Privacy Policy

Effective 2026-06-03 · Version 2.0 · revised 2026-06-03 — alignment with Terms §3a alameleen alaiha cost-recovery model; no monthly-subscription billing data is collected

In plain words

When you sign up, we ask only for your name, email and phone number. No date of birth, no Social Security or other ID number, no photo of an ID, and no selfie.
If you later choose an account with real money, the company that holds that account asks for your ID itself. We do not collect it and we do not keep it.
We never see your bank password or your investment-account password. The linking services give us a secure digital key, used only for the actions you agreed to.
We keep what we need to run your waqf: the rules you set, what moved and when, any loan request or calamity claim you send, and your messages to us.
We never sell your data. We show no ads and use no ad trackers or Google Analytics. Our only cookies keep you signed in, protect your account, and remember your language.
If you lend, you never see who borrowed. If you borrow, no lender sees you. The system enforces this, and no one can ask around it.
Your data is stored in the United States and protected with encryption. Every time anyone looks at it, that is logged. We give it to authorities only when the law truly demands it.
Money records and logs are kept for seven years. Your account details are kept while your account is open, and for one year after it closes.
You can ask to see, correct, export or delete your data. Some records must be kept by law or by your waqf agreement. We answer within thirty days.
Questions: privacy@qardon.org

بكلمات بسيطة

عند التسجيل لا نطلب إلا اسمك وبريدك الإلكتروني ورقم هاتفك. لا تاريخ ميلاد، ولا رقم ضمان اجتماعي أو أي رقم هوية، ولا صورة لوثيقة، ولا صورة شخصية.
إن اخترت لاحقًا حسابًا بمال حقيقي، فالجهة التي تحفظ ذلك الحساب هي التي تطلب هويتك بنفسها. نحن لا نجمعها ولا نحتفظ بها.
لا نرى أبدًا كلمة سر بنكك ولا كلمة سر حساب استثمارك. خدمات الربط تعطينا مفتاحًا رقميًا آمنًا لا يُستعمل إلا فيما وافقت عليه.
نحفظ ما نحتاجه لإدارة وقفك فقط: القواعد التي وضعتها، وما تحرّك من مال ومتى، وأي طلب قرض أو طلب عون ترسله، ورسائلك إلينا.
لا نبيع بياناتك أبدًا. لا إعلانات، ولا أدوات تتبّع إعلانية، ولا Google Analytics. وملفات تعريف الارتباط عندنا لا تفعل إلا ثلاثة أشياء: تبقيك مسجّل الدخول، وتحمي حسابك، وتتذكّر لغتك.
إن أقرضت، فلن ترى من اقترض. وإن اقترضت، فلن يراك أي مُقرض. والنظام نفسه يفرض ذلك، ولا يمكن لأحد أن يتجاوزه.
تُحفظ بياناتك في الولايات المتحدة، وهي محمية بالتشفير. وكلّ اطّلاعٍ عليها مسجَّل. ولا نعطيها لأي جهة رسمية إلا بطلب قانوني صحيح.
سجلات المال والسجلات الرقابية تُحفظ سبع سنوات. وبيانات حسابك تُحفظ ما دام حسابك مفتوحًا، وسنة واحدة بعد إغلاقه.
لك أن تطلب الاطّلاع على بياناتك، أو تصحيحها، أو نسخها، أو حذفها. وبعض السجلات يجب أن تبقى بحكم القانون أو بحكم اتفاقية وقفك. ونردّ خلال ثلاثين يومًا.
للأسئلة: privacy@qardon.org

If anything here differs from the full text below, the full text governs.

إن اختلف شيء هنا عن النص الكامل أدناه، فالنص الكامل هو المعتمد.

In plain English

We collect the little we need to run the platform safely — at sign-up that is only your name, email and phone; no date of birth, no Social Security or other government ID number, no ID photo and no selfie. Beyond that: which bank account is yours, which brokerage account is yours, what rules you set for your waqf, and what moved when. We do not see your bank password. We do not see your brokerage password. We use vendors that give us tokens — not credentials — to operate on accounts you own. We never sell your data. We never share it with third parties for marketing. We protect borrower identity absolutely: if you lend waqf, you do not see who received it; if you borrow, the lender does not see you.

1. Who we are

qardon.org is a technology platform owned by Fotoh, Inc., a California for-profit stock corporation, entity B20260321874, incorporated 2026-07-15 in Fresno, California. We are the operator that controls and is responsible for the personal data described here. For privacy questions: privacy@qardon.org.

2. What we collect

Identity at sign-up. Your name, email address and phone number. That is all. We do not ask for, receive or store your date of birth, your Social Security number or any other government identification number, a photo of any identity document, or a selfie or other liveness capture. Your account begins as a paper (virtual-money) account, which requires no identity check, so we collect no identifier for one.
Identity for a live account — collected by the custodian, not by us, and only if you choose it. If and when you elect to move from a paper account to a live account holding real money, the regulated custodian that will hold that account runs its own onboarding. Its legal identity requirements — which include a government identification number — are disclosed to you by the custodian at that step, for its own lawful reason, and are collected by the custodian. qardon.org does not collect them, and does not receive or store them.
Bank account information. Through a bank-linking service (Plaid, or an equivalent vendor): a long-lived access token that authorizes us to read your waqf bank account's balance and transactions, and to initiate the movements you authorized in the Waqf Lender Agreement. We do not see, store, or transmit your bank password. We do not see your full account or routing number except where the law requires it for a specific transaction.
Brokerage account information. Through the partner halal brokerage's interface: an API access token authorizing us to place trades and read positions in your waqf investment account. We do not see your brokerage password.
Waqf rules. The commitments you have set: purpose restrictions (category, country, or other allowed limits), opt-in or opt-out of bot-managed investing, and the amounts and dates of what you have lent.
Transaction metadata. Timestamps, amounts, idempotency keys, and outcome codes of every authorized movement on your accounts. The minimum needed to run the registry and reconcile against bank and brokerage records.
Application content. If you apply for a goodly loan: the details you submit (income, debt, purpose, supporting documents), the review findings, and the final decision. If you submit a Recovery Fund claim: the calamity details and supporting documents, the review findings, and the final decision.
Support correspondence. Messages you exchange with our specialist agents, with timestamps, for service quality and audit.
Technical data. IP address, browser user-agent, session cookie, and standard server logs needed to operate the site and detect abuse.

3. What we do not collect

We do not collect or store your bank password.
We do not collect or store your brokerage password.
We do not collect or store payment card numbers.
We do not collect biometric data of any kind. There is no selfie, no liveness check and no face capture at sign-up.
We do not collect your date of birth, your Social Security number, any other government identification number, or a photo of any identity document. Where a live account later requires them, the custodian collects them directly, under its own disclosure.
We do not collect precise geolocation. The site does not request your device's GPS.
We do not run third-party tracking pixels. We do not run Google Analytics. We do not run advertising trackers.

4. How we use what we collect

We use it only to:

Reach you: confirm your membership, send you your account notices, and answer you when you write to us.
Open, link, and operate the accounts described in the Terms of Service: your waqf bank account, your waqf investment account, and the registry entry in your name.
Execute the movements you authorized in the Waqf Lender Agreement.
Review goodly-loan applications and Recovery Fund claims on the facts filed.
Detect fraud, abuse, and system anomalies.
Communicate with you about your account, applications, and claims.
Comply with our legal obligations, including tax reporting where applicable.
Audit our own operations, including the meta-supervisor's sample review of decisions for quality control.

We do not profile you for advertising. We do not target you with ads. We do not sell your data. We do not share your data with third parties for their independent purposes, except as described in §6.

5. Borrower dignity — the absolute privacy rule

If you lend a waqf, you do not see who received any portion of it as a goodly loan. You see only aggregated category totals and impact summaries (for example: "Your waqf helped 12 families this year; 4 medical, 3 education, 5 debt-relief"). You do not see borrower names, faces, ages, locations beyond a country level, loan amounts per individual, or any other identifying detail.

If you receive a goodly loan, no lender sees you. Your identity is shielded from the people whose waqf funded your loan. qardon.org's internal systems see you for the purpose of running the loan; no member of the platform sees you on the lender side.

This separation is architectural. It is enforced by the system, not by trust. It cannot be opted out of and it cannot be requested around.

6. Where the data lives, and who sees it

Cloudflare is our primary infrastructure provider (D1 databases, KV namespaces, Vectorize indexes, Workers). The data is stored in their United States regions. Cloudflare is SOC 2 Type II compliant.
No identity-verification vendor is used at sign-up. No document is submitted and none is shared. If you later elect a live account, the regulated custodian performs its own identity onboarding directly with you.
Plaid (or the bank-linking vendor in use) handles the connection between qardon.org and your bank. They hold the access token. They see your bank's transaction records on our behalf when we query.
The partner halal brokerage (for example, Wahed Invest) holds your waqf investment account. They see the trades and positions in your account because the account is at their firm. Their privacy policy governs their handling of your data; their terms govern your account relationship with them.
qardon.org's automated systems see what is needed to run your account: balances, rules, transactions, applications, and decisions.
qardon.org's admin operator (a small operations team within Fotoh, Inc.) has read-only audit access used for resolving escalations, complaints, and meta-supervisor anomalies. Every access is logged.
The Founder of Fotoh, Inc. has override authority for cases that escalate to him and for governance reasons described in our Charter. Every access is logged.

We do not sell your data. We do not share your data with any third party for marketing. We do not give your data to any government, agency, or other party except in response to a valid legal demand, and even then we challenge demands that exceed the law.

7. How we protect the data

Encryption in transit. All connections to qardon.org use TLS 1.3.
Encryption at rest. Sensitive tokens (bank-linking access tokens, brokerage API tokens) are encrypted at rest with AES-256-GCM. Keys are managed in Cloudflare's secret store.
Least-privilege access. Internal services see only the fields they need. Admin operator access is audit-logged.
Idempotency and reconciliation. Every movement carries an idempotency key; daily reconciliation against bank and brokerage records catches any drift.
Meta-supervisor audit. A separate automated process samples one in one hundred decisions for quality review.

8. Cookies

We use a small number of cookies, all functional:

A session cookie that keeps you signed in while you use the platform.
A CSRF protection cookie that defends against forged-request attacks.
A preference cookie that remembers your language and accessibility choices.

We do not use tracking pixels. We do not use third-party analytics. We do not use advertising cookies.

9. How long we keep the data

Transaction records: seven years from the date of the transaction. This is the standard regulatory retention period in the United States for financial records.
Audit logs: seven years from the date of the log entry.
Member account data: while your account is active, plus one year after closure. After that we retain only what regulatory rules require us to keep.
Identity records: we hold none, so there are none to retain. Records held by a custodian you have opened a live account with are kept under that custodian's own retention policy, which it discloses to you.
Application and claim files: seven years from the decision date.
Support correspondence: three years from the date of the message, unless tied to an ongoing dispute, in which case until the dispute is resolved plus seven years.

10. Your rights

Depending on where you live, you may have legal rights to:

Access the data we hold about you. Email privacy@qardon.org with the request.
Correct data that is inaccurate. You can correct most of this yourself in your dashboard; contact us for the rest.
Delete data we hold about you. We honor deletion requests subject to legal retention obligations. We cannot delete records of committed waqf without breaching the agreement you signed; we can delete records that are not bound by that agreement.
Export your data in a portable format.
Restrict or object to certain processing.
Withdraw consent for any processing that requires consent. Withdrawing consent for account linking or trading authorization will result in our being unable to operate the platform for you.
Lodge a complaint with your local data protection authority.

We respond to verified requests within thirty days. We may extend by another thirty days for complex requests and will tell you if we do.

11. Children

We do not knowingly collect data from anyone under eighteen years old. If you believe a child has provided us data, write to privacy@qardon.org and we will delete it.

12. International transfers

If you live outside the United States, your data is transferred to and processed in the United States. For users in jurisdictions that require it (the European Economic Area, the United Kingdom, and similar), the data transfer is governed by standard contractual clauses or an equivalent legal mechanism.

13. California residents

If you live in California, the California Consumer Privacy Act (CCPA) gives you the rights described in §10, plus: the right to know the categories of personal information we have collected; the right to non-discrimination for exercising your rights; the right to opt out of any sale or sharing of your personal information. We do not sell or share your personal information. No opt-out is needed.

14. European Economic Area, United Kingdom, and similar

If you live in the European Economic Area, the United Kingdom, or a jurisdiction with a similar regime, the General Data Protection Regulation (or its local equivalent) gives you the rights described in §10. Our legal bases for processing are: performance of the contract you entered into with us (Terms of Service and Waqf Lender Agreement); compliance with our legal obligations; and our legitimate interests in operating the platform safely. Our data protection contact: privacy@qardon.org.

15. Changes

We may update this Privacy Policy. We will give you thirty days' notice by email and by banner in your member dashboard before any material change takes effect. Continued use after the effective date is your acceptance of the changed Privacy Policy.

16. Contact

For privacy questions: privacy@qardon.org.