Lashkaru · Legal

Lashkaru Privacy Policy

DRAFT v0.3 for legal review. Not yet in force. Updated 10 November 2026 to match the build as reported on that date, and aligned with Maldivian market practice.

Last updated: 10 November 2026

This Privacy Policy explains how [PLACEHOLDER: operator legal name, e.g. "Lashkaru Inc."] ("Lashkaru", "we", "us") collects, uses, shares and protects personal data when you use lashkaru.com, app.lashkaru.com, admin.lashkaru.com, checkout.lashkaru.com and each group website at {group}.lashkaru.com or at a custom domain a Group connects (the "Platform"). It also explains your rights.

The Platform is used by children as young as 8, so we have tried to write this in plain language. There is a short version for young members in Section 1, and a dedicated section for parents in Section 9.

1. The short version (for young members)

  • We keep the information you, your parent or your group put on Lashkaru, such as your name, birthday, section, attendance, logbook and photos, so your group can run its activities.
  • Your parent or guardian can see your account and can ask us to fix or delete your information.
  • We do not sell your information, we do not show you adverts, and we do not track where you are.
  • Your logbook and its photos can be seen only by you and the leaders who review it.
  • Your group's public website is open to everyone. Your group may only put your photo there if your parent says yes.
  • Before taking photos to upload, ask an adult to help you turn off location tagging on the camera or phone.
  • A computer program (AI) helps read payment slips and notes, but a real person always checks the results.
  • If something worries you, tell your parent or a leader you trust, or email support@lashkaru.com.

2. Who we are, and who is responsible for your data

2.1 Lashkaru is operated by [PLACEHOLDER: operator legal name], registered in [PLACEHOLDER: country] under number [PLACEHOLDER: registration number], at [PLACEHOLDER: registered address]. [PLACEHOLDER: confirm whether to state "a member of the Zelos PVT LTD group (Maldives)".]

2.2 Two roles. Data protection laws distinguish between a "controller", which decides why and how personal data is used, and a "processor", which handles personal data on a controller's behalf.

Data Who is the controller Lashkaru's role
Account and platform data: your login, account profile, Parent–child links, consent records, security logs, our billing with Groups, support requests, and data used to run, secure and improve the Platform Lashkaru Controller
Group Data: membership records, section and role, attendance, events and RSVP responses, announcements, courses and logbooks, sign-offs, SOP meetings and votes, payment requests and slips, section in-charge bank details, emergency contacts, registration PDFs and the Group Website content (including a custom domain the Group connects) Your Group (e.g. your Scout Group) Processor, acting on the Group's instructions under a Data Processing Agreement
Live chat on group public sites (Tawk.to) [PLACEHOLDER: Lashkaru or the Group, depending on who sets up the chat widget] [PLACEHOLDER]

2.3 For Group Data, your Group is responsible for deciding what it collects and for answering your requests, and we help it do so. If you contact us about Group Data, we will pass your request to the Group, or handle it ourselves if the Group cannot or does not respond.

2.4 Privacy contact: compliance@lashkaru.com. [PLACEHOLDER: name of data protection officer or privacy lead, if appointed.]

2.5 EU/UK representative. [PLACEHOLDER: if the Platform is offered to people in the EU or UK, name the representative appointed under Article 27 of the EU GDPR / UK GDPR, or delete this paragraph.]

3. What personal data we collect

Category Examples Whose data
Identity Full name, common name, date of birth, gender, nationality Members, Parents, leaders
Contact Mobile number, email, permanent and current address (country, atoll/state, island/city, district, house/street) Members, Parents, leaders
Emergency contact Name, relationship, phone number and email of an emergency contact Young Members (the contact's data is given by the Member or Parent)
Account and login Username, password (stored only in hashed form), role, sign-in records All users
Group membership Group, section, role, join requests, approval or decline, registration PDFs Members
Activity Announcements, event participation and RSVP responses (e.g. attending / not attending), attendance records (present, absent, date, event or meeting), course progress, review and sign-off records, SOP meetings and votes. Events with RSVP and Attendance are being built Members, Parents (RSVPs on behalf of a child), leaders
Logbook Logbook text, uploaded notes and documents, photos (automatically resized; visible only to the Member and their reviewers), AI-drafted entries Members
Public site content Gallery photos, news and event posts published by the Group Anyone shown or named
Ratings Group ratings (out of 5) [PLACEHOLDER: and written reviews, if enabled], and the rater's account ID Raters
Payments (Member to Group) Payment requests, transfer slip images, and the details read from them: sender name, receiver name, receiver account number and bank, reference, date, remarks, amount; verification outcome; mismatch and duplicate flags Parents and adult Members who pay; section in-charges
Section in-charge bank details Account name, account number, bank Section in-charges (leaders)
Payments (Group to Lashkaru) Plan, invoices, transaction reference and status from the BML gateway. We do not receive or store full card numbers. Group Administrators
Parent links and consent Which Parent is linked to which child, consent records (what was agreed, when, how it was checked) Parents, Young Members
Live chat (Tawk.to) Name and email (Tawk.to asks for these before a chat starts), chat messages, and technical data collected by Tawk.to Visitors to group public sites
Notifications Web push subscription tokens (a browser push endpoint and its keys), notification preferences Users who turn on notifications
Preferences Language preference (English or Dhivehi) All users
Custom domain Domain name a Group connects and related configuration (generally not personal data, unless the domain or its registration identifies an individual) Groups, Group Administrators
Technical IP address, browser and device type, security and error logs All users

What we do not collect (as built): we do not collect government ID numbers, health or medical information, location tracking data, or biometric data. Note that photos you upload may contain location data embedded by your camera or phone, which the Platform does not currently remove (see Section 7.3). [PLACEHOLDER: if medical/allergy or ID fields are added later, update this section before launch of that feature. Health data is a "special category" and needs explicit consent and extra safeguards.]

Data minimisation for children. We, and Groups, must not ask a child for more personal data than is reasonably needed to take part in an activity. A child's participation is never conditional on giving more data than necessary.

4. Where we get personal data

  • From you, when you sign up, complete your profile, write logbook entries, upload files or slips, rate a Group, or use chat.
  • From your Parent, who may create or manage a Young Member's account and give emergency contact details.
  • From your Group and its leaders: for example, approving your join request, assigning your section, recording attendance, signing off your logbook, or publishing gallery photos.
  • From other Members, for example a photo that includes you, or a payment slip that names a section in-charge.
  • From service providers, such as payment status from the BML gateway, and chat data from Tawk.to.
  • Automatically, from your device when you use the Platform (technical data).

5. Why we use personal data, and our lawful bases

Where the EU or UK GDPR applies, we must have a lawful basis under Article 6. The table covers data for which Lashkaru is controller. For Group Data (including announcements, RSVP responses and attendance records), the Group chooses its lawful basis, and we process the data only on its instructions.

Purpose Lawful basis (GDPR Art. 6(1))
Create and run your account; let you join a Group; provide the Platform's features Contract (Art. 6(1)(b)). For children, this is combined with Parent consent where required (see Section 9)
Obtain and record Parent consent; link Parent and child accounts; end Parent access at 18 Legal obligation (Art. 6(1)(c)) where a law requires it; otherwise legitimate interests (Art. 6(1)(f)) in protecting children
Keep the Platform secure; prevent fraud, duplicate or fake payment slips, and abuse Legitimate interests (Art. 6(1)(f))
Safeguarding: handle reports, preserve evidence, refer concerns to authorities Legitimate interests (Art. 6(1)(f)); vital interests (Art. 6(1)(d)) in emergencies; legal obligation (Art. 6(1)(c)) where reporting is mandatory
Bill Groups for subscriptions; keep accounting and tax records Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Send service messages and push notifications you have turned on, using your stored subscription token Contract (Art. 6(1)(b)) for essential messages; consent (Art. 6(1)(a)) for push notifications, which are opt-in and can be turned off at any time in your browser
Show the Platform in your chosen language (English or Dhivehi) Contract (Art. 6(1)(b))
Connect and serve a Group Website on a Group's custom domain Contract with the Group (Art. 6(1)(b)); Lashkaru acts as processor for the Group's site content
Show public group ratings and comparisons Legitimate interests (Art. 6(1)(f)) in helping families choose a Group, balanced by moderation and a right of reply. Ratings never identify Young Members
Answer support and privacy requests Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))
Comply with law, court orders and regulators; defend legal claims Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

What we never do: we do not sell personal data. We do not use it for advertising, behavioural targeting or profiling of children, and we do not share it with data brokers. We do not use children's data in ways that are bad for their wellbeing, and we do not use design tricks to push children to share more data or weaken their privacy settings.

6. AI processing

6.1 What AI does. We use Cloudflare Workers AI (currently the Meta Llama 4 Scout model) to: (a) read payment slip images and extract the payment details listed in Section 3, then flag possible mismatches (for example, a wrong amount or receiving account) and possible duplicates; and (b) turn uploaded notes into draft logbook entries.

6.2 Human review. A human verifier appointed by the Group confirms every payment slip. A Member or Parent, and then a leader, reviews logbook drafts. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR Article 22). AI is not used to profile Members.

6.3 Your choices. You can ask your Group's verifier to look at a slip again, explain a flag, or correct extracted details. You may write logbook entries without using AI.

6.4 Provider commitments. Cloudflare states that it does not use Workers AI inputs or outputs to train AI models, and that for standard requests it does not keep inputs or outputs after the response is delivered. Slips and logbook files are stored in our own database and file storage, not by the AI service.

7. Public content on group websites

7.1 Each Group Website (at {group}.lashkaru.com or the Group's custom domain) is public by design, and the Group chooses what to post there. Anyone can see it, and search engines may index it. This includes Gallery photos, News and Events posts, and the Group's name and rating.

7.2 Groups must get written Parent consent before publishing any photo, video or identifying details of a Young Member on a public page. They must never publish a child's address, school, contact details or date of birth there. Gallery photos on a Group Website are public. Logbook photos are different: they are visible only to the Member and the leaders who review the logbook, and they do not appear on the public site.

7.3 Location data in photos. The Platform does not currently remove location (GPS) or other hidden metadata from uploaded photos. Please turn off location tagging on your camera or phone before taking photos you plan to upload, or remove location data before uploading. Groups should check this before posting any photo publicly.

7.4 You or your Parent can withdraw photo consent at any time. Ask the Group, or email compliance@lashkaru.com, and the content will be removed from the public site within [PLACEHOLDER: e.g. 7 days]. Copies that others have already saved, or that search engines have stored, may take longer to disappear. We will ask search engines to remove them where we can.

8. Who we share personal data with

8.1 Within your Group. Group Administrators and leaders see the data they need for their role. Members see Group announcements and events. Section in-charges' bank details are shown to Members or Parents so they can pay fees [PLACEHOLDER: confirm the "only those with a payment due" restriction].

8.2 Your Parent, if you are under 18 (see Section 9).

8.3 The public, only for content a Group publishes on its public site, and for public ratings.

8.4 Service providers (processors and sub-processors) that help us run the Platform under contracts that require them to protect the data and use it only on our instructions:

Provider What they do Data involved Location / transfer safeguard
Cloudflare, Inc. (Workers, D1 database, R2 storage, Workers AI; custom domains for Group Websites, in progress) Hosting, database, file storage, AI processing, security, connecting Groups' custom domains All Platform data D1 database in the Asia-Pacific region (Seoul, Republic of Korea, as configured); Cloudflare's global network. Cloudflare Data Processing Addendum incorporating EU Standard Contractual Clauses and the UK Addendum; Cloudflare is certified under the EU-U.S. Data Privacy Framework and Global CBPR/PRP
Zoho (Zoho Mail) Sending and receiving email (support@, no-reply@, billing@, compliance@) Names, email addresses, email content [PLACEHOLDER: Zoho data centre region]; Zoho DPA with Standard Contractual Clauses [PLACEHOLDER: confirm signed]
Bank of Maldives (BML) payment gateway Processing Group card payments to Lashkaru Payer name, transaction details; card data handled by BML directly Maldives; [PLACEHOLDER: confirm BML gateway terms]
tawk.to Live chat on group public sites Chat name, email, messages, technical data United States; tawk.to DPA; EU-U.S./UK/Swiss Data Privacy Framework as stated by tawk.to
Browser push services (Google, Apple, Mozilla, Microsoft) Delivering web push notifications Push subscription token/endpoint and notification content Provider's locations; [PLACEHOLDER: confirm payloads are encrypted under the Web Push message encryption standard, RFC 8291, so push services cannot read them]
Google Fonts Displaying fonts IP address and browser information, if fonts are loaded from Google's servers [PLACEHOLDER: recommended to self-host fonts so no data is sent to Google]
[PLACEHOLDER: Google / Firebase Authentication, if launched] Sign in with Google Name, email, Google account ID United States; Google's data processing terms

8.5 Authorities and legal requirements. We disclose personal data to public authorities only: (a) to comply with a valid court order, or a summons or similar legal process that is enforceable against us; (b) in response to a lawful written request from the Maldives Police Service, a regulator or another public authority that has legal power to require the information; (c) where we believe in good faith that disclosure is urgently needed to protect a child or another person from serious harm, for example a referral to the Maldives Police Service or the State's child and family protection services; or (d) where needed to establish, exercise or defend legal claims. We check that each request has a legal basis and is limited to what is needed. We disclose only the minimum data required. Where the law allows and it would not put anyone at risk, we tell the person concerned (or their Parent, or the Group for Group Data). For Group Data we refer the authority to the Group where that is appropriate. We keep a record of requests we receive. [PLACEHOLDER: decide whether to publish an annual summary of authority requests.]

8.6 Business changes. If the Platform or our company is sold or merged, personal data may pass to the new owner. The new owner must protect it as this Policy describes, and we will tell you first.

8.7 Children's data and third parties. We share children's data with third parties only where that is integral to running the Platform (the service providers above) or required by law. We do not share it for advertising or any other purpose. If that ever changed, we would first ask Parents for separate consent.

9. Children's data and Parents' rights

This section is our notice to Parents. It is written to meet the US Children's Online Privacy Protection Rule (16 CFR Part 312), EU and UK GDPR Article 8, the UK Age Appropriate Design Code, and the Maldivian Child Rights Protection Act (Act 19/2019).

9.1 Ages. Members can be as young as 8. We treat everyone under 18 as a child for safeguarding purposes. We apply extra protections to children under 13 and, where the EU GDPR applies, to children under the age of digital consent in their country (16 unless their country sets a lower age, which may not be below 13; 13 in the UK).

9.2 What we collect from children. The categories in Section 3 marked for Members and Young Members: identity, contact, emergency contact, account, Group membership, activity, logbook (including photos and uploaded notes), and parent links. Young Members can view fees but cannot upload payment slips or pay. Only Parents do that. Children cannot make their own data public. Only the Group can publish content on its public site, and only with Parent consent.

9.3 How we use it. Only to provide the Platform to the child's Group: membership, activities, attendance, courses, logbook and progress, safety, and safeguarding. Never for advertising or profiling.

9.4 Verifiable parental consent. Before we collect personal data from a child under 13 (beyond the Parent's contact details needed to ask for consent), we send the Parent a direct notice and obtain verifiable consent using [PLACEHOLDER: chosen method, e.g. a signed consent form uploaded and checked; a card transaction by the Parent; or a video call with trained staff]. Where the EU GDPR applies to a child under the age of digital consent, we make reasonable efforts to verify that consent is given or authorised by the holder of parental responsibility. If we do not receive consent within [PLACEHOLDER: e.g. 14 days], we delete the information collected for the consent request.

9.5 Parents' rights. At any time, a Parent can: (a) review the personal data we hold about their child; (b) correct it; (c) refuse further collection or use and have the child's data deleted (this will close the child's account, as the Platform cannot work without it); (d) consent to collection and use without consenting to disclosure to third parties, except where disclosure is integral to the service, such as hosting by our service providers; (e) withdraw consent for optional features such as public photos and push notifications without losing access to the rest of the Platform.

How to do this now: email compliance@lashkaru.com (or support@lashkaru.com), or ask your child's Group leader. We will check that you are the child's Parent before acting, and we will respond within one month. A Parent dashboard is being built. It is planned to let Parents link to their children, view and pay fees, upload slips and get finance alerts, with access ending when the child turns 18. Email requests will remain available after it launches.

9.6 Transparency for the child. We tell children, in words suited to their age, that a Parent is linked to their account and what the Parent can see.

9.7 High privacy by default. Children's profiles are visible only within their Group [PLACEHOLDER: confirm with build]. Logbook photos are visible only to the child and their reviewers. We do not track location or profile children. Push notifications are opt-in.

9.8 Turning 18. At 18, Parent access ends automatically. The Member may then ask us to delete content posted about them when they were a child, including public photos.

9.9 Retention of children's data. Our written retention policy for children's data is in Section 11. We do not keep children's data indefinitely.

9.10 Operator contact for Parents: [PLACEHOLDER: operator legal name, postal address, telephone number], compliance@lashkaru.com.

10. International transfers

10.1 Lashkaru is [PLACEHOLDER: based in country]. Our main database is hosted by Cloudflare in the Asia-Pacific region (Seoul, Republic of Korea), and our providers may process data in other countries, including the United States.

10.2 Where EU or UK data protection law applies to a transfer, we use one of these safeguards: (a) an adequacy decision. For example, the European Commission has found that the Republic of Korea provides adequate protection (Implementing Decision (EU) 2022/254), and the EU-U.S. Data Privacy Framework covers certified US providers; (b) the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), with the UK International Data Transfer Addendum for UK data; or (c) another safeguard the law allows.

10.3 You can ask for a copy of the relevant safeguards by emailing compliance@lashkaru.com.

11. How long we keep data

These periods are proposals. [PLACEHOLDER: confirm each period with Groups, and with Maldivian accounting and tax rules.]

Data Proposed retention
Account and profile While the account is active. Deleted within [30 days] of account closure, except as below
Pending sign-ups with no Parent consent Deleted after [14 days]
Group membership, attendance, course progress, logbooks While the Member belongs to the Group. Then, for [2 years] after leaving, at the Group's instruction (so a Member can rejoin or get a record of achievements). Deleted sooner on request where the law allows
Public photos and posts Until removed by the Group, or on request. Withdrawn consent is honoured within [7 days]
Payment slip images [12 months] after verification. Extracted payment records: [PLACEHOLDER: period required by Maldivian accounting/tax law, e.g. 5 years]
Section in-charge bank details Until the in-charge leaves the role or withdraws consent
Group billing records (Lashkaru) [PLACEHOLDER: statutory period under Maldivian tax law]
Parent consent records For the life of the child's account plus [2 years], as proof of consent
Live chat (Tawk.to) [12 months]
Security and access logs [12 months]
Safeguarding reports [PLACEHOLDER: period advised by the Group's safeguarding policy and local law; often longer]
Backups Overwritten within [35 days]

When a Group closes its account, we delete or return Group Data within [PLACEHOLDER: e.g. 60 days], as the Data Processing Agreement sets out.

12. Security

We protect personal data with appropriate technical and organisational measures. In general terms, these include:

  • encryption in transit (HTTPS) and at rest (provided by Cloudflare);
  • hashed passwords;
  • role-based access, so that leaders see only what their role needs, and logbooks are visible only to the Member and their reviewers;
  • a separate sign-in session for platform administration;
  • limiting access to payment information to the people who need it;
  • a written information security programme with a named coordinator and at least annual risk assessments [PLACEHOLDER: confirm in place].

We keep these measures under review and plan to strengthen them over time.

If a personal data breach is likely to put your rights at risk, we will notify the relevant authorities and the Groups affected. Where the risk is high, we will also notify you, as the law requires (for example, within 72 hours to the supervisory authority under the GDPR where it applies).

No system is perfectly secure. Please keep your password safe.

13. Your rights

Depending on where you live, you have some or all of these rights:

  • Access: get a copy of your personal data.
  • Correction: fix inaccurate or incomplete data.
  • Deletion: ask us to delete your data.
  • Restriction: ask us to pause the use of your data.
  • Portability: receive the data you gave us in a common, machine-readable format.
  • Objection: object to our use of your data based on legitimate interests.
  • Withdraw consent: at any time, without affecting earlier use.
  • Human review: of any automated decision (we do not make solely automated significant decisions).
  • Complaint: you can complain to us first (see below). You also have the right to complain to a data protection supervisory authority, for example in the EU country where you live, or the UK Information Commissioner's Office. The Maldives does not yet have a dedicated data protection authority. Consumers in the Maldives may raise consumer complaints with the Consumer Ombudsman's Office under the Consumer Protection Act (Law No. 12/2020). [PLACEHOLDER: update if the Maldives Personal Data Protection Bill is enacted and a Privacy Commissioner is appointed.]

How to make a request: email compliance@lashkaru.com [PLACEHOLDER: add in-app options when available]. We acknowledge requests and complaints within 2 working days. For Group Data, you can also ask your Group directly. We will reply within one month (extendable where the law allows). We do not charge, unless a request is clearly unfounded or excessive. We may need to confirm your identity first.

14. Cookies, local storage, push notifications and live chat

14.1 Essential storage only. We use cookies and browser local storage that are strictly necessary to sign you in, keep your session secure, and remember your settings, including your language choice (English or Dhivehi). We do not use advertising or analytics cookies. [PLACEHOLDER: if analytics are added, add a consent banner first.]

14.2 Push notifications. Push notifications are opt-in. If you allow them, your browser creates a push subscription token, which we store so we can send you notifications. Messages are delivered through your browser maker's push service (Google, Apple, Mozilla or Microsoft). You can turn notifications off at any time in your browser settings. When you do, we stop sending them and delete the token [PLACEHOLDER: confirm tokens are deleted when a subscription expires or is revoked]. [PLACEHOLDER: consider whether a Parent must approve notifications for under-13s.]

14.3 Live chat (Tawk.to). Group public sites may show a Tawk.to chat widget. It asks for your name and email before a chat starts, and it may set its own cookies. Your chat is handled by tawk.to under its privacy policy (tawk.to/privacy-policy) and data processing terms. [PLACEHOLDER: decide whether the widget loads only after a visitor clicks to start a chat. This is recommended, so no Tawk cookies are set before that.] Children should not use live chat without a Parent.

14.4 Fonts. [PLACEHOLDER: if Google Fonts are loaded from Google's servers, your IP address is sent to Google. We recommend self-hosting fonts, in which case delete this paragraph.]

15. Maldivian law

We respect the right to privacy in Article 24 of the Constitution of the Republic of Maldives. Where the Maldives Consumer Protection Act (Law No. 12/2020) applies to our services, we respect the rights it gives consumers. We also follow the Child Rights Protection Act (Act 19/2019), including its rule against making public a child's personal information (name, address, school, picture or any information that could identify them) in a way that harms the child's reputation, or where the child is a suspected offender, a victim of crime or in need of care and protection. The Maldives does not yet have a general data protection law in force. We have designed this Policy to meet international standards in the meantime, and we will update it when new law takes effect.

This Policy is written in English and may be translated into Dhivehi. If the versions differ, the English version prevails, but we will read any unclear wording in the way that best protects you and your child.

16. Changes to this Policy

We may update this Policy. For material changes, we will give notice by email and in the Platform at least 30 days before they take effect. For minor changes, such as clarifications or new contact details, we will publish the update at least 7 days before it takes effect. Continued use is never treated as consent where the law requires consent to be given expressly. If a change materially affects how we handle children's data, we will ask Parents for fresh consent where the law requires it. The date at the top shows the latest version.

17. Contact