Musafir Charity Program

When you create an account, we collect:

• Full name (first and last)
• Email address
• Phone number (optional)
• Account password (stored in encrypted form by Supabase Auth)

When you submit a donation, we collect:

• Donation amount
• Payment method
• Transaction reference number
• Payment screenshot (uploaded image file)
• Submission timestamp

We do not collect payment card details, bank account numbers, or any payment credentials. All payments are made through third-party channels outside the Platform.

We use your personal information for the following purposes:

• Account management — to create and maintain your account on the Platform.
• Donation verification — to allow administrators to review and verify your submitted donation evidence.
• Email notifications — to inform you when your donation is verified, rejected, or allocated to a cause.
• Audit trail — to maintain an immutable record of donation activity for transparency purposes.

We do not use your information for advertising, profiling, or any commercial purpose.

Certain aggregated, non-identifiable data is displayed publicly on the Transparency Dashboard, including total donations raised, number of verified donations, and fund allocation records. Individual donor identities are never displayed publicly.

Donation receipt pages (accessible via a public link you choose to share) display only the donation reference, amount, and verification status. They do not display your name or contact details.

Your data is stored securely using Supabase, a managed database and authentication platform. All data is encrypted in transit (TLS) and at rest.

The Platform implements Row Level Security (RLS) at the database level, which means each user can only access their own records. Administrators have read access to donation records for the purpose of verification, but cannot access your password.

Payment screenshots are stored in an isolated, access-controlled storage bucket and are accessible only to verified administrators and to you via your authenticated session.

We do not sell, rent, or trade your personal information to any third party.

We share data only with the following service providers, strictly for the purpose of operating the Platform:

• Supabase — database, authentication, and file storage
• Vercel — application hosting and edge delivery
• Resend — transactional email delivery

We may disclose your information if required to do so by law or in response to a valid legal request from competent authorities.

Your account data and donation records are retained for as long as your account is active. Audit log records (verification decisions, fund allocations) are retained indefinitely as they form part of the permanent transparency record of the Platform.

If you request account deletion, your personal details (name, email, phone) will be removed. Donation amounts and anonymised audit records may be retained to preserve the integrity of the public transparency record.

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of your account and personal data (subject to retention obligations above)
• Withdraw consent to email communications at any time

To exercise any of these rights, please contact us at charity@3musafir.com.

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Platform after changes are posted constitutes your acceptance of the revised policy.

If you have any questions or concerns about this Privacy Policy, please contact us at charity@3musafir.com.