Privacy Policy — AmanahSuite

AmanahSuite (“we”, “our”, or “us”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The nature of our service requires us to process sensitive personal data, including information about your family, assets, religious beliefs, and end-of-life wishes. We treat this data with the highest standards of care, confidentiality, and security.

1. Who we are

AmanahSuite is the data controller for personal data processed through our platform. Contact us at: privacy@amanahsuite.com

2. What data we collect

Account data

Email address (required for account creation)
Full name (optional, shown in your will document)
Authentication data (password hash stored by Supabase; we never see your password)
Google OAuth data if you sign in with Google

Will content

Family structure: marital status, number and gender of children, status of parents and siblings
Assets and estimated values
Debt information
Names and contact details of guardians, executors, and bequest recipients
Janazah (funeral) instructions
Personal messages to family members

Usage data

Pages visited within the application (server logs only)
Browser type and operating system
IP address (retained for up to 30 days)

Payment data

Payments are processed by Stripe. We do not store your card details. We receive confirmation of payment status and your Stripe customer ID.

3. Legal basis for processing

Contract performance: processing account data and will content to provide the service you have signed up for.
Legitimate interests: processing usage data to maintain and improve the platform, and to detect fraud or abuse.
Legal obligation: processing data where required by law.

Will content — including family data, asset information, and religious preferences — is processed on the basis of explicit consent, which you provide when you create and save your will. You may withdraw this consent at any time by deleting your account.

4. How we use your data

To create, store, and display your Islamic will
To calculate Faraidh inheritance shares based on your family structure
To generate PDF documents of your will
To send transactional emails (account confirmation, password reset)
To process subscription payments
To improve the platform and fix issues

We never sell your data, share it with advertisers, or use it to train AI models.

5. Data storage and security

Your data is stored on Supabase (hosted on AWS in EU-West regions). All data is encrypted at rest and in transit (TLS 1.3). Row-Level Security (RLS) policies ensure you can only access your own data — even at the database level.

PDF documents are generated on-demand and are never stored on our servers. They are generated fresh each time you download.

6. Data sharing

We share data only with these third-party processors, all under data processing agreements:

Supabase — database and authentication (EU-West)
Stripe — payment processing
Vercel — hosting and edge functions

7. Data retention

Active accounts: data retained for the duration of your account
Deleted accounts: all personal data deleted within 30 days of account deletion
Server logs: deleted after 90 days

8. Your rights

Under UK GDPR, you have the right to:

Access: request a copy of your personal data
Rectification: correct inaccurate data
Erasure: delete your account and all associated data
Portability: receive your data in a machine-readable format
Restriction: limit how we process your data
Objection: object to processing based on legitimate interests

To exercise these rights, email privacy@amanahsuite.com. We will respond within 30 days.

9. Cookies

We use only essential cookies: session cookies for authentication (managed by Supabase) and security cookies. We do not use tracking or advertising cookies.

10. Changes to this policy

We will notify you by email of any material changes to this Privacy Policy. Continued use of the service after notification constitutes acceptance.

11. Contact and complaints

If you are unsatisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.