Halaal
Privacy Policy
We believe privacy should be simple and software should be honest. Here is exactly how we handle data across the Workspace Suite, our public tools, our forms, and our signage displays in compliance with UK GDPR.
Identity & Data Contact
Halaal Inc LTD ("we", "us", or "our") operates the Workspace platform and related services in accordance with the UK GDPR and the Data Protection Act 2018.
Halaal Inc LTD is a company registered in England & Wales (company no. 16055333). Registered office: 167–169 Great Portland Street, London, W1W 5PF, United Kingdom.
For any privacy or data protection query, please contact us using the details below.
Data & privacy:privacy@halaal.app
General support:support@halaal.app
Address: 167–169 Great Portland Street, London, W1W 5PF, United Kingdom
We are established in the United Kingdom and regulated by the ICO. We do not currently offer our own services to people in the EU or EEA in a way that requires a representative under Article 27 of the EU GDPR. If that changes, we will appoint one and name them here. You can contact us atprivacy@halaal.app about anything to do with your personal data.
Scope of This Policy
This Privacy Policy applies to all services operated by Halaal Inc LTD, including the Workspace dashboard, our mobile app, hosted forms, profiles, short links, digital signage displays, Calendar, shops, and the Marketplace.
Where you use our Forms, Profiles, or Signage to collect or display personal data relating to third parties (your audience or congregation), you are responsible for providing your own privacy notices to those individuals as required by law. If you buy from a shop on Halaal, section 3.7 explains how your order details are used, on the seller's behalf and for our own purposes.
Services Covered
The Workspace
workspace.halaalos.com / account.halaalos.comThe central SaaS dashboard for managing your brand, forms, and analytics.
Forms
forms.halaalos.comPublic form-hosting. You create forms; your audience fills them securely.
Profiles (Link in Bio)
halaal.link / link.halaalos.comPublic digital storefronts and unified profile pages.
Short Links
url.halaalos.comDynamic traffic routing and privacy-respecting click analytics (short links resolve via hala.al).
Slides (Digital Signage)
slides.halaalos.comCloud-hosted signage for showing announcements, prayer times, and content on screens in your premises.
Calendar
calendar.halaalos.comPlan and share community events across screens, profiles, and the apps you use.
Shops
shop.halaalos.comOnline shops run by sellers on Halaal: storefronts, checkout, orders and order emails.
Marketplace
marketplace.halaalos.comDiscover and list halal products and services across the Halaal network.
Third-Party Links Disclaimer
Our Services, particularly public Profiles and Short Links, may contain links to third-party websites. We are not responsible for the privacy practices, cookies, or content of external sites linked by our users.
The Halaal App
The Halaal app for iOS and Android is covered by this policy. Most of it works without an account at all.
Noor runs entirely on your device
Noor's search and AI features run locally, on your phone. Your queries never leave the device. They are not sent to us, not sent to anyone else, and not logged or stored anywhere — including by us. There is no server that could see what you searched for, because nothing is sent to one.
- If you sign in: your Halaal account holds your email address, your name, and the calendar and event data you choose to create or register for. That is the same account described elsewhere in this policy — the app is another way into it, not a separate store of data.
- If you do not sign in: the app works, and we hold nothing about you. Halaal Pro deliberately does not require an account.
- Announcements: the app reads a public list of announcements when it opens. It is a one-way read — the request carries no account data and nothing about you is written back.
- Who else is involved: Supabase hosts the account database, in the EU. Apple and Google handle payment for Halaal Pro; they are the seller and we never see your card details. No advertising networks, and no analytics that identify you.
- Deleting your data: you can delete your account and everything in it from the account portal at account.halaalos.com. Deletion is immediate and is not recoverable. You can also write to us at the address in section 01 and we will do it for you.
Collection & Cookies
3.1 Account Information
- Full Name
- Email Address
- Date of Birth — used to verify you meet our minimum age (lawful basis: legal obligation and our legitimate interest in age-appropriate access)
- Gender — optional; only if you choose to provide it
Required information is necessary to provide the service. If you do not provide required data, you may not be able to use certain features.
3.2 Form Submissions & Analytics
When members of the public submit responses through forms or click links created by our users, we process that information strictly on behalf of the workspace owner.
- You are the Data Controller
- We act as a Data Processor
We do not sell this data, nor do we use it to profile your audience for advertising purposes.
What a page view or link click records
Only the following: which of your links or pages was opened, when, a device category (mobile, tablet, desktop or bot), a country, and the domain name of the site the visitor came from.
- No IP addresses are stored — not hashed, not shortened.
- No browser fingerprint — we keep a device category, never the full browser identification string.
- No visitor identifier and no tracking cookie — which means these are counts of clicks, not of people, and no visitor can be followed between visits, pages or workspaces.
- No full page addresses from other sites — a referring address is reduced to its domain before it is written, so search terms and identifiers in it are never stored.
These records are deleted after 400 days.
When a visitor shares one of your pages, the link they pass on notes the channel it was sent through so you can see what is working. If the sharer was signed in, it carries a one-way, page-specific reference to them — it cannot be reversed, cannot be matched across different pages, and is not shown in your dashboard. The page they land on reads this from the link itself, and a sign-up made from that page is credited to the share. Nothing is stored on the visitor's device for it — no cookie — and closing the page forgets it.
Where a visit came from. A visit to one of your public pages notes where the link came from: one of your own links (“the poster at the door”), a visitor's share, your campaign tags, the site that sent it (as a domain name) or, for an advertising click, only which platform it came through — never the click's own identifier. An order, a form answer or an event sign-up made during that visit keeps the same note, so you can see “came from Instagram”. That is a fact about your channels, not about the person: it names no one, and it is not joined to anything else they did. The origin of a visit is kept in the open tab only — not in a cookie — and closing the tab forgets it.
3.3 Digital Signage Displays
When you use Slides to show content on a screen in your premises, we host and deliver the content you publish. You are the Data Controller for that content; we act as a Data Processor.
- We do not set tracking cookies on the display device.
- We do not identify, profile, or track the people who view the screen.
- The display requests its content from our servers; we process those requests (including the device's IP address) only to deliver content and keep the service secure.
Any location used to calculate prayer times is the location of your premises, which you configure — not the location of any individual.
3.4 Technical, Usage & Security Data
To deliver and protect the platform, our infrastructure providers process technical data — including IP address, device and browser information — as part of serving a request and keeping the service secure. This is transient: it happens in order to answer the request and is held only in short-lived operational logs.
It is deliberately separate from the usage statistics we keep for workspace owners. Those are described in 3.2, and no IP address, browser identification string or visitor identifier is written into them. Nothing links an operational log entry to a row in a workspace's statistics.
To stop abuse — automated orders, or a script inflating a page's numbers — our servers count requests per address for a minute or an hour at a time. The address itself is never kept for this: only a keyed one-way hash of it, which cannot be reversed without a secret held on our servers, is different for each purpose, and is deleted within a day.
To prevent bots and abuse on sign-up and public forms, we use a bot-detection service, which processes limited technical signals from the visitor's device.
3.5 Children's Privacy
Our services are not intended for children under the age of 13. We verify age using your date of birth at sign-up, and accounts for anyone under 13 are not permitted. Users under 18 must have permission from a parent or guardian to use our services.
Children's data. Where we provide services to users aged 13–17, we apply data-minimisation and age-appropriate design in line with the ICO's Age-Appropriate Design Code (the Children's Code). We do not knowingly collect personal data from anyone under 13. If we become aware that such data has been collected without the appropriate consent, we will delete it promptly.
3.6 Cookies & Tracking
We use cookies strictly necessary for authentication, security, and workspace operation, plus a few first-party functional cookies set only when you take an action (for example, remembering your last-used workspace or preventing duplicate form submissions). We set no advertising or cross-site tracking cookies. See our Cookie Policy for the full list.
We do not inject third-party advertising or tracking cookies (such as Facebook Pixels) into your public Forms, Profiles, or Signage displays without your explicit instruction.
3.7 Shops: Orders & Card Payments
When you buy from a shop on Halaal, the seller who runs the shop is responsible for your order details: the seller is the Data Controller. We keep and use them on the seller's behalf, as a Data Processor, to run the shop: taking your order, emailing you about it, payment, delivery or collection, and your order history.
- your name and email address (from your Halaal account if you are signed in), and a phone number if you choose to give one;
- a delivery address, if you choose delivery;
- your answers to the shop's questions and any note you add;
- what you ordered and the totals, then the order's status and whether it was paid, refunded or disputed.
Where we decide for ourselves. We are a Data Controller in our own right for a few uses of the same data: keeping the platform secure and stopping fraud and abuse (the bot check and rate limits in 3.4, and acting against fraudulent shops), meeting our own legal duties, handling reports about a shop, and the account emails we send if you have a Halaal account. We rely on our legitimate interests and on legal obligation for these.
Card payments.If you pay by card, we pass your email address and the order's items and total to the seller's own Stripe account. This creates the payment page, with your email filled in (you can change it there), and lets Stripe send the seller's receipt. The lawful basis is that it is necessary to carry out the purchase you asked for (UK GDPR Art. 6(1)(b)). Your email is used for the receipt and updates about your order, never for marketing unless you agree to it. You type your card details on Stripe's page and they never reach us: from Stripe we receive only whether the payment went through, was refunded or was disputed, and Stripe's reference numbers.
Stripe's role.Stripe is the seller's payment provider, not ours. It processes the payment for the seller, under the seller's own agreement with Stripe, and is a controller in its own right for its legal duties (such as anti-money-laundering checks) and fraud prevention. See Stripe's Privacy Policy.
- The order itself (what was bought, the amounts, the dates and its status) is the seller's business record. It stays with the shop for as long as the seller keeps their Halaal workspace, so the seller can meet their tax and consumer-law duties.
- If you ordered as a guest, your name, email, phone and delivery address are removed from a completed or cancelled order 12 months after it last changed.
- If you have a Halaal account and delete it, your details are removed from your orders straight away; the sale itself stays with the seller.
- When a seller deletes their workspace, its orders are erased with it (backups within 30 days).
Where it is kept. Order details are stored in the EU (Supabase) and order emails are sent from our own servers in Helsinki. For a card payment, Stripe may process your details outside the UK and EEA under its own transfer safeguards.
Your rights.For your order details, the seller is the first place to ask (their contact details are on the shop's Seller details page), and we help them answer. You can also write to privacy@halaal.app: we deal with what is ours and pass the rest to the seller.
3.8 Reports About Content
Anyone can report something published on Halaal (section 10 of our Terms). A report holds the address of what was reported, the reason chosen, anything you write, and your email address if you give one. Your email is optional and used only to tell you what we decided. With each report we also save a copy of what the page showed at that moment (its text and pictures), so we judge what was actually published. If you report through a form on our site, we keep your IP address only as a keyed hash (a scrambled code that can't be turned back into the address), for 30 days, to stop abuse.
Who sees it.Only the people at Halaal who review reports. We never tell the owner of the content who reported it, except for a copyright or brand claim, where the owner needs the rights holder's name to respond. We pass a report to the police or the National Crime Agency only where the law requires it, for example for child sexual abuse material.
Lawful basis. Our legitimate interests in keeping Halaal safe and handling reports fairly; and legal obligation where a report is about illegal content (the Online Safety Act 2023).
- The keyed hash of your IP address: 30 days.
- A report we took no action on, with the saved copy, your email and your words: 6 months after we decide.
- A report we acted on, or one that was appealed: 12 months after we decide.
- After that, only a short record, without the reporter's details or the saved copy (what was reported, which rule, what we did and when), for 3 more years, so we can spot repeat breaches.
- Child sexual abuse material and the related account data: the one yearthe law requires after we report it to the National Crime Agency, and the agency's reference number for five years.
How & Why We Use Data
We process personal data under the following lawful bases under UK GDPR:
- Contract: To create and maintain user accounts, process subscriptions, and deliver core platform functionality.
- Legitimate Interests: To protect platform security, prevent fraud, and maintain system performance.
- Legal Obligation: To comply with applicable laws, including financial, taxation, and regulatory requirements.
- Consent: Where we rely on your consent — for example, optional marketing communications, non-essential cookies, and certain contexts involving users aged 13–17 — you may withdraw it at any time, without affecting processing carried out before withdrawal.
Shop orders:when we process order details for a seller, the lawful basis is the seller's, usually that it is necessary to carry out the purchase (contract). Our own uses of that data are listed in 3.7.
Marketing: We only send marketing communications where you have given consent, as required by the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time using the unsubscribe link in any marketing email or by contacting us.
Checking content: we do not scan or judge your content with automated tools, beyond simple checks on what you enter (for example, that a payment link goes to a provider we accept). Every shop is approved by a person before it opens, and a person reviews every report about content (see 3.8).
We do not make legally significant decisions affecting users solely through automated processing.
Security & Retention
We implement technical and organisational safeguards designed to protect personal data. These include:
- Encrypted HTTPS/TLS connections
- Secure cloud hosting environments
- Row Level Security (RLS) database architecture
Your account's security activity
To protect your account, we keep a record of how it is used and changed: each sign-in (how you signed in, the device type such as “Safari on iPhone”, and the country and city it came from), the second step of two-step verification, ways to verify added or removed, recovery codes made or used, devices signed out, and password or email changes. The country and city are taken from our network provider at the moment of sign-in; we do not store your IP address (our authentication provider holds it with each active session, and it goes when the session ends). You see this record on your account's Security page, and we email you when your sign-in settings change. It is kept for 90 days, read only by you (and by our administrators when investigating a problem you report), relies on our legitimate interest in keeping your account safe, and is erased with your account.
Data Retention
- Account data is retained while your account remains active.
- When you delete your account, your personal data and all resources you own are permanently and irreversibly erased from our active systems immediately; copies in encrypted backups are overwritten within 30 days.
- Active subscriptions are cancelled and any remaining paid period is forfeited (no refund for voluntary deletion; this does not affect any statutory cooling-off right).
- Our Merchant of Record (Lemon Squeezy) retains invoice/tax records for the period required by law.
- Shop orders are kept as described in 3.7: the sale stays with the seller's shop, and a guest's contact details are removed 12 months after a finished order last changed.
Data Breach Notification
Where we are the Controller (account and billing data): if a breach poses a risk to individual rights, we notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, and we notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Where we are the Processor (data our customers collect via Forms, Profiles, Signage, Calendar or their shops): we notify the affected customer (the Controller) without undue delay. We do not notify the ICO directly for data we only process on a customer's behalf.
Your Rights & ICO
Under UK GDPR and EU GDPR, you have the following rights:
- Right of Access — Request copies of your data.
- Right to Rectification — Correct inaccurate information.
- Right to Erasure — Request deletion of personal data.
- Right to Restrict Processing — Ask us to limit how we use your data.
- Right to Data Portability — Receive data in a structured, machine-readable format.
- Right to Object — Object to processing based on our legitimate interests.
- Right to Withdraw Consent — Where processing relies on consent, withdraw it at any time.
- Rights regarding Automated Decisions — Not be subject to solely automated decisions producing legal or similarly significant effects.
How to exercise your rights
To exercise any of these rights, contact us at privacy@halaal.app. We will respond within one month, as required by UK GDPR. This may be extended by up to two further months for complex requests, in which case we will let you know. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints to us
If you are unhappy with how we have handled your personal data, you can complain to us at privacy@halaal.app. We acknowledge a complaint within 30 days, look into it without undue delay, and tell you the outcome. If you are still not satisfied, you can complain to the ICO.
Complaints to the ICO
If you believe your personal data has been handled improperly, you may lodge a complaint with:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk
Updates to this Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements.
Where material changes occur, we will notify users through email, platform notifications, or dashboard alerts before changes take effect.