Privacy policy
Last updated 7 October 2026
This policy explains how SDQA CIC looks after your personal data and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018). SDQA is a UK Community Interest Company, not a charity. By law, our profits go back into the work.
Who is responsible for your data
The data controller is SDQA CIC, company number 16543744, registered office Concorde Road, Concorde Park, Maidenhead, England, SL6 4BY. If you have any question about this policy or your data, contact us at support@sdqa.org.uk.
The personal data we collect and why
We only collect what we need to run SDQA and to do what you have asked us to do. The table below sets out each kind of data, what we use it for, and our lawful basis for that use.
| Data | Why we use it | Lawful basis |
|---|---|---|
| Account details: your email, name, phone number, portfolio name, and country. | To create and run your SDQA account, identify you when you sign in, and contact you about your giving. | Contract (to provide the account you asked for). |
| Giving and allocation records: the projects you funded, amounts, shares, and your wallet balance and ledger. | To process your giving, allocate it to projects, keep your wallet and statements accurate, and report delivery back to you. | Contract, and legal obligation where financial records must be retained for accounting. |
| Payment reference: your Stripe customer reference. SDQA does not store your full card number; card details are handled by Stripe. | To take payment securely and match it to your account. | Contract. |
| Attribution and device data tied to a giving action: UTM campaign tags, referrer, your IP address, and browser user-agent. | To understand which of our campaigns brought you here so we can run them responsibly, and to help detect fraud or abuse. | Legitimate interests (measuring our own campaigns and protecting the platform), balanced against your rights. The marketing cookies that also produce this kind of data load only with your consent (see the cookie policy). |
| Sign-in credentials: session tokens and magic-link tokens issued to your email. | To keep you securely signed in and to let you sign in by email. | Contract, and our legitimate interest in account security. |
| Goals, scheduled giving, milestones, and notification read-state. | To run the features you use: savings goals, recurring giving, progress milestones, and your notifications. | Contract. |
| Signature enquiry details: name, email, and phone, if you make a high-value or bespoke enquiry. | To respond to your enquiry and arrange the conversation you asked for. | Legitimate interests, or steps taken at your request before any agreement. |
| Newsletter and programme interest: your email if you join the newsletter or register interest in a programme such as Amana. | To send you the updates you asked for. | Consent (you can unsubscribe at any time). |
| Sawtuk, our free recitation app: your recordings stay on your own device. If you choose to sign in and sync, we store your email, your recordings, and which surah and ayahs each one covers. | To send you a sign-in link and let you reach your recordings on another device. Only you can open or delete them. | Contract (to provide the sync you asked for). |
| Khatmah, our free Quran reading app: your email, the name you choose, your weekly reading commitment, any pledge you set, the clubs you join, and the Juz you log. | To run your reading and your clubs. Other people see only totals: the community counter and each club's member count and progress. Your name, your pledge and the Juz you log are visible only to you. | Contract (to provide the app you signed up for). |
We do not knowingly collect data from children. SDQA is intended for adults who give or support our projects.
How long we keep your data
We keep your data only for as long as we need it. Account, giving, and wallet records are kept while your account is active and for as long as we are required to keep financial records for accounting and tax. When a legal duty means we must retain a financial record, we keep the minimum needed and remove or anonymise the rest. Sign-in tokens and magic links are short-lived and expire automatically. Campaign attribution data is kept only as long as it is useful for measuring the campaign it relates to.
Data in our free apps, Sawtuk and Khatmah, is kept until you delete it or ask us to close your app account. Recordings you keep only on your own device never reach us.
Who we share your data with
We do not sell your data. We share it only with the service providers who help us run SDQA, and only as far as they need it to do their job. Each is bound by a data-processing agreement. Our providers are:
- Supabase: Database and authentication hosting.
- Vercel: Website hosting and delivery.
- Stripe: Payment processing.
- Resend: Transactional email (for example sign-in and receipts).
- Mailchimp: Newsletter email, if you subscribe.
- Sanity: Content management for the project pages.
- Sentry: Error monitoring to keep the site working.
Some of these providers may process data outside the UK. Where that happens, we rely on the safeguards UK law requires, such as the UK International Data Transfer Agreement or an adequacy decision.
Data from our free apps, Sawtuk and Khatmah, is stored with Supabase in the EU (Ireland). Sawtuk also loads fonts from Google Fonts and Quran text from Quran.com; those services receive your device's IP address when the app loads.
Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, the right to be forgotten (see below);
- restrict how we use your data;
- data portability, to receive your data in a usable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where we relied on your consent;
- not be subject to a decision based solely on automated processing.
To exercise any of these, contact us at support@sdqa.org.uk. We will respond within one month.
Right to erasure (right to be forgotten)
You can ask us to delete the personal data we hold about you. When you do, we remove your account and the personal data linked to it across our systems. Where a financial record must be kept for a legal accounting reason, we anonymise it rather than delete it, so it can no longer identify you, and we record why. Our internal procedure for handling an erasure request is documented and followed for every request. To make a request, contact us at support@sdqa.org.uk.
To close a Sawtuk or Khatmah account, email support@sdqa.org.uk from the address you signed in with. We will delete your app account, your Khatmah records and your Sawtuk recordings within one month and confirm when it is done.
Cookies and tracking
We use a small number of essential cookies to run the site, and, only with your consent, marketing and analytics cookies to measure our campaigns and improve the site. No non-essential cookie is set until you opt in; our Google tags run in Google Consent Mode and send only cookieless signals before then. The full detail, and how to change your choice, is in our cookie policy.
How to complain
If you are unhappy with how we have handled your data, please tell us first at support@sdqa.org.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk.
Changes to this policy
We may update this policy. When we do, we will change the date at the top of the page. Significant changes will be highlighted on the site.