Skip to content
Maqsadi

Privacy policy

This policy explains which personal data Maqsadi processes, why we do so and what rights you have.

Effective from: · version 1.0

1. Who is responsible?

Maqsadi is the controller of personal data processed through maqsadi.com. For privacy questions, to withdraw consent or to exercise your rights, email privacy@maqsadi.com.

2. What data do we process and why?

  • Newsletter: your email address, optional first name and signup time. We use these details to send the updates you requested. The legal basis is your consent; you can unsubscribe at any time.
  • Community: your first name, email address, mobile number, language, signup time and selected email and WhatsApp preferences. We use these details to send the invitation you requested and, only where you choose separately, updates or offers. Because participation may reveal something about your religious beliefs, we ask for your explicit consent.
  • Personal help: your name, email address, optional phone number, stage in the Hajj process and help request. We use these details to handle your request and contact you. Because your request may reveal something about your religious beliefs, we ask for your explicit consent.
  • Maqsadi Assistant: your question, recent messages needed to understand the conversation, your language and a random temporary session code. This is necessary to answer you. We retain question and answer text to improve the knowledge base only if you tick the separate retention box.
  • Website use and security: technical data such as IP address, time, requested page, browser and device data, approximate location and performance data. We use these for security, abuse prevention, troubleshooting and aggregated statistics. The legal basis is our legitimate interest in a secure, reliable website.

3. Do not share sensitive data

Do not share passwords, verification codes, passport numbers, payment details, medical information or other sensitive personal data through forms, Maqsadi Assistant or the WhatsApp community. Maqsadi does not need this information to provide general guidance or support.

4. Who receives the data?

We do not sell personal data. We use suppliers only where necessary to operate the website and provide the services you select:

  • Vercel for hosting, security logs, website statistics and performance measurement;
  • Brevo for newsletter and community signups, consent records, email communication and forwarding personal-help requests to Maqsadi’s internal recipient;
  • OpenAI to generate answers in the Maqsadi Assistant;
  • PostHog, when configured, for Maqsadi Assistant usage statistics. Question and answer text is included only if you choose this;
  • Sentry (EU data centre) for technical error reports: the error message, the location in the code, the requested page and browser information. Form contents, cookies and IP address are not included;
  • Meta/WhatsApp when you join the WhatsApp community. Depending on your WhatsApp settings and the community setup, your profile name, profile photo and phone number may be visible to Meta, administrators or other participants.

5. Transfers outside the EEA

Some suppliers may process personal data outside the European Economic Area. Where this occurs, we use a valid transfer mechanism, such as an adequacy decision or European Commission-approved standard contractual clauses, and assess which supplementary safeguards are required.

6. Retention periods

  • Community and marketing data: until you unsubscribe or withdraw consent. We may then retain a minimal suppression record to prevent further messages. We retain proof of consent for up to five years after withdrawal.
  • Personal-help requests: for up to twelve months after resolution, unless an ongoing dispute or legal obligation requires a longer period.
  • Conversations with Maqsadi Assistant: conversation text remains in browser memory while the session is open. OpenAI may retain API inputs and outputs for up to thirty days by default for abuse monitoring. If you consent to retention by Maqsadi, we keep the text for up to 24 months; analytical event data for up to twelve months.
  • Technical security and server logs: for up to thirty days, unless a specific security incident requires a longer investigation.

7. Cookies and local storage

Maqsadi does not use advertising cookies. The site may store a language preference in a cookie and your colour-mode preference in local browser storage. These functions are necessary to remember your choices. Vercel Analytics and Speed Insights are used for aggregated usage and performance statistics and are not intended to track you across websites.

8. Your rights

You can email privacy@maqsadi.com to request access, correction, deletion, restriction or transfer of your data. You may object to processing based on a legitimate interest and withdraw consent at any time. Withdrawal does not affect the lawfulness of earlier processing. We may request additional information to verify your identity.

If you are not satisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

9. Required data and automated decisions

Required fields are necessary to process the relevant invitation, request or question. Without those details, we cannot provide that service. Maqsadi does not make decisions that produce legal or similarly significant effects based solely on automated processing.

10. Changes

We may update this policy when the website or our processing changes. The current version and effective date will always appear here. We will notify active subscribers through an appropriate channel if a change is significant.