anything.
Teachers do enter pupil names into the classroom tools. Every one of those tools is a browser tool, deliberately: pupil names typed into a seating plan or a marksheet stay on the teacher’s own machine and are never sent to us. If you believe a child’s personal data has nonetheless reached us, tell us and we will delete it.
9. Security
The site is served over an encrypted connection throughout. Passwords are stored in a hashed form and cannot be read by us. Card details never reach our servers. Administrative access is restricted to the people who run the site.
The strongest security measure here is the architecture rather than any of that: the great majority of what people do on this site never leaves their own computer, so there is nothing on our side to breach.
If a breach happens that is likely to put anyone at risk, we will report it to the Information Commissioner within 72 hours and tell the people affected.
10. Changes
When this policy changes, the date at the top changes with it. If a change materially affects what we do with your data, we will tell account holders by email rather than rely on you noticing.