Acceptable Use Policy

1. Who it applies to

It applies to everybody your madrasa lets into its account — administrators, teachers, and the guardians who are invited to see their own children — and to your madrasa itself for what those people do. If a teacher at your madrasa breaks one of these rules, we take it up with your madrasa rather than with the teacher, because the account is your madrasa’s and so is the responsibility.

It applies to us as well, and not only as a courtesy. Our own limits are written down in the data processing agreement — what we may look at, what we may never use your records for, and what happens when we get something wrong. A use policy that binds only the customer is a warning notice, not a rule.

2. One account, one madrasa

An account belongs to one madrasa. Your madrasa may not keep another madrasa’s register inside it, run a second institution through it, or pass it on to somebody else to use — including a branch under different management. Each of those means two sets of children’s records in a place built to keep them apart, and the separation in this system works because one account means one madrasa.

Sign-in details are not to be shared. Administrators sign in with a Google account, so that account should belong to a person and not to an office, and it should have two-step verification turned on — if it is taken over, everything your madrasa keeps here is taken over with it. When a member of staff leaves, remove their access the same week. We cannot tell whether the person signing in is the person the account was made for, and nothing in the product can.

3. PINs and the device in your hand

A PIN is how the register knows who marked it. Once two teachers use the same PIN, every mark in that class was made by “somebody”, and an attendance record that cannot say who made it is worth nothing on the day it is questioned — which is the only day it matters.

• Do not share a PIN, write it on the register cover, or keep it on a note by the door.
• Do not mark a register for a colleague who is absent. Ask your administrator to do it in their own name, so the record says what happened.
• Tell your madrasa the same day if a phone with Sijil signed in on it is lost, stolen or sold, so the device can be removed from the account.
• Do not try to get back onto a device your madrasa has removed. If it was removed by mistake, ask them to add it again.
• A guardian’s PIN is for that guardian. A child should not be marking their own attendance from a parent’s phone, and a parent who hands the phone over should expect that to be possible.

One thing worth knowing before you choose a PIN: your madrasa’s administrator can read a teacher’s or guardian’s PIN back to them, because somebody has to be able to help a teacher who has forgotten it on a Monday morning. That is a deliberate design choice and the data processing agreement lists it among the security facts rather than hiding it. The practical consequence is simple — do not use a number you use for anything else, and treat a PIN somebody has read out to you as one to change.

4. What a guardian’s phone number is for

A guardian handed over their number for one reason: so that the madrasa teaching their child could reach them about that child. Fees, attendance, progress, the things a parent has a right to be told. That is the whole permission, and it does not stretch.

• Not for political messages, candidates, parties or campaigns of any kind.
• Not for fundraising other than your own madrasa’s, and then only about the madrasa the family is already part of.
• Not for anybody else’s business, product, service or announcement.
• Not for another madrasa’s admissions, even a friendly one, and even if a guardian has left.
• Not for adding a guardian to a group or broadcast list they did not ask to join.
• Never sold, rented, lent, exported for somebody else, or handed on when a member of staff moves institutions.

Here is the honest part. When your administrator sends a guardian a message from Sijil, the message leaves their own phone through WhatsApp; nothing is sent from our servers. So we have no send to block, no rate limit to impose, and no list of what was written. This clause is therefore a rule your madrasa accepts, not a limit the software enforces — and a document that blurred those two would be worth less than one that admits the difference. If we are told about it, or a guardian complains to us, the last section of this policy is what happens next.

5. Your public page

If your madrasa turns on its public page, it is your madrasa’s own words sitting on our domain, where a parent deciding between two institutions will read them. Both halves of that sentence matter, and they pull in different directions: the words are yours, and the address is shared with every other madrasa here.

• Say only what is true about your madrasa. Do not claim a registration, an affiliation, a board recognition or an examination result you do not actually hold — that is the one kind of inaccuracy a family cannot check before enrolling.
• Do not put a named child on it. There is no field in Sijil that publishes a student’s name, photograph or result, and nothing about a particular child should be written into the free text either — not a prize-winner’s name, not a class list.
• Do not use it for party politics, for content that is unlawful in Pakistan, or for abuse of another madrasa, maslak or community.
• Do not present yourself as a different institution, a branch you are not, or as endorsed by us. We host your page; we do not vouch for your madrasa, and saying that we do is a misrepresentation of somebody else — us.
• Enquiries that arrive through the page are questions about admission. The name and number in an enquiry are for answering it. The rule for guardians’ numbers above applies to these in exactly the same way.

This is the one part of the product where a rule broken by one madrasa lands on another, because the page is served from our domain and a reader has no way to tell whose words they are. So it is also the one part where we may act on the page itself — taking it offline while we ask you about it — without that being a step on the ladder in the last section. Your records are never touched by this; a public page going dark changes nothing inside your account.

6. Reaching for things that are not yours

Every madrasa’s records sit in the same database, kept apart by rules that decide, on every single request, which madrasa the person asking belongs to. That separation is the most important thing this product does. Testing it is not curiosity; it is an attempt to read somebody’s children.

• Do not try to reach a record belonging to another madrasa — by editing an address, altering what a request says about who you are, reusing a link or token that was not issued to you, or signing in on a subdomain that is not yours.
• Do not run scripts, scrapers or automated tools against Sijil. There is no public interface for bulk collection, and a script pointed at pages built for a browser costs the same server every madrasa is sharing.
• Do not scan, probe or penetration-test the service without written permission first. Ask at security@sijil.pk and we will discuss it properly — but understand what is on the other side of the test: not a staging copy, but the attendance and fee records of real children.
• Do not interfere with the app to get around a limit — a removed device, a locked PIN, a plan ceiling, a read-only account. If a limit is in your way, ask us to lift it.

7. What we do when a rule is broken

A madrasa whose register lives here cannot be switched off over a first offence. Attendance has to be marked tomorrow morning whatever we think of what happened yesterday, and a policy that threatens otherwise is a policy nobody believes. So the steps are set out in order, and we take them in that order.

1. We ask. Most of what looks like a breach from outside is a misunderstanding, a shared phone, or somebody who was never told the rule.
2. We warn in writing, to the administrator, saying exactly what has to stop and by when.
3. We lock the one account involved, so the rest of your madrasa carries on marking registers and taking fees.
4. If the problem is the madrasa rather than a person, we make the whole account read-only: everything can be read, nothing new can be entered. Your data is all still there.
5. We end the agreement. Even then your records are not deleted — nothing in Sijil deletes a register on a timer, so they stay until your madrasa asks for them to go, and you can get a copy out first. The data processing agreement describes how that removal happens.

Three things let us move straight to the last step: a child appears to be at risk of harm, an account is actively being used to get at data it should not reach, or the law requires it of us. Those are named rather than left to our discretion, because “at our sole discretion” in a document like this means the ladder above is decorative.

On the first of those three we should be plain about what we are. Sijil is a register, not a safeguarding service; we have no case workers, no helpline, and no standing in your city. What we will not do is pretend we did not see something. If what is written in an account suggests a child is being harmed, we will raise it with your madrasa’s administrator, and where a law obliges us to go further, we will.

8. Telling us, and disagreeing with us

Write to contact@sijil.pk about anything in this policy, or to security@sijil.pk if it concerns somebody reaching data they should not. +92 371 2633733 reaches the same person. Tell us what happened and which madrasa it concerns; you do not need to write it as a complaint.

If you are a guardian, start with the madrasa teaching your child. This is not us passing you along: the record is theirs, and we cannot correct a mark or remove a child’s details on your instruction without being asked by the madrasa that entered them. But if you have asked them and heard nothing, write to us anyway and we will take it up with them.

If we lock an account or take a page down and you think we have it wrong, say so in writing. One person reads it — the same person who took the decision, which is the honest description of an appeal in a service run by one person — and you get a yes or a no with the reason. If the answer is no and you cannot live with it, you may end the agreement and ask us for a copy of your records, which stay where they are until you ask for them to be removed; the billing policy sets out what happens to anything already paid.

When we change these rules we will say so on this page and date it. If a change narrows what your madrasa may do with an account it already has, you will hear from us before it applies to you, on the notice period in the terms.