Privacy Policy

Who we are

Masjid Application Suite ("MAS") gives mosques a website, online donations with Gift Aid, event registration and room bookings, all run from one dashboard. In this policy "we" means the team that runs MAS, and we operate under UK data-protection law (the UK GDPR and the Data Protection Act 2018).

Two groups of people use MAS: mosque teams, who sign in to manage their mosque's workspace, and members of the public, who visit a mosque's website to donate, register for an event or ask to book a room. When you give information on a mosque's website, it goes to that mosque; MAS stores it and runs the website for them.

Information we collect

• Your account: your name and email address, and your password, which is stored only in scrambled (hashed) form. You can instead sign in with a link sent to your email address, or with your Google account, in which case Google gives us your name, email address and profile picture.
• Sign-in records: for each device you are signed in on, its IP address and browser, so the session can be recognised and ended.
• Mosque workspaces: the mosque's details, the people in its workspace and their roles, its website's content and images, its plan and payments to MAS, and the domains and email addresses it sets up.
• Donations made on a mosque's website: your name, email address, the amount, the campaign, whether the donation is one-off or monthly, and any message you add. If you add Gift Aid: your home address (first and second lines, town and postcode), your confirmation that you are a UK taxpayer, whether your declaration also covers the past four years and future donations, and when you made it.
• Event registrations: your name, email address, phone number (if you give it), how many people are coming, any notes, and the payment for a paid event.
• Booking requests: your name, email address, phone number (if you give it), what you want to book and when, any notes, and any deposit or balance you pay.
• The contact form on masjidappsuite.com: your name, email address, phone number (if you give it), the topic and your message.
• Technical information: your IP address and browser, used to protect sign-in and the public forms from abuse (for that we keep only a scrambled form of them), and how pages are used, where analytics is switched on (see Analytics, cookies and other services).

How we use your information

• To run the service: host mosque websites, take payments, record donations, Gift Aid declarations, event registrations and booking requests, and make them available to the mosque they were made to.
• To send the emails you would expect: sign-in links, receipts, and messages about your event registration or booking.
• To keep MAS secure: recognise signed-in devices, and slow down repeated attempts to sign in or submit forms.
• To answer you when you contact us.
• To understand how MAS is used and to find and fix errors.

We do not sell personal data.

Donations and Gift Aid: who receives your details

Your name, home address and Gift Aid declaration are the most sensitive information MAS holds, so this is everyone who receives them.

• The mosque you gave to. The owners, administrators and finance members of its MAS workspace can see your donation and your Gift Aid declaration, and can download them for the mosque's Gift Aid claim: as a spreadsheet, and as a draft of the file HMRC's Charities Online service accepts. No other mosque on MAS can see them.
• HMRC, only when the mosque claims Gift Aid on your donation. The claim includes your name, the first line of your address, your postcode, and the date and amount of each donation. The mosque sends it to HMRC itself: MAS does not send your declaration to HMRC.
• Stripe, which takes the payment. The card details you enter go straight to Stripe and never reach MAS. For a one-off donation, MAS gives Stripe your email address (for Stripe's receipt) and whether you asked for Gift Aid, but not your name or address. For a monthly donation, MAS gives Stripe your name, email address, Gift Aid home address, your taxpayer confirmation, what your declaration covers and any message you added. Stripe keeps these with your monthly donation, so that each month's payment can be recorded with your declaration.
• Our payment-event relay. Stripe tells MAS about each payment by sending it an event, and those events can pass through a relay we run, which keeps a copy of each one. An event carries what MAS gave Stripe with the payment: for a monthly donation, everything in the point above.
• Brevo, which delivers your receipt. The receipt email has your name and email address, the amount, campaign and date, whether a Gift Aid declaration was recorded, and your message, but not your address.
• MongoDB Atlas, which hosts MAS's database, where your donation and declaration are stored.

MAS keeps Gift Aid evidence that is part of a claim for at least six years after the end of the period the claim covers, or of the mosque's accounting period if that ends later. After that the mosque is asked to review it, and can remove donors' details from the claim's stored spreadsheet and HMRC file once no tax, legal or other need to keep them remains. Donation and Gift Aid declaration records themselves are not deleted automatically; to ask for yours to be deleted, see Your rights.

Who else receives information

Inside MAS, information given on a mosque's website is shown only to the members of that mosque's workspace whose role covers it, and never to another mosque. Outside MAS, these services receive personal data so that MAS can work:

• Stripe takes every payment on MAS: the plans, add-ons and domains mosques buy, and donations, event places and booking payments on mosque websites. It receives the card details you enter, straight from your browser; the email address of the account or the person paying; and, for a monthly donation, the details listed under Donations and Gift Aid.
• Our payment-event relay receives the events Stripe sends MAS about payments, carrying what MAS gave Stripe, and keeps a copy of each.
• Brevo delivers MAS's emails: sign-in links, receipts, event and booking messages, and messages sent through our contact form. It receives each recipient's name and email address and what the email says.
• Vercel runs MAS and the mosque websites: everything you send MAS, and your IP address, passes through its servers. Vercel Blob stores the pictures and logos uploaded to mosque websites.
• MongoDB Atlas hosts MAS's database, where the information in this policy is stored.
• PostHog measures how MAS and the mosque websites are used, and receives your name and email address when you create an account or start a subscription (see Analytics, cookies and other services).
• Google, if you choose to sign in with Google: it confirms who you are and gives MAS your name, email address and profile picture, and it knows that you signed in to MAS.
• Google Tag Manager is loaded on every page and receives your IP address and browser details.
• Google Fonts, Adobe Fonts, Google Maps and unpkg.com receive your IP address and browser details when your browser fetches typefaces, or the home page map, from them.

Domains that mosques buy through MAS are registered in MAS's name, with MAS's own contact details, so no one's personal details go to the domain registrar.

Analytics, cookies and other services

MAS uses cookies to keep you signed in and to remember which mosque workspace you are editing.

On the live site, PostHog records how MAS and the mosque websites are used (pages viewed, clicks and errors) and sets a cookie to recognise a returning browser; its requests go through MAS's own web address. When you create an account, and when you start a subscription, your name and email address are attached to what it records for you. Errors on MAS's servers are reported to it too.

Google Tag Manager is loaded on every page of MAS and of the mosque websites, so Google receives your IP address and browser details.

Your browser also fetches a few things directly from other services, which receive your IP address and browser details when it does: the typefaces on MAS and the mosque websites come from Google Fonts and Adobe Fonts, and the map on the masjidappsuite.com home page comes from Google Maps, with its marker pictures from unpkg.com.

Keeping data safe

Each mosque's information is kept to its own workspace and shown to its members according to their role. Connections to MAS are encrypted, and passwords are stored only in hashed form. No system is perfectly secure, so tell us straight away if you think your account has been misused.

Your rights

Under UK data-protection law you can ask for a copy of your personal data, ask for it to be corrected or deleted, object to some uses of it, and complain to the Information Commissioner's Office (ico.org.uk). For information you gave on a mosque's website you can also ask that mosque. A mosque may need to keep Gift Aid records for the period above even after you ask. To make a request, email us at info@connextar.com.

Changes to this policy

We update this policy when what MAS does with personal information changes. The date at the top shows when it last changed.

Contact us

Questions about this policy or your information? Email us at info@connextar.com.