Privacy Policy

Information you provide

When you create an account or use Talem, we collect information you give us directly. This includes:

• Account credentials: email address, password (stored only as a salted hash), and your selected account type (parent, student, or institution representative).
• Profile details: first and last name, date of birth, gender, nationality, phone number, emirate of residence, and preferred language.
• For parents: information about your child, including their name, date of birth, gender, current school, and intended entering year.
• For students: your current education level, expected graduation year, and current school.
• For institution representatives: your job title, the institution you represent, and any access-request notes.
• Education preferences: preferred curriculum, preferred emirates, fee range, gender preference, and required facilities.
• Uploaded documents you choose to add: passport copy, Emirates ID, passport photo, transcripts and report cards, vaccination records, birth certificate, and any other documents you label and upload.
• Interactions: enquiries, applications, reviews, saved institutions, and content you submit through forms.

Information collected automatically

When you use Talem we automatically collect technical and usage information, including:

• Device and browser information (user agent, operating system, screen size).
• IP address and approximate location derived from it (city / country only).
• Usage data: pages visited, searches performed, institutions viewed, time spent, referring URL.
• Cookies, local storage, and similar technologies used to keep you signed in, remember preferences, and measure how the platform is used.
• Diagnostic and error logs captured when something goes wrong, so we can fix it.

Information from third parties

If you choose to sign in with Google, we receive your name, email, and profile photo from Google. If you submit a form protected by hCaptcha, hCaptcha receives technical signals (IP, device characteristics) to verify you are not a bot.

We process your personal data for the following purposes:

• To create and operate your account and provide the platform features.
• To match your education preferences with relevant institutions and surface useful recommendations.
• To process enquiries and applications you submit and forward them to the relevant institution (see "How We Share Your Information" below).
• To send transactional emails (verification codes, password resets, application status updates) — these are necessary to operate your account and cannot be turned off while the account is active.
• To send newsletters and product updates — only if you have opted in. You can opt out at any time from Account → Email Preferences or via the unsubscribe link in any marketing email.
• To analyse aggregated and de-identified usage data so we can improve the platform.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with applicable laws, court orders, and regulatory obligations in the UAE and any other jurisdiction whose laws apply to you.

If you are in the European Economic Area or the United Kingdom, the GDPR requires us to identify a legal basis for each type of processing. Our bases are:

• Performance of a contract: to provide the platform features you signed up for, including processing your applications and enquiries.
• Consent: for marketing emails, optional profile fields, and any processing where we ask for your explicit permission. You can withdraw consent at any time.
• Legitimate interests: for analytics, product improvement, security monitoring, and fraud prevention — always balanced against your rights.
• Legal obligation: where we are required by law to retain or disclose information.

With educational institutions

When you submit an enquiry or an application through Talem, we share the relevant information with the educational institution you selected. For enquiries this typically includes your contact details and the message you wrote. For applications this includes your full application details and any documents you uploaded as part of the application. We share this information so the institution can respond to you and process your application; once shared, the institution becomes an independent controller of that data and its own privacy notice applies.

With service providers (processors)

We rely on the following third-party services to operate Talem. Each is bound by contractual data-processing terms and only processes your data on our instructions:

• Supabase (United States / European Union) — our database, authentication, and file storage provider.
• Resend (Ireland, European Union) — our transactional and marketing email delivery provider.
• Vercel (global edge network) — our application hosting provider; also provides aggregate performance analytics.
• PostHog (United States) — product analytics to understand how the platform is used.
• Sentry / BetterStack (European Union / United States) — error monitoring and diagnostics.
• hCaptcha (global) — bot protection on signup and other sensitive forms.
• Google (global) — only if you choose to sign in with your Google account.

For legal reasons

We may disclose your information if required to do so by law, court order, or government request; to enforce our terms of service; or to protect the rights, property, or safety of Talem, our users, or others.

Business transfers

If Talem is involved in a merger, acquisition, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify you (typically by email and on the platform) before your data becomes subject to a different privacy policy.

We do not sell your personal data

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. This applies to all users, including those covered by the California CCPA/CPRA “do not sell or share” right.

Talem is based in the UAE, but several of our service providers are located in or operate from the European Union, the United Kingdom, or the United States. This means your personal data may be transferred to, stored in, and processed in those countries.

For transfers from the European Economic Area or the United Kingdom to countries that do not have an adequacy decision, we rely on Standard Contractual Clauses (SCCs) and supplementary measures (encryption in transit and at rest, access controls, contractual confidentiality) to ensure your data receives an equivalent standard of protection. For transfers from the UAE, we comply with the cross-border transfer requirements of the UAE PDPL.

We keep your personal data only for as long as we need it. Typical retention periods:

• Account profile data — for as long as your account is active. If you delete your account, we remove your profile and uploaded documents within 30 days.
• Enquiries and applications — retained for up to 2 years after submission so we and the receiving institution can respond to follow-up questions across an admission cycle.
• Uploaded documents — deleted when you delete the document, when the related application is deleted, or when you delete your account.
• Marketing-email contact list — retained until you unsubscribe or delete your account, whichever happens first.
• Server, application, and security logs — retained for up to 90 days.
• Email delivery logs (via Resend) — retained according to Resend’s own retention period (currently up to 1 year).
• Database backups — retained on a 30-day rolling basis, after which deleted records age out of backups automatically.

We may retain data longer than these periods if we are legally required to (for example, to comply with tax, accounting, or anti-fraud obligations), or if we need to defend against legal claims.

Talem uses cookies, local storage, and similar technologies for the following purposes:

• Strictly necessary: keeping you signed in, remembering your in-progress searches and form inputs, and protecting against cross-site request forgery. These cannot be turned off.
• Analytics: PostHog and Vercel Analytics record aggregate usage of the platform (pages visited, features used, performance metrics) so we can improve it.
• Security: hCaptcha sets short-lived cookies on signup and login pages to detect automated abuse.

On your first visit we show a cookie consent banner. Until you click "Accept", only strictly necessary cookies are loaded — analytics scripts (PostHog, Vercel Analytics) do not run. You can change your decision at any time using the "Cookie preferences" link in the footer. We do not use advertising cookies and do not track you across other websites.

Talem allows three types of accounts: parents, students, and institution representatives. We recognise that students and the children parents register on the platform are often minors, and we treat their data with extra care.

• Children under 13 years old should not create their own account. Only a parent or legal guardian may create an account that contains data about a child under 13.
• Students aged 13 to 17 may create their own account but should have permission from a parent or guardian before doing so. We may ask for verifiable parental consent for accounts identified as belonging to minors in jurisdictions that require it (for example, the US under COPPA, or the EU under Article 8 of GDPR for users under the relevant member-state age).
• Parents and guardians who register a child’s information are responsible for keeping it accurate, and for monitoring how the platform is used.
• We do not knowingly collect data directly from a child under 13 without verifiable parental consent. If you believe a child has provided us with personal data without proper consent, contact us at privacy@talem.ae and we will delete it.
• A parent or guardian can at any time request access to, correction of, or deletion of a child’s data by emailing privacy@talem.ae.

Depending on where you live, you have some or all of the following rights regarding the personal data we hold about you:

• Access: request a copy of the personal data we hold about you.
• Correction (rectification): ask us to fix data that is inaccurate or incomplete.
• Deletion (erasure): ask us to delete your personal data. You can also delete your account yourself from Account → Profile → Danger Zone.
• Restriction: ask us to limit how we use your data while a complaint or correction is being investigated.
• Objection: object to processing we carry out based on legitimate interests (such as analytics) or for direct marketing.
• Portability: receive a copy of your data in a structured, machine-readable format so you can transfer it elsewhere.
• Withdraw consent: where processing is based on consent (for example marketing emails), withdraw your consent at any time.
• Non-discrimination: we will not deny service, charge different prices, or provide a different level of service because you exercised any of these rights.
• Lodge a complaint with a regulator: EU users can complain to their national data protection authority; UK users to the Information Commissioner’s Office (ICO); UAE users to the UAE Data Office; California residents to the California Attorney General or the California Privacy Protection Agency.

To exercise any of these rights, email privacy@talem.ae. We will respond within 30 days. We may need to verify your identity before processing the request to make sure we don’t disclose data to the wrong person.

We take reasonable technical and organisational measures to protect your personal data. These include:

• Encryption of data in transit (TLS 1.2 or higher) for all connections to talem.ae.
• Encryption of data at rest in our database and document storage.
• Passwords stored only as salted hashes via our authentication provider — we never see or store your password in plain text.
• Row-level access controls in our database, so users can only read and write their own data.
• hCaptcha-protected signup and other sensitive forms to reduce automated abuse.
• Sentry / BetterStack error monitoring so we detect problems quickly, with personally identifying fields automatically masked where possible.
• Regular review of access permissions for the small number of Talem team members with administrative access.

No system is perfectly secure. If we ever become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay if the risk is high.

Marketing emails (newsletters, product updates, school highlights) are sent only to users who have explicitly opted in. You can opt in or out at any time from Account → Profile → Email Preferences, or by clicking the unsubscribe link at the bottom of any marketing email. Opting out takes effect immediately.

Transactional emails — such as email verification codes, password reset codes, application status updates, and security notifications — are necessary to operate your account and cannot be turned off while your account is active.

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we use, or applicable law. The “Last Updated” date at the top of this page indicates when the policy was last revised.

For material changes — for example, a new category of data we collect, or a new third-party processor that significantly changes how your data is handled — we will notify you in advance by email (to the address on your account) and via a prominent notice on the platform. Continued use of Talem after a change takes effect means you accept the updated policy.

If you have any questions about this Privacy Policy, want to exercise your rights, or want to raise a concern about how we handle your data, please contact us at:

• Email: privacy@talem.ae
• Postal address: Talem EdHub Portal, Dubai, United Arab Emirates
• Registration: Dubai Department of Economic Development (DED)

We will respond within 30 days of receiving your request. If you are not satisfied with our response, you have the right to escalate to the data protection authority in your jurisdiction (see "Your Rights" above).