Privacy Policy

Who we are

This policy covers the website whatisarbaeen.org ("we", "us"), a non-profit initiative providing free educational resources and practical guidance about Arbaeen and the pilgrimage to Karbala.

For any privacy question, or to have your data corrected or deleted, contact us through the contact page or by email at info@whatisarbaeen.org.

What we collect, and when

We only collect information you deliberately give us. We do not run advertising trackers, and we do not sell or rent anyone's data to anybody, ever.

If you register a moukib

• Moukib name (English and Arabic), organiser's name
• Route, pole/marker number, services offered
• Contact email, telephone number, website or social page
• Anything you write in the message field
• A one-way encrypted fingerprint of your IP address (used only to stop automated spam — it cannot be reversed into an address)

If you register as a pilgrim

• Your name, email, and optionally phone
• Country or city you travel from, route, party size, how you are travelling
• Anything you write in the message field

If you volunteer, message us, or join the app waitlist

• Name and email, and optionally phone and country
• Your skills, languages, area of interest, and your message

If you hold a member account

• Your username, email, and a securely hashed password (we never see or store your actual password)
• The annual records you choose to enter — for pilgrims: poles walked, days, companions; for mawakib: meals served, pilgrims hosted, and similar service figures
• Any private notes or reflections you save (visible only to you and site administrators)

What we publish — and what we never publish

For an approved moukib listing, only the following becomes public: the moukib's name (English and Arabic), its route and pole number, the services it offers, and — if you provided one — the public website or social page you chose to share.

Pilgrim registrations and annual records are never public. Your journey data is yours; we may use anonymous, aggregated totals (for example, "our members have walked 40,000 km between them") in reports, in a form that cannot identify any individual.

Why we hold this information (lawful basis)

• Consent — you chose to submit a form, and you may withdraw consent at any time by asking us to delete your data.
• Legitimate interests — verifying that a moukib listing is genuine before publishing it, protecting the site from spam and abuse, and keeping accurate records of our charitable activity.
• Contract — where you hold a member account, to provide the dashboard service you signed up for.

Who else can see data, by using this site

Some parts of the site load content from other companies. When your browser fetches that content, those companies necessarily receive your IP address and basic technical information. We do not share your form submissions with any of them.

• Our web host — stores the site and its database, and keeps standard server logs.
• Instagram / Meta — the Instagram feed on our home page and gallery is served by Instagram.
• Karbala TV (ktvlive.online) — supplies the live stream on our Live page. We do not control that service or its own data practices.
• Unsplash — hosts the photographs displayed across the site.
• Google Fonts — supplies the typefaces used for our text.
• jsDelivr — supplies the video player library used on the Live page.
• Akismet — checks submissions for spam.
• Email delivery — our mail provider transmits notification and password emails.

Cookies

We do not use advertising or analytics cookies, and there is no third-party tracking of your browsing on this site.

WordPress sets a small number of strictly functional cookies: a session cookie if you sign in to a member account, a "remember me" cookie if you tick that box, and a temporary cookie that checks whether your browser accepts cookies at all. Signing out clears them. Third-party embeds listed above may set their own cookies under their own policies.

How long we keep things

• Rejected or spam submissions — deleted promptly.
• Moukib listings — kept while the listing is active, and removed on request.
• Member accounts and annual records — kept while the account exists, so your history builds year on year. Deleted when you ask us to close the account.
• Contact messages and volunteer enquiries — kept while relevant to our work, then deleted.

How we protect it

• The site is served over HTTPS, so data in transit is encrypted.
• Passwords are stored only as one-way cryptographic hashes, using WordPress's standard mechanism. Nobody — including us — can read your password.
• We never send you a password by email. Account access is set through a single-use, expiring link that you control.
• Member accounts hold minimal permissions and cannot access the site's administration area.
• We do not process card or bank details on this website; any donation payments are handled by an external payment provider under their own security and privacy terms.

Your rights

You can ask us to: show you the data we hold about you; correct anything inaccurate; delete your data; stop using it; or provide a copy you can take elsewhere. Simply contact us — we will not ask you to justify the request, and there is no charge.

If you are in the United Kingdom and are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ico.org.uk). If you are elsewhere, your local data protection authority performs the same role.

International transfers & children

Our audience is global, and the services listed above may process data outside your own country, including outside the UK and EU.

This site is not directed at children under 13, and we do not knowingly collect their data. If a child's details reach us — for example within a family registration — tell us and we will remove them.

Changes to this policy

We will update this page whenever our practices change, and revise the date at the top. Significant changes affecting members will also be emailed to account holders.