Privacy notice

Who we are

WeMasjid is the data controller for the personal data described here. Controller: WeMasjid [CHECK registered legal entity name and address — currently operated by its founder; registered office address to be added before launch]. Contact for anything privacy-related: takram2@gmail.com.

Each masjid that uses WeMasjid is separately the controller for its own congregants' data (member accounts it invites, donations made to it, content it publishes). We act as its processor for that data.

What we collect

• Committee accounts — email address and sign-in events (magic-link authentication; we never store passwords).
• Masjid profile data — name, address, contact details, charity status, logo and documents uploaded for verification.
• Donor details — for donations made through the platform: name, email, billing address (collected for Gift Aid and receipts) and gift details. Card numbers go directly to Stripe — we never see or store them.
• Gift Aid declarations — name, address and declaration records needed for HMRC claims.
• App & device data — Expo push tokens, device platform, app version and last-seen time for the congregant app and paired terminal/display devices.
• Technical logs — IP addresses and request metadata retained briefly for rate-limiting, security and debugging.

Lawful bases (UK GDPR)

• Contract — providing the service to the masjid and its committee members; processing donations and receipts.
• Legal obligation — keeping donation, Gift Aid and accounting records required by HMRC.
• Legitimate interests — security, abuse prevention, keeping displays and the app working (push tokens, device sync).
• Consent — optional app announcements/notifications; donors opt in to Gift Aid declarations themselves.

How long we keep it

• Gift Aid declarations and donation records: 6 years after the end of the tax year they relate to (HMRC requirement).
• Committee accounts: until the account or masjid is deleted.
• Push tokens and device registrations: until unregistered, or 180 days inactive.
• Audit log entries: retained for the life of the masjid account (they are the record of who changed what).
• Rate-limit and security counters: under 24 hours.

Who processes it for us

• Supabase — database and authentication, hosted in London (UK).
• Vercel — hosting and content delivery.
• Stripe — payment processing, payouts and billing (payments never touch our servers).
• Resend — transactional email (receipts, sign-in links, notifications).
• Expo (push service) — delivery of push notifications to the congregant app.
• Google Play / Apple — app distribution and their own platform services.

Some of these processors are outside the UK; transfers rely on adequacy regulations or UK-approved safeguards (IDTA/Addendum) as provided by each processor. [CHECK confirm each sub-processor's DPA is on file.]

Your rights

You can ask for a copy of your data, have it corrected or deleted, object to or restrict processing, and request portability. Contact takram2@gmail.com — we respond within one month. If we can't resolve a concern you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Children

The service is for masjid committees and adult congregants. We do not knowingly collect children's data. [CHECK madrasah/parent-facing features would need a review.]

Changes

We'll update this page when the service changes and note the date above. Material changes will also be flagged in the admin dashboard.