Privacy Policy
Effective: 18 October 2026. Qalamora is provided by ABT Dev Services, Lahore, Pakistan. The English text of this page prevails over any translation.
1. Who we are
Qalamora is developed and operated by ABT Dev Services, Lahore, Pakistan ("ABT", "we", "us"). This policy explains how we handle personal data on our website, during signup and billing, in support, and when schools use Qalamora.
2. Our role
For the records a school enters about its students, guardians and staff, the school decides why and how the data is used (it is the controller) and we process the data on its behalf under the Data Processing Terms. Parents, students and staff should contact their school about those records.
For website visitors, people who ask for a demo or contact us, school owners who sign up, and billing and support records, we decide how the data is used.
3. What we collect
Website: technical data needed to deliver pages securely (IP address, browser type, pages requested, time), and what you type into the contact, demo or signup forms (name, school, city, phone, email, message).
Signup and billing: the school name and web address, the owner's name, email, phone and password (stored only as a one-way hash), the plan chosen, the version of the terms accepted, invoices and payment status. Card details are entered on the payment provider's page and never reach our servers.
Support and security: messages you send us, records of support access granted by a school, sign-in history and security logs.
School records (processed for the school): what the school enters, such as student and guardian details, B-Form and CNIC numbers, contact details, attendance, fees, results, staff and payroll records, uploaded files and messages, plus activity logs of who viewed, changed or printed records.
4. Why we use it
To provide and secure the Service, create and manage school accounts, process payments and send invoices, answer questions and give support, send service messages (such as renewal reminders, security alerts and changes to terms), meet legal and tax obligations, and prevent fraud and abuse.
We send marketing emails only to people who asked for them or who are existing customers, and every marketing email has a way to stop receiving them. We never use school records for marketing or advertising.
5. Who receives data
We use carefully chosen providers to run the Service: hosting and backup providers, a network and security provider (content delivery, DNS and attack protection), an email delivery provider, a PDF rendering service, and payment gateways and banks for payments. They receive only what they need and may use it only to provide their service to us.
When a school connects its own services (SMS, WhatsApp, cloud storage or payment accounts), data is sent to those providers on the school's instructions. When a school uses AI or OCR features, only the minimum content needed is sent to the AI or OCR provider, with sensitive fields such as CNIC and B-Form numbers removed first.
We may disclose data when required by law, a court order or a lawful request by a Pakistani authority, after checking the request and, where the law allows, telling the school. We may also share data with a successor if our business is transferred, under the same protections.
We do not sell personal data.
6. Where data is stored
The cloud Service is hosted in data centres that may be outside Pakistan, and some providers operate worldwide. We choose providers that protect data with security measures at least as strong as ours. On-premise and desktop editions keep school data on the school's own computer or server.
7. How we protect data
Each school's records are separated from every other school's. Sensitive fields such as CNIC and B-Form numbers and medical notes are encrypted with a key unique to each school. Passwords are stored as one-way hashes. Connections use HTTPS. Private files are served only through short-lived signed links. Two-step sign-in is available for every account and sensitive actions are recorded in audit logs.
Our staff can open a school account only when the school grants support access, for a limited time, and each session is recorded. Access to production systems is limited to staff who need it and protected with two-step sign-in.
No system is perfectly secure. If a breach affects personal data we hold, we will tell the affected schools without undue delay and in any case within 72 hours of becoming aware of it, with the information they need to meet their own duties.
8. Children
Most students are under 18. Their records are entered and controlled by their school, which is responsible for informing parents and obtaining any consent needed. Student and parent logins are created by the school. We do not knowingly collect data directly from children for our own purposes, and we never use student data for advertising or profiling.
9. How long we keep data
School records: while the subscription is active, then as described in the Terms of Service: at least 90 days after it ends, and deleted after 180 days following 30 days' notice. Backups are overwritten within a further 35 days.
Website enquiries: up to 24 months after the last contact. Billing and tax records: as long as tax and company laws require (normally 6 years). Security logs: up to 12 months. In-app notifications: 90 days.
10. Cookies
We use cookies that are needed for the Service to work: a session cookie to keep you signed in, a security cookie that protects forms, and a cookie that remembers your language. They are not used for advertising.
If we use visitor analytics on the website, it counts visits without advertising profiles and runs only after you agree. You can withdraw that consent at any time from the cookie notice.
11. Your choices and rights
You may ask us for a copy of personal data we hold about you, ask us to correct it, ask us to delete it where we no longer need it, or object to marketing. We will answer within 30 days. We may need to confirm your identity first.
Parents, students and staff should send requests about school records to their school. If the school asks us to help, we will.
Write to [email protected]. If you are not satisfied with our answer, you may complain to the authority responsible for data protection or cyber crime in your country.
12. Law that applies
We handle data in line with the laws of Pakistan, including the Prevention of Electronic Crimes Act, 2016, and widely accepted data protection principles. When a comprehensive data protection law comes into force in Pakistan, or in another country where we serve schools, we will update our practices and this policy to meet it.
13. Changes
We will post updates on this page with a new effective date. Material changes are announced to school owners by email at least 30 days in advance.
14. Contact
ABT Dev Services, Lahore, Pakistan. Email: [email protected].