Privacy Policy

This Privacy Policy applies to personal information processed in connection with:

• Our public websites and marketing pages (including https://duha.appand related domains);
• The Duha masjid / organization admin dashboard and APIs (subscription software for Islamic centers and nonprofits);
• The Duha community mobile applicationsfor iOS and Android (the “Community App”), including push notifications, in-app giving, prayer times, events, and related features;
• Customer support, onboarding, billing, and communications related to the above.

Together, these are the “Services.” If a product feature has additional privacy notices (for example in-app permission prompts), those notices apply in addition to this policy.

Organization accounts. When a masjid, Islamic center, or other organization (“Organization”) uses Duha to store member, donor, volunteer, student, or similar records, that Organization generally determines why and how that Customer Content is processed. In that case the Organization is the controller (or equivalent) of Customer Content, and Duha processes it on the Organization's instructions to provide the Services.

Duha accounts & product data. We are the controller of account, billing, support, security, and product-analytics data we collect about administrators, website visitors, and Community App users for our own operations (for example login emails, device diagnostics we collect, and marketing site analytics where enabled).

If you are a community member and believe an Organization has entered your information into Duha, contact that Organization first for access or deletion requests about Customer Content. You may also contact us at contact@duha.appand we will help route the request as appropriate.

Depending on how you interact with the Services, we may collect:

A. Information you provide

• Account and profile details (name, email, phone, password or SSO identifiers, role within an Organization);
• Organization details (name, address, branding assets, tax or nonprofit identifiers you choose to supply);
• Content you upload or create (messages, events, media, forms, member/donor records, school data, and similar Customer Content);
• Support requests, feedback, and survey responses;
• Marketing preferences and newsletter sign-ups on our website;
• Mobile numbers and messaging preferences when you or an Organization enroll you in SMS or voice communications (including opt-in / opt-out status).

B. Information collected automatically

• Log and usage data (pages or screens viewed, features used, timestamps, referring URLs, approximate location derived from IP);
• Device and browser data (device type, OS, app version, browser, language, crash and performance diagnostics);
• Cookies, local storage, and similar technologies on our websites (see Section 10).

C. Information from others

• Organization administrators who invite you or import your contact details;
• Payment processors and identity providers when you connect payment or sign-in methods;
• App stores (Apple / Google) for purchase or install metadata where applicable.

The Community App is designed for end users of participating Organizations (prayer times, announcements, events, giving, and related community features). In addition to Section 3, the app may process:

• Push notification tokens to deliver alerts you enable (for example prayer reminders, event updates, or campaign messages from your Organization). You can disable notifications in device settings.
• Precise or approximate location only if you grant permission (for example nearby prayer times or mosque discovery). You may deny or revoke location access at any time in device settings; core features that do not require location will continue to work where possible.
• Camera, photos, or microphone only if you grant permission for features that need them (for example uploading media or scanning). We do not access these sensors without your action and OS permission.
• Contacts only if a feature explicitly requests access and you approve it.
• In-app purchases / giving: payment card data is processed by our payment partners; we receive confirmation, amounts, and related transaction metadata needed for receipts and Organization reporting, not full card numbers where the processor tokenizes payments.

App Store / Google Play listings and in-app permission dialogs describe the purposes for which permissions are requested. If you uninstall the Community App, some server-side account or donation history may remain until deleted under Section 9 or by your Organization.

WAQTO LLCoperates the Duha Communication Hub messaging program. Organizations may use Duha to send SMS text messages and automated voice calls to people who have opted in to receive those communications (for example prayer reminders, event announcements, program updates, and urgent community alerts). Messages are sent by WAQTO LLC on behalf of the Organization using WAQTO LLC's messaging infrastructure (including carrier partners such as Twilio).

Message frequency. Message frequency varies by Organization and program. Recipients typically receive a low volume of messages (for example up to four SMS messages per month for routine updates), with higher frequency only when the Organization sends time-sensitive or emergency notices. Exact frequency depends on the programs you join and the Organization's practices.

Message and data rates may apply. Standard message and data rates from your wireless carrier may apply to SMS and voice communications. WAQTO LLC and the Organization do not charge you a separate fee for receiving these messages, but your carrier may.

Mobile information is not shared for third-party marketing. WAQTO LLC does not sell, rent, or share mobile phone numbers or SMS/voice opt-in data with third parties or affiliates for their own marketing or promotional purposes. Mobile numbers are used only to deliver messages you (or your Organization, with your consent) requested, to operate and secure the Services, to honor opt-out requests, and as otherwise described in this Privacy Policy (including sharing with messaging carriers and subprocessors solely to transmit those messages).

Opt out and help. You may opt out of WAQTO LLC / Duha Organization SMS at any time by replying STOP to a message. Reply HELP for assistance. You may also update messaging preferences in your Community App or Organization profile where available, or contact WAQTO LLC / Duha at contact@duha.app. Opting out of SMS does not cancel other Services or email communications unless you also unsubscribe from those channels.

We use personal information to:

• Provide, operate, maintain, and improve the Services;
• Authenticate users, prevent fraud and abuse, and keep the Services secure;
• Process subscriptions, donations, and related receipts or reporting for Organizations;
• Send transactional messages (security alerts, billing, product updates). Marketing emails are sent only where permitted and with opt-out available;
• Deliver SMS, voice, and Community App notifications you or your Organization configure, subject to your consent and device settings;
• Analyze aggregated or de-identified usage to improve reliability and product design;
• Comply with law and enforce our Terms of Service.

We do not sell personal information as that term is commonly understood, and we do not share personal information for cross-context behavioral advertising except where a specific integration you enable requires it and we disclose that at the time.

We may share personal information with:

• Service providers who process data for us under contract (hosting, email/SMS/voice carriers, analytics, customer support, error monitoring, payment processing);
• Your Organization and its authorized admins when you use features tied to that Organization (including Community App activity visible to admins per their configuration);
• Professional advisors and authorities when required by law, legal process, or to protect rights, safety, and security;
• Business transfers in connection with a merger, financing, or sale of assets, subject to appropriate confidentiality.

We do not grant unrestricted public access to Customer Content. Organization admins control roles and sharing within their workspace. As stated in Section 5, we do not share mobile numbers with third parties for those parties' marketing.

Subscription billing and donation / payment flows are handled by third-party payment processors (for example card networks and payment platforms). Those processors process payment credentials under their own privacy policies. Duha receives transaction status, amounts, payer identity information needed for receipts and Organization ledgers, and similar metadata.

Organizations are responsible for the tax, nonprofit, and donor communication practices applicable to funds they collect through Duha.

We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Customer Content is retained according to the Organization's account status and our retention schedules; deleted data may persist in encrypted backups for a limited period.

We implement administrative, technical, and organizational measures designed to protect personal information (access controls, encryption in transit, monitoring). No method of transmission or storage is 100% secure; please use strong passwords and protect your devices.

Depending on your location, you may have rights to:

• Access, correct, or delete personal information;
• Export or receive a copy of certain data;
• Object to or restrict certain processing;
• Withdraw consent where processing is consent-based;
• Opt out of marketing emails via the unsubscribe link;
• Opt out of Organization SMS by replying STOP, or request help by replying HELP;
• Control cookies via browser settings (some cookies are required for login and security);
• Control Community App permissions (notifications, location, camera, etc.) in your device settings.

To exercise rights regarding Duha-controlled data, email contact@duha.app or use our contact form. We may need to verify your identity. For Customer Content held for an Organization, we may redirect you to that Organization or work with them to fulfill the request.

The Services are not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children under 13 for Duha's own purposes. Organizations that use Duha for youth programs (for example weekend school) are responsible for obtaining any parental consents required by law for the Customer Content they collect. If you believe we have collected a child's information inappropriately, contact contact@duha.app.

Duha is operated from the United States. If you access the Services from another country, your information may be processed in the U.S. or other countries where we or our processors operate. Those countries may have different data-protection laws than your own. Where required, we use appropriate safeguards for cross-border transfers.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we post a revision. Material changes may also be communicated by email, in-product notice, or Community App notice where appropriate. Continued use of the Services after an update means you acknowledge the revised policy.

WAQTO LLC (Duha platform)
Website: https://duha.app
Privacy inquiries: contact@duha.app
General contact: Contact form · contact@duha.app

Related: Terms of Service