Privacy Policy

How Trans4m Institute collects, uses, and protects your data.

Last updated: 18 May 2026

1. Who We Are

Trans4m Institute is an English-language training institute operated by Lays Al Haditha L.L.C (Commercial Registration No. 1022115, Tax Identification No. 33027), a Limited Liability Company registered in the Sultanate of Oman ("we", "us", "our"). We deliver English-language courses for adults, children, and corporate clients, both in person at our institute and online.

Contact: skander@trans4minstitute.com

2. Data We Collect

Lead Data (from Meta Lead Ads and other inquiry channels)

When you submit a Meta (Facebook or Instagram) Lead Ads form, walk in, call us, or otherwise enquire about our courses, we collect:

• Full name (in English and Arabic where provided), parent or guardian name where applicable
• Phone number(s) and email address
• Preferred communication language
• Answers to questions on the Meta lead form you submitted
• The Meta leadgen_id and form ID associated with your submission, used to retrieve your lead from Meta and dedupe against repeat submissions
• Marketing attribution identifiers (fbclid, fbc, fbp) and standard UTM parameters, used to measure which campaigns produced your lead

Student & Enrollment Data (if you enroll as a student)

• Civil ID number, date of birth, photograph of national ID for verification (processed via OCR)
• Parent or guardian contact details (for under-18 enrolments)
• Class enrolments, attendance, assessment grades, teacher notes
• Payment records and invoice history

Staff Account Data (for our employees)

• Name, email address, role, and a bcrypt-hashed password
• Session activity for security (login timestamps, trusted-device identifiers, browser/OS strings)

Usage Data

• IP address, browser type, and pages visited within our internal staff portal
• Standard web-server logs retained for security and debugging

3. How We Use Your Data

• To contact you about course enrollment, schedule trial classes, and answer your enquiries
• To register and manage your enrollment, attendance, and assessment progress if you become a student
• To deliver internal staff notifications (e.g. follow-up alerts for stale leads) via Telegram and WhatsApp
• To measure the effectiveness of our Meta advertising campaigns, including by sending hashed conversion events back to Meta via the Conversions API
• To generate operational reports and analytics for managing our institute
• To meet our legal and regulatory obligations under Omani law

4. Legal Basis for Meta Lead Ads

By submitting a Meta Lead Ads form, you consent to Meta sharing the information you provided in that form with us so that we can follow up with you. We retrieve your submission via Meta's Lead Retrieval API and the associated webhook subscription.

5. Third-Party Services

We use the following third parties that process some of your data under their own privacy policies:

• Meta Platforms, Inc. — source of Meta Lead Ads submissions, recipient of hashed conversion events via the Conversions API (facebook.com/privacy/policy)
• Vercel — application hosting (vercel.com/legal/privacy-policy)
• Neon — managed PostgreSQL database hosting (neon.tech/privacy-policy)
• Railway — hosting for our WhatsApp messaging bridge (railway.app/legal/privacy)
• Telegram — Bot API for internal staff notifications that may include lead name and phone (telegram.org/privacy)
• WhatsApp (Meta) — for contacting leads and students via our WhatsApp Business integration (whatsapp.com/legal/privacy-policy)
• Google Cloud — Cloud Vision API for OCR of national ID documents during student enrollment (policies.google.com/privacy)
• Anthropic — Claude API for operational AI features (content analysis, bank-statement parsing); does not receive lead contact details (anthropic.com/legal/privacy)
• OpenAI — Whisper API for transcribing marketing content audio; does not receive lead contact details (openai.com/policies/privacy-policy)
• Apify — public scraping for marketing-intelligence purposes; does not receive personal data of our leads or students (apify.com/privacy-policy)

6. Data Storage and Security

• Lead, student, and operational data is stored in a managed PostgreSQL database hosted by Neon
• The application is hosted on Vercel; all connections use TLS/HTTPS
• Staff passwords are hashed with bcrypt
• Sensitive operational credentials we store on behalf of staff (e.g. API keys) are encrypted at rest using AES-256-GCM
• Session cookies are httpOnly, Secure, and SameSite=Lax; session tokens are JWT-signed and rotate with activity
• Idle staff sessions automatically log out after 15 minutes of inactivity; absolute session ceiling is 8 hours on untrusted devices
• Access to lead and student data inside the platform is restricted to authorised staff via role-based access control
• Marketing attribution identifiers sent back to Meta via the Conversions API are hashed (SHA-256) before transmission

7. Data Retention

Lead data: If you submit a lead form and do not enroll, we retain your lead record for up to 12 months of inactivity (no contact, no status change). After that, the record is permanently deleted.

Student data: If you enroll as a student, we retain your enrollment, attendance, assessment, and payment records for the duration of your relationship with us plus any period required by Omani tax and commercial law.

You may request earlier deletion at any time — see Section 8.

8. Your Rights

You have the right to:

• Access a copy of the personal data we hold about you
• Ask us to correct inaccurate data
• Request deletion of your data
• Export your data in a standard format
• Withdraw consent for marketing communications

To exercise any of these rights — including a deletion request — email skander@trans4minstitute.com from the email address (or with the phone number) you originally provided. We will confirm your identity, action your request, and confirm completion in writing within 30 days.

9. Cookies & Tracking

• We use essential session cookies to keep authorised staff logged in to the internal portal
• A signed "last user hint" cookie may pre-fill a masked email on the staff login page for usability; it can be cleared from the login screen
• A "trusted device" cookie may be set (for up to 30 days) when a staff member explicitly opts in, to skip the idle-logout timer on their personal device
• When you arrive at our site from a Meta ad, Meta's first-party cookies (such as _fbp and _fbc) may be present and used by Meta's tracking pixel for ad-conversion attribution
• We do not use third-party advertising cookies inside our internal staff portal

10. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. The current version is always available at this URL.

11. Contact