Privacy Policy

1. Who operates Noorlingo

Noorlingo is operated by:

Noor Lingo (FZC)
United Arab Emirates
Email: [email protected]
Website: noorlingokids.com

For the purposes of applicable data-protection legislation, this entity is responsible for Noorlingo’s handling of personal information except where a school or another organisation has its own legal responsibilities for information processed through a school account.

2. Our approach to children’s privacy

Noorlingo is designed for children and therefore applies child-protective privacy settings to child profiles.

We follow these principles:

• collect only information reasonably necessary to provide the learning service;
• do not sell or rent personal information;
• do not use children’s personal information for advertising;
• do not use behavioural profiling for commercial purposes;
• do not collect precise location;
• do not allow messaging between children;
• do not collect children’s personal photographs;
• restrict access to children’s information;
• keep information only for a defined purpose, and delete it when a parent or guardian asks us to;
• give parents and guardians meaningful control over children’s information; and
• explain our practices in language families can understand.

Noorlingo does not ask a child to provide a date of birth simply to create a normal child profile. Because the service is designed for children, child profiles receive child-level privacy protections by default.

Noorlingo does not currently use a separate age-assurance or age-verification process. A family account is created by an adult, who confirms that they are the child’s parent or guardian or are otherwise authorised to act for the child, and a child who joins through a school is enrolled by the school.

3. Parents, guardians and consent

A family account must be created and controlled by a parent, guardian or other authorised adult.

Before personal information is collected for a child, Noorlingo requires the parent or guardian to provide the consent required by applicable law.

When a parent or guardian creates a family account, Noorlingo asks them, before any child profile can be added, to confirm that they are the child’s parent or guardian or are otherwise authorised to act for the child, and to agree to Noorlingo collecting and using the child’s information as this policy describes. Parents and guardians who already have an account are asked once, the next time they use Noorlingo after this version takes effect.

Where a child is under 13 and UAE child digital-safety requirements apply, this consent is explicit and recorded, and it is linked to an adult account whose email address has been confirmed or which signs in with Apple or Google.

For a child who joins Noorlingo through a school, the school is responsible for obtaining any parent or guardian consent required by applicable law before enrolling the child (see section 6). Noorlingo does not treat a school account, by itself, as a substitute for that consent.

Noorlingo records:

• the parent or guardian’s account;
• their confirmation that they have authority to act for the child;
• the version of this policy agreed to;
• the date and time of consent; and
• how the adult account was verified: a confirmed email address, or sign-in with Apple or Google.

A parent or guardian may withdraw consent at any time by closing a child’s profile or the whole account in the Parents area of the app, or by asking us to permanently delete their information (see section 17).

Withdrawing consent will not disadvantage the child, although Noorlingo may no longer be able to provide features that require the information concerned.

4. Parent and guardian accounts

To create a family account, Noorlingo may collect:

• the adult’s name;
• email address;
• account authentication information; and
• information necessary to verify or secure the account.

Passwords are protected and are not stored as readable plain-text passwords.

The parent’s email address may be used for:

• account verification;
• security messages;
• account recovery;
• important service notices;
• privacy or deletion requests; and
• communications requested by the account holder.

A parent’s contact information is not used for behavioural advertising.

5. Child profiles

A child profile is intentionally limited.

Noorlingo may store:

• a first name or nickname entered by the parent, school or child as appropriate;
• the illustrated Noorlingo avatar selected for the child;
• stories and activities started or completed;
• learning progress;
• badges, points and streaks;
• answers and choices made during learning activities;
• written responses;
• limited spoken responses converted to text where a speech activity permits this; and
• limited session and activity information needed to provide the service.

Noorlingo does not normally ask a child for:

• date of birth;
• personal email address;
• telephone number;
• home address;
• precise location;
• contact list;
• real profile photograph;
• social-media account; or
• advertising identifier.

Profiles created in older versions of Noorlingo before September 2026 may still contain an age range, a starting English level or whether the child is a boy or a girl, which those versions asked for. Noorlingo no longer asks for or uses this information, and we will remove it if a parent or guardian asks us to. It is also deleted when the associated profile is permanently deleted.

6. Children using Noorlingo through a school

A school may create a Noorlingo class and provide children with a class code.

A child may join the class using that code, enter a name or nickname and select a Noorlingo avatar.

A school-based child account does not require the child to provide a personal email address or password.

Before allowing children to use Noorlingo, the school must have the authority required under applicable law to enrol those children and must provide any notices that the law requires.

The school is responsible for obtaining any parent or guardian consent required by applicable law before enrolling a child in Noorlingo. Noorlingo does not collect that consent itself from the parents of children who join through a school.

A school’s authority to enrol a child does not remove any direct caregiver-consent requirement that applies under applicable law.

Separate data-protection or processing terms may apply between Noorlingo and a school where required by applicable law or the school’s procurement requirements. Those terms may define the parties’ respective responsibilities for permitted educational use, confidentiality, security, service providers, international processing, rights requests and deletion.

Authorised school staff may see information necessary to administer learning, including:

• the child’s name or nickname;
• avatar;
• progress;
• completed activities;
• last activity;
• approximate session duration; and
• whether the child is currently using the school service.

Teachers do not see a child’s private written responses through the standard teacher view and cannot see unrelated family-account information.

A teacher may correct a child’s class name or avatar or remove the child from the class.

Noorlingo does not use school children’s information for advertising or unrelated commercial profiling.

7. What children write

Some Noorlingo activities ask children to write short responses about a story, text or learning activity.

These responses may be stored with the child’s learning progress so they remain available when the child changes device.

Some activities may allow the child to speak an answer instead. When this happens, speech recognition converts the spoken answer to text and the resulting text may be saved as part of the activity.

Children should not enter personal information about themselves or other people into open-response activities.

Written responses are not made public and are not visible to other children or unrelated families.

They are deleted when the associated child data is permanently deleted, subject to the limited backup period described below.

8. Microphone and speech recognition

Some Noorlingo activities ask a child to read aloud or speak an answer.

The microphone is used only when a speech-enabled activity is being used and the necessary permission has been granted.

Apple devices

On an iPhone or iPad, speech recognition may use technology provided by Apple. Depending on the device and its settings, processing may occur on the device or through Apple’s systems.

Apple’s handling of information through its services is governed by Apple’s applicable privacy terms.

Android devices

On Android devices, speech recognition may use technology provided by Google. Depending on the device and its settings, processing may occur on the device or through Google’s systems.

Google’s handling of information through its services is governed by Google’s applicable privacy terms.

Noorlingo web app

In supported web reading activities, the browser may capture a short audio segment and send it securely through Noorlingo’s service to a speech-processing service provider for conversion into text.

No child name, email address or other direct account identifier should be intentionally included with the audio request.

The resulting transcription is returned to Noorlingo so the reading activity can respond.

The speech-processing provider is obliged not to retain any data it processes for Noorlingo.

Noorlingo does not use children’s voice recordings to:

• identify the child;
• build biometric or voice profiles;
• advertise to the child;
• create behavioural profiles; or
• train Noorlingo advertising systems.

Except where a spoken answer is intentionally saved as text as described above, Noorlingo does not store the child’s audio recording in the child’s Noorlingo profile.

A parent or child may refuse microphone permission. Core parts of Noorlingo that do not require speech recognition remain available.

9. Camera

On supported phones or tablets, Noorlingo may request camera access for the limited purpose of scanning a Noorlingo class code.

The camera image used to locate the code is processed for that purpose and is not used as a child’s photograph or profile image.

Noorlingo does not use the camera for advertising, facial recognition or biometric identification.

If camera permission is refused, the class code can be entered manually where that option is available.

10. Learning and usage information

Noorlingo records limited first-party information about how the service is used so that it can:

• save a child’s place;
• record learning progress;
• award progress indicators such as badges or points;
• operate classroom features;
• diagnose service problems;
• protect the service from misuse; and
• understand whether educational activities function correctly.

This may include:

• when a session begins;
• activity completion;
• approximate time spent in an activity;
• progress through learning material; and
• an internal account or profile identifier.

This information is not used for targeted advertising or behavioural advertising.

Noorlingo does not use third-party advertising analytics or attribution SDKs to track children’s activity across other apps or websites.

11. What Noorlingo does not do

Noorlingo does not:

• display third-party advertising to children;
• sell or rent children’s personal information;
• use children’s personal information for targeted advertising;
• create commercial behavioural profiles of children;
• use social-media advertising trackers in the children’s learning experience;
• collect precise location from child profiles;
• collect children’s phone contacts;
• collect children’s calendars;
• use children’s real photographs as standard profile photographs;
• allow open messaging between children;
• allow children to make their profiles publicly searchable; or
• intentionally collect more child information than reasonably necessary to provide the learning experience.

12. Signing in with Apple or Google

A parent or guardian may be offered the option to sign in using Apple or Google.

When this option is selected, the relevant provider confirms the authentication and may provide Noorlingo with information such as the adult account holder’s name and email address.

Noorlingo does not receive the user’s Apple or Google password.

Apple may allow users to use a private forwarding email address. Noorlingo supports this where available.

Information processed directly by Apple or Google is also subject to the provider’s applicable privacy terms.

13. Service providers

Noorlingo uses a limited number of service providers where reasonably necessary to operate the service.

These may include:

• our hosting and technical-infrastructure provider, whose servers also send Noorlingo’s emails;
• Apple and Google for authentication or device-based services;
• Apple or Google speech-recognition services where selected by the device; and
• a speech-processing provider for specified web speech-to-text processing, which is obliged not to retain any data it processes for Noorlingo.

Service providers are permitted to process personal information only for the services for which they are engaged and subject to the applicable contractual, confidentiality, security and data-protection requirements.

Noorlingo does not authorise service providers to use children’s Noorlingo information for their own targeted advertising on Noorlingo’s behalf.

Where applicable, Noorlingo requires appropriate contractual protections from processors handling personal information, including confidentiality, security, permitted-purpose and data-protection obligations appropriate to the services they perform.

14. International processing

Personal information held by Noorlingo does not stay only in the United Arab Emirates. At present it is processed outside the UAE in these ways:

• Hosting. Noorlingo’s servers, including its database and backups, are hosted in data centres in the United States. Account information, child profiles, learning progress and written answers are stored and processed there, and Noorlingo’s emails are sent from the same provider’s servers.
• Speech-to-text in the web app. When a child reads aloud in a supported activity in the web app, the short audio segment is sent through Noorlingo’s servers to a speech-processing provider based in the United States, which converts it into text outside the UAE and is obliged not to retain any data it processes for Noorlingo (see section 8).
• Sign in with Apple or Google. When a parent chooses to sign in with Apple or Google, the sign-in is handled by Apple or Google on their own systems, which may be outside the UAE (see section 12).
• Speech recognition on phones and tablets. On iPhone, iPad and Android devices, speech recognition is provided by Apple or Google and, depending on the device and its settings, may be processed on their systems outside the UAE (see section 8).

Where personal information is transferred outside the UAE, Noorlingo will only transfer or permit processing of that information where the transfer is permitted by applicable data-protection law. Noorlingo will apply the contractual, legal or other safeguards required in the circumstances.

Parents may contact Noorlingo for additional information about relevant categories of recipients and cross-border safeguards.

If Noorlingo changes the location of its core hosting, this section will be updated once the new hosting arrangement is live and verified. Until then, the United States hosting statement above remains the current position.

15. Information kept on the device

Some information may remain locally on a phone, tablet, television or browser so Noorlingo can work properly.

This may include:

• authentication information that keeps the account signed in;
• the parent’s email address if the parent chooses a “remember me” feature;
• the last child profile used on the device;
• class-session information on a school device; and
• a recent local copy of learning progress to protect against temporary loss of internet access.

Local information may be removed when Noorlingo is uninstalled, when browser/site data is cleared or when the device’s operating system removes application data.

Removing the app from a device does not by itself permanently delete the Noorlingo account or server information.

16. Data retention

Different information is kept for different periods because it serves different purposes.

Active family accounts

Personal information associated with a family account is kept for as long as the account exists, so that a child’s progress, badges and learning history are still there when the family comes back, including after a long break.

Closed family accounts

Closing an account is different from permanently deleting it.

A closed account is removed from the normal app experience straight away, but it is kept on our servers so it can be recovered by signing in again if it was closed by mistake.

A closed account is kept so it can be recovered until the parent or guardian asks for it to be permanently deleted (see section 17). At present, closed family accounts do not have an automatic expiry period. A parent may request permanent deletion at any time. Closed-account information is not used for advertising or unrelated commercial profiling.

School profiles

A school child’s profile is kept while the child is in the class.

When the child is removed from the class, the child’s identifiable profile, progress and written responses are deleted unless the profile has legitimately been linked to a parent-controlled family account.

Schools are encouraged to review their classes regularly so pupil profiles are not kept longer than needed.

De-identified information

Information that has been permanently de-identified so that it can no longer reasonably be connected to an identifiable child may be retained for purposes such as security, service reliability or understanding the overall effectiveness of Noorlingo.

17. Permanent deletion

A parent or guardian may request permanent deletion of:

• an individual child profile; or
• the entire family account and its associated child profiles.

How to request permanent deletion

In the Parents area of the app, a parent can close a child’s profile or the whole account. Closing takes effect straight away and can be undone by signing in again.

Permanent deletion is requested by emailing [email protected]. The app’s close-account screen explains how.

Permanent deletion is not a button inside the app. It cannot be undone, and Noorlingo is used by children: a request by email makes sure a family’s information is never permanently deleted by a child, or by anyone else who does not control the account.

Before anything is deleted, we reply to the email address registered on the account and ask the account holder to confirm the request.

What happens next

Once the account holder has confirmed the request:

Noorlingo will permanently erase the account and associated personal information from its active database within 30 days.

This includes, as applicable:

• the adult account;
• child profiles;
• learning progress;
• written answers;
• badges and points;
• stored activity records associated with the account; and
• other personal information that is no longer legally required.

After deletion from Noorlingo’s active systems, residual copies may remain in routine system backups for up to a further 30 days before those backups expire or are overwritten.

Backup copies are not restored for ordinary business use after a valid deletion request except where technically necessary for disaster recovery or required by law. If a backup is restored, deletion controls must be reapplied.

Certain information may be retained where Noorlingo is legally required to retain it or where limited retention is necessary to establish, exercise or defend legal rights. Any such information will be restricted to that purpose.

18. Withdrawing parental consent

Parents and guardians may withdraw permission for Noorlingo to continue collecting or using a child’s personal information.

A parent may withdraw permission by closing a child’s profile or the whole account in the Parents area of the app, or by contacting Noorlingo at [email protected].

Noorlingo will provide a reasonably simple and accessible process for withdrawal.

Where withdrawal means Noorlingo can no longer lawfully or practically provide the child’s profile, Noorlingo will explain this and offer appropriate deletion of the affected information.

Withdrawal does not affect processing that was lawful before permission was withdrawn.

19. Parents’ and users’ privacy rights

Depending on the applicable law, a parent, guardian or other data subject may have rights to:

• know what personal information Noorlingo holds;
• understand why it is processed;
• receive a copy of relevant information;
• correct inaccurate information;
• request erasure;
• restrict certain processing;
• object to certain processing;
• withdraw consent;
• request data portability where applicable;
• receive information about categories of recipients;
• receive information about international transfers and safeguards; and
• object to automated decision-making where applicable.

Noorlingo does not use children’s personal information to make solely automated decisions that have legal or similarly significant effects on a child.

A parent or guardian normally exercises privacy rights on behalf of a child using a family account.

For children using Noorlingo through a school, parents may contact either Noorlingo or the relevant school. The school may also have separate responsibilities regarding pupil information.

Noorlingo may request reasonable verification before providing, changing or deleting personal information so that children’s information is not disclosed to an unauthorised person.

Privacy requests may be sent to: [email protected]

Requests are handled without charge where required by law and within the timeframe required by applicable law.

20. Additional protection for children under 13

Where Noorlingo collects personal information from a child under 13 and applicable law requires parental consent, Noorlingo requires that consent before the collection takes place: from the parent or guardian through the step described in section 3 for a family account, and through the school, as section 6 describes, for a child who joins through a school.

Noorlingo does not currently use a separate age-assurance or age-verification process. If one is introduced, this policy will be updated to describe it before it is used.

Parents have the right to:

• know what information is collected from the child;
• review the child’s information;
• correct inaccurate information;
• request deletion;
• refuse further collection or use; and
• withdraw consent.

Noorlingo does not condition a child’s participation in a learning activity on providing more personal information than is reasonably necessary for that activity.

Where a school is legally permitted to provide authorisation for an educational service on behalf of parents, Noorlingo will use the information only for the school-authorised educational purpose and not for advertising or unrelated commercial profiling.

Where direct caregiver consent is required, the school must obtain it before the child is enrolled.

21. Security

No system connected to the internet can be guaranteed completely secure.

Noorlingo nevertheless uses reasonable administrative, organisational and technical measures designed to protect personal information. The measures used are intended to be appropriate to the nature of the information and the risks associated with its processing, and to protect against:

• unauthorised access;
• inappropriate disclosure;
• alteration;
• accidental loss;
• misuse; and
• unlawful destruction.

Access to children’s personal information is limited to authorised people and service providers who require access to perform their permitted role.

Noorlingo requires processors that handle personal information on its behalf to maintain appropriate confidentiality and security protections where required by applicable contractual and data-protection requirements.

Parents and schools should also protect account credentials and should not share parent-account passwords with children.

22. Data incidents

If Noorlingo becomes aware of a personal-data breach, it will investigate the incident and take appropriate steps to contain and address it.

Where applicable law requires notification to affected individuals, schools or a regulatory authority, Noorlingo will make the required notification within the legally required timeframe.

Where a personal-data breach involves school-managed pupil information, Noorlingo will also cooperate with the relevant school as required by applicable law and the parties’ respective responsibilities.

23. Advertising, profiling and sale of information

Noorlingo does not sell children’s personal information.

Noorlingo does not rent children’s personal information.

Noorlingo does not use children’s personal information for targeted or behavioural advertising.

Noorlingo does not create commercial profiles of children based on their learning behaviour.

Noorlingo’s first-party learning records exist to provide and support the educational service.

24. Children should not provide unnecessary personal information

Noorlingo learning activities are designed to ask children about reading and learning rather than about their private lives.

Children should not type or speak unnecessary personal details such as:

• home address;
• telephone number;
• password;
• personal email address;
• private family information; or
• another person’s private information

into an open-response learning activity.

Parents and teachers are encouraged to reinforce this with younger learners.

25. United States children’s privacy

Where the U.S. Children’s Online Privacy Protection Act and Rule (“COPPA”) apply, Noorlingo provides the notices, parental controls and children’s privacy protections required by applicable law.

For children under 13, this includes verifiable parental consent where required, access and deletion rights, limits on collection, reasonable security, and a defined retention and deletion policy.

Where a school is permitted to provide consent in the educational context, children’s information is used only for the authorised educational service.

26. Other jurisdictions

Families may have additional rights under the privacy laws that apply where they live.

Where Noorlingo is offered in another jurisdiction, Noorlingo will apply mandatory local privacy rights and child-protection requirements where they apply to the service.

Nothing in this Privacy Policy is intended to remove rights that cannot legally be waived.

27. Changes to this Privacy Policy

Noorlingo may update this Privacy Policy when the service, technology or applicable law changes.

The current version and effective date will always be displayed with the policy.

If Noorlingo materially changes where personal information is stored or processed, or adds a category of service provider that materially affects children’s information, Noorlingo will update this policy as appropriate.

If a change materially affects:

• the personal information collected from children;
• the reason it is collected;
• who receives it; or
• how it is used,

Noorlingo will provide appropriate notice before the change takes effect.

Where applicable law requires new parental or caregiver consent for a material change, Noorlingo will obtain that consent before applying the new processing to the child.

28. Contact us

Questions, concerns and privacy requests can be sent to:

Noorlingo
Operated by: Noor Lingo (FZC)
United Arab Emirates
Email: [email protected]
Website: noorlingokids.com

Parents may contact us to:

• ask what information we hold;
• correct information;
• withdraw consent;
• request a copy of information;
• permanently delete a child profile;
• permanently delete an account; or
• ask a question about Noorlingo’s privacy practices.

Where applicable, individuals may also have the right to raise a complaint with the competent data-protection authority in their jurisdiction.