Privacy Policy

Last updated: 9 September 2026

WAQAF is a platform that charities use to run their fundraising and their finances. This policy explains what personal data the platform handles, why, who it is shared with, how long it is kept, and what you can ask us to do about it.

It is written to be read once, in order. If you only want one section, the two most people are looking for are What we collect and Your choices and your rights, both below.

Who is responsible for your data

WAQAF is used by many independent charities, and that changes who answers for what:

The charity you gave to, or work for, decides what to do with your data — whether to contact you, how to describe your gift, what to keep in its records. In data-protection language, the charity is the controller.
WAQAF operates the platform on that charity's instructions. We hold the data, keep it running and keep it separated between charities, but we do not decide to market to you, and we do not sell or rent anyone's data to anybody. In the same language, we are the processor.

For our own website, and for the accounts our staff sign in with, WAQAF is the controller.

If you are unsure which charity holds your data, ask us and we will help you find out.

What we collect

When you give

Your name, email address and phone number, when you provide them. You may also choose to give anonymously, in which case your name is not shown on any public list of donors.
The details of the gift itself — amount, currency, date, the project or fund it was for, and any note or reference you added.
Answers to any questions the charity's donation form asks, which vary by project.

When you create an account

A name, an email address and, if you use it, a phone number, along with whether each has been verified.
A profile picture, only if it comes from the sign-in method you chose.
Your language and notification preferences — whether you want to hear from the charity by email or by message, and about what.

Accounts are separate for each charity. Using the same email address at two charities on the platform creates two unconnected accounts, and neither charity can see the other's.

When you sign in

You can sign in with a link sent to your email, with a one-time code sent to your phone, or through a third-party sign-in provider — a large technology company whose account you already have.

If you use one of those providers, we receive only what is needed to identify you: your name, your email address, whether that address is verified, and a profile picture if the provider supplies one. We do not receive, ask for or store your password for that provider, and we get no access to anything else in your account there — not your contacts, not your files, not your activity elsewhere. What that provider does with the fact that you signed in is governed by its own privacy policy, not this one.

We link a third-party sign-in to an existing account only when the provider has confirmed the email address, so that nobody can reach your account by claiming an address they do not control.

When you pay

We never see or store your card number or security code. They are entered with a regulated payment provider and never reach our servers.

If you choose to save a card for next time, we keep only enough to show you which card it is and to charge it again with your permission: the card brand, the last four digits, and the expiry month and year, plus a token from the payment provider that is meaningless anywhere else. You can remove a saved card at any time.

When you use the site

Session information, so that you stay signed in — including the IP address and browser description of the device you signed in from. We keep this so you can see your own active sessions, and so we can investigate a suspicious sign-in.
A small number of cookies. See Cookies, below.

When someone gives a gift in your name

A donor can make a gift and ask us to tell the person it is for. In that case we receive the recipient's name, a contact address or number, and any message the giver wrote — from the giver, not from the recipient. We use it to deliver that notice, and the recipient can ask us to delete it.

What we do not collect

We do not ask for, and do not want, your national identity number, your date of birth, your religion, your health, your political views, or any other special category of data. If you send any of it to us in a free-text box anyway, please don't — and tell us, so that we can remove it.

Why we use it

We use personal data only for these purposes:

To take and record a donation, issue a receipt, and let the charity account for the money — including in the statutory accounts and audit trail that a charity is required to keep.
To operate your account, sign you in, and keep it secure.
To tell you about your own giving — a receipt, a confirmation, a reminder about a recurring gift you set up, a notice that a gift you sent has been delivered.
To let the charity report to its donors and its regulators on what was raised and what it was spent on.
To keep the platform working and safe — diagnosing faults, preventing fraud and abuse, and meeting our legal obligations.

We do not sell personal data. We do not rent it, trade it, or share it for anyone else's advertising. We do not use it to train artificial-intelligence models.

Messages that are not about your own giving — a newsletter, an appeal — are sent only where the charity has a proper basis to send them, and every one of them has a way to stop.

Who we share it with

We share personal data only in these situations, and only what is needed for the job:

With the charity whose donation form, website or donor portal you used. This is the main one: your gift is theirs to account for.
With the service providers who run the platform for us. By category, these are: a cloud hosting provider, a managed database provider, a file and image storage provider, a payment provider, an email delivery provider, a messaging provider, an error-monitoring provider, and — for translating a charity's own published text between Arabic and English — a machine-translation provider. Each is bound to use the data only to provide that service to us.
With a third-party sign-in provider, if you choose to sign in that way, and then only the fact that you are signing in. We send them no donation data of any kind.
Where the law requires it, or to establish or defend a legal claim.
If the platform or a charity's operations change hands, in which case this policy travels with the data and you will be told.

Charities cannot see each other's donors. That separation is enforced by the platform on every request, not by convention.

Where your data is held

The platform's database and file storage are currently hosted in the United States, and some of the service providers above operate elsewhere. So if you are in Oman — as most of our donors are — your data is transferred outside the Sultanate in the course of being processed.

We say this plainly because you are entitled to know it. We require our providers by contract to protect the data to the standard this policy describes, and we are actively reviewing where the platform is hosted.

How long we keep it

Donation and financial records are kept for as long as the charity must keep its accounts — typically several years, under Omani law and the charity's own regulator — because a charity cannot lawfully delete the record of money it received.
Your account is kept while it exists. Close it, and the sign-in identity is removed.
Session records, including the IP address, are kept for a short period and then expire.
Gift-notice contact details are kept only as long as needed to deliver the notice and to show the giver that it was delivered.
Our administrative audit trail records what changed and who changed it. It is append-only by design, which is what makes it trustworthy: entries cannot be edited or deleted, including by us. See the honest limit under Your choices and your rights.

How we protect it

Data is encrypted in transit. Access is limited to what a person's role requires, and every significant change to a charity's financial records is written to that append-only audit trail with the identity of whoever made it. Payment credentials are held by the payment provider, not by us. Access to production systems is restricted to the small number of people who operate them.

No system is perfect, and we will not pretend otherwise. If a breach affects your personal data, we will notify the charity — and you, and the relevant authority, where the law requires it.

Your choices and your rights

You can ask us to:

Show you the personal data we hold about you.
Correct it, if it is wrong.
Delete it, subject to the limit below.
Stop messaging you. Everything we send that is not about a transaction you asked for has a way to opt out, and you can turn off email or messaging in your account settings.
Give you a copy in a portable form.
Object to, or restrict, a particular use.

⚠️ The honest limit on deletion. We can delete your account, your contact details and your preferences. We usually cannot delete the record of a donation, because the charity is legally required to keep its financial records, and the audit trail cannot be rewritten. What we can do instead is disconnect that record from you — remove your name and contact details so that the amount remains in the accounts without identifying you. If you ask us to delete everything, that is what will happen, and we will tell you exactly what was kept and why.

To exercise any of this, email privacy@waqaf.uk. We will reply within 30 days, and there is no charge. If your data is held by a particular charity, we may need to pass your request to them, and we will tell you when we do.

If you are not satisfied with our answer, you may complain to the data-protection authority in your country. In Oman, that is the Ministry of Transport, Communications and Information Technology.

Cookies

We use as few as we can, and we use no advertising cookies and no third-party tracking cookies.

Necessary cookies keep you signed in and keep the site secure. The site does not work without them.
A preference cookie remembers whether you chose Arabic or English.

You can clear or block cookies in your browser. Blocking the necessary ones will sign you out.

Children

The platform is not intended for children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

Changes to this policy

If we change how we use personal data, we will update this page and change the date at the top. If a change materially affects you, we will make a point of telling you rather than relying on you to come back and check.

Contact

Questions, requests and complaints: privacy@waqaf.uk.

If your question is about a particular charity's use of your data, tell us which charity and we will put you in touch, or pass it on.