Privacy Policy

At Zakaty, we recognise that privacy is a trust (amānah). We are committed to protecting your personal information and handling all data in a manner consistent with our ethical principles and applicable data protection law. This Privacy Policy explains what information we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have.

This policy applies to Zakaty's website (https://zakaty.ai), our mobile applications made available through the Apple App Store and Google Play Store, and any related services (together, the "Platform"). It applies regardless of whether you access the Platform through a web browser, mobile device or other supported method.

The data controller responsible for your personal information is:

ZAKATY AI LTD, trading as Zakaty
Registered in England and Wales, company number 16958208
Registered office: Suite Ra01, 195-197 Wood Street, London, England, E17 3NU
Email: support@zakaty.ai
Website: https://zakaty.ai

1. Information we collect

We collect the following categories of personal information, depending on how you use the Platform:

• Identity and contact information — your name, email address and, where you provide it, phone number and postal address.
• Account information — login credentials, account preferences and other information associated with your account if you register with us.
• Donation and payment information — the amount, date, frequency and recipient charity of your donations, your chosen payment method, and Direct Debit details where you set up recurring giving. Card and bank details are collected and processed by our regulated payment provider; Zakaty does not store your full card number or bank credentials.
• Gift Aid information — your Gift Aid declaration, name, home address and confirmation of UK taxpayer status, which we may be required to record and share for HMRC purposes.
• Calculator inputs — the asset and liability figures you enter into the Zakat calculator. You can use the calculator without creating an account, in which case inputs are not linked to your identity where technically practicable.
• AI companion conversations — questions, prompts and other information you provide to our AI companion and the responses generated. We use Amazon Bedrock, provided by Amazon Web Services (AWS), to process AI requests and generate responses. Depending on how the Platform is configured, related information may also be processed through other AWS services used to operate, secure and monitor the Platform.
• Technical and usage information — IP address, device type, operating system, browser type, app version, language and general device settings, pages or screens viewed, features used, interactions with the Platform, approximate location derived from IP address where applicable, and information about errors or crashes.
• Mobile application information — information associated with your use of our mobile applications, such as app installation and update information, device identifiers or similar technical identifiers where used, push notification tokens where you enable notifications, and diagnostic information necessary to operate, secure and improve the application.
• Cookies and similar technologies — we use cookies, software development kits (SDKs), local storage and similar technologies to operate the Platform, remember preferences, understand usage and, where applicable, measure the effectiveness of communications and services.

We do not intentionally ask you to provide special category personal data unless it is necessary for a specific service or required by law. However, some information you choose to provide or actions you take on the Platform may reveal or suggest sensitive information, including information concerning religious beliefs. Where applicable, we will process such information only where a lawful condition under applicable data protection law permits us to do so.

Please do not provide sensitive personal information to the AI companion or in support requests unless it is necessary for your question or request. You should also avoid providing passwords, payment-card numbers or other confidential credentials in AI conversations or free-text fields.

2. How we use your information and our lawful bases

UK GDPR requires us to have a lawful basis for every use of your personal information. These are the purposes for which we process your data and the basis we rely on for each:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that they are not overridden by them. You can ask us for details of these assessments at any time.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew it.

3. Who we share your information with

We never sell your personal information. We share it only where necessary to provide our services, comply with the law, protect our users or operate and improve the Platform:

• Recipient charities — when you donate, we share your name, donation details and, where applicable, your Gift Aid declaration with the charity you have chosen, so they can process your donation, claim Gift Aid and meet their own record-keeping obligations. If you donate anonymously where that option is available, we share only what is required for the payment and any Gift Aid claim.
• Payment providers — our regulated payment provider processes your payment details under its own privacy policy and security standards. Zakaty does not receive or store your full payment-card details where the payment provider handles those details directly.
• HMRC — Gift Aid declaration records may be shared with HM Revenue & Customs in connection with Gift Aid claims, compliance and audits.
• Amazon Web Services (AWS) — we use AWS cloud services to host, operate, secure and support parts of the Platform. This includes Amazon Bedrock, which we use to process AI requests and generate responses for our AI companion.
• AI model providers through Amazon Bedrock — Amazon Bedrock provides access to foundation models from Amazon and third-party model providers. Our use of Amazon Bedrock is subject to AWS's applicable privacy and security terms. AWS states that customer inputs and outputs provided through Amazon Bedrock are not used to train the underlying foundation models unless the customer consents.
• Other service providers — hosting, cloud infrastructure, analytics, email, customer-support, security, payment, database and other technology providers who process data on our behalf under appropriate contractual and security arrangements.
• App store and platform providers — where necessary for distribution, operation, security or updates of our mobile applications, information may be processed by Apple, Google or other platform providers in accordance with their own privacy policies and applicable terms.
• Legal and regulatory bodies — where we are required to do so by law, court order, regulation or lawful request, or where necessary to protect our rights, users or others.
• Business transfers — if Zakaty or substantially all of its assets are acquired, merged, reorganised or transferred, personal information may be transferred as part of that transaction, subject to applicable legal requirements.

International transfers

Some of our service providers may be located outside the UK. Where personal data is transferred internationally, we take appropriate steps to ensure that the transfer is lawful and that suitable safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses, or another lawful transfer mechanism.

4. Marketing and fundraising communications

We will only send you marketing or fundraising communications where we have a lawful basis to do so. Where consent is required, we will ask for it separately and you can withdraw it at any time.

Where applicable law permits us to contact existing supporters about similar services or charitable activities without obtaining separate consent, we will provide a clear opportunity to opt out when your details are collected and in subsequent communications.

You can opt out of marketing or fundraising communications at any time by emailing support@zakaty.ai, using the unsubscribe link in an email, or using the relevant communication preferences available through the Platform.

Opting out of marketing does not affect service messages that we need to send you, such as account security notices, donation confirmations, receipts, Direct Debit notifications, important changes to our services or legal notices.

5. How long we keep your information

• Gift Aid records — for the period required by applicable HMRC rules and tax legislation.
• Donation and payment records — for the period required by applicable financial, tax and legal record-keeping obligations.
• Account information — for as long as your account is active, then deleted or anonymised within a reasonable period after closure unless we must keep particular information for legal, regulatory, fraud-prevention or other legitimate purposes.
• Calculator inputs (not linked to an account) — processed to produce your result and not intentionally retained as identifiable personal data after the calculation, subject to temporary technical logs or backups where applicable.
• AI companion conversations — retained only for as long as reasonably necessary to provide, secure and improve the service. Where our systems retain identifiable conversations, we aim to retain them for no longer than 24 months unless a longer period is required or permitted by law.
• Technical, diagnostic and usage information — retained for as long as reasonably necessary for security, troubleshooting, analytics and service improvement, subject to applicable legal requirements.
• Support correspondence — retained for as long as reasonably necessary to resolve your enquiry, maintain appropriate records and deal with potential disputes or legal obligations.

Where retention periods expire, data is securely deleted or irreversibly anonymised where reasonably practicable.

Where AI requests or responses are processed through Amazon Bedrock, AWS may process service-related information in accordance with its applicable service terms and documentation. Our own retention of AI conversations and related information is governed by the retention practices described above.

6. How we protect your information

We use appropriate technical and organisational measures to protect your personal information, taking into account the nature of the information and the risks involved. These measures may include encryption in transit and at rest, access controls, authentication, restricted staff access, monitoring, backups and security reviews.

Payment details are handled by our PCI DSS compliant payment provider where applicable. We do not store full payment-card details unless expressly stated otherwise.

We use security controls provided by our cloud and technology infrastructure providers, including AWS where applicable, together with our own access controls and security measures.

No website, application, electronic transmission or storage system is completely secure. If we become aware of a personal data breach, we will assess the incident and take the steps required by applicable data protection law, including notifying the ICO and affected individuals where legally required.

7. Your rights

Under UK GDPR and other applicable data protection laws, you may have the following rights over your personal information:

• Right to be informed — to know how your data is used, which this policy provides.
• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to ask us to delete your data, subject to legal retention obligations and other lawful exceptions.
• Right to restrict processing — to limit how we use your data in certain circumstances.
• Right to data portability — to receive certain personal data in a structured, commonly used and machine-readable format.
• Right to object — to object to processing based on legitimate interests and to direct marketing at any time.
• Right to withdraw consent — where we process your information based on consent, you can withdraw that consent at any time.
• Rights relating to automated decision-making — where applicable law provides such rights. We do not use your information to make solely automated decisions that produce legal or similarly significant effects about you. Our AI companion provides information and does not make such decisions.

To exercise any of these rights, email support@zakaty.ai. We may need to verify your identity before completing certain requests. We will normally respond within one month, subject to any lawful extension. There is normally no fee unless applicable law permits us to charge one.

8. Children's privacy

The Platform is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@zakaty.ai and we will take appropriate steps to delete the information where required.

Users under 18 should use the Platform only with the involvement and consent of a parent or legal guardian where required by applicable law. Certain features, including account creation and donations, may be restricted to users aged 18 or over as described in our Terms and Conditions.

9. How to make a complaint

If you are unhappy with how we have handled your data, we encourage you to contact us first at support@zakaty.ai so we can attempt to resolve the matter.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, the website, mobile applications, legal requirements or our privacy practices. We will update the "Last updated" date and version number when changes are made.

Where changes are significant, we will take reasonable steps to notify you, such as by email if you have an account or by displaying a prominent notice through the Platform.

We encourage you to review this policy periodically to understand how we handle your personal information.

11. Contact us

For any questions, requests, or concerns about this Privacy Policy or how we handle your data:

Email: support@zakaty.ai
Website: https://zakaty.ai

Zakaty is committed to the responsible stewardship of your data — treating it as the trust it is.