Privacy Policy for Zakatek

Effective Date: 2026-10-05

At Zakatek ("we", "us", "our"), accessible from https://zakatek.app, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform for crowdfunding and donation management.

If you have questions or concerns, contact us at privacy@zakatek.app.

1. Information We Collect

We collect personal information that you voluntarily provide when you register, make a donation, create a project, or communicate with us.

• Account Data: name, email address, password hash, profile image, role preferences.

• Donation Data: donation amount, currency, project supported, transaction ID, recurring donation plan details (frequency, billing cadence), and donor location (optional). Payment card numbers, CVV, and expiry are never stored by Zakatek — these are processed and vaulted exclusively by Square. We do store card descriptors (card brand, last four digits, expiry month and year) returned by Square solely to display your saved payment method in your account dashboard. For card donations, we also record the amount and currency you were shown, the exchange rate used, and the amount charged in US dollars, so your receipt matches what you saw at checkout.

• Recurring Support Data: if you enroll in recurring giving, we store a Square subscription ID, a Square customer ID, and a Square card vault token (an opaque reference — not raw card data) to enable ongoing billing. Square's cardholder data environment is PCI-DSS certified.

• Project Data (for campaign creators): organisation name, tax ID (if applicable), bank account details for payouts, project description, updates, photos.

• Usage Data: IP address, browser type, operating system, referring URLs, pages visited, date/time stamps. We also use your IP address to determine your approximate country (see "Currency display" in Section 2).

• Communication Data: emails, support tickets, survey responses.

We also collect non-personal information aggregated for analytics (e.g. number of visitors per page).

2. How We Use Your Information

We use your information to:

• Create and manage your account.

• Process one-time and recurring donations and payouts.

• Manage your recurring support commitments, including pausing, resuming, and cancelling subscriptions on your instruction.

• Verify eligibility for Zakat compliance.

• Communicate project updates, receipts, and service announcements.

• Suggest showing amounts in your local currency.

• Improve our platform (analytics, debugging).

• Comply with legal obligations (anti-money laundering, tax reporting).

Currency display. When you first visit, we may suggest showing amounts in your local currency. To do this, we look up the country your IP address belongs to in a database stored on our own servers (MaxMind GeoLite2). Your IP address is not sent to MaxMind or anyone else for this, and the country is not stored or logged. We only suggest; we never change your currency unless you choose to. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your data based on:

• Contract performance: to provide the service you requested.

• Legitimate interests: to improve security, prevent fraud, analyse usage, and present amounts in a currency familiar to you.

• Consent: for marketing communications and analytics cookies (you can opt out anytime).

• Legal obligation: for tax or anti-fraud reporting.

4. Sharing Your Information

We do not sell your personal data. We share it only in these limited circumstances:

• Payment Processors: Square — to process one-time and recurring card payments, vault payment methods, and manage subscriptions. Square receives payment and card data and is PCI-DSS certified. NCBA — to process M-Pesa STK push payments for KES donations.

• Service Providers: hosting (GCP), email delivery (Google Mail), analytics (Google Analytics) — under confidentiality agreements.

• Legal Compliance: if required by law or to protect rights and safety.

• Business Transfers: in case of merger or acquisition (you will be notified).

5. Cookies and Tracking Technologies

We use cookies for essential functions (authentication, session management) and to remember your preferences. With your permission, we also use Google Analytics cookies to understand how the site is used and improve it.

Analytics cookies are only set if you choose "Accept analytics" in our cookie banner. Declining doesn't affect how the site works. You can change your choice at any time from Cookie settings at the bottom of every page. You can also block or clear cookies in your browser settings, but some features, such as signing in, need them.

We use the following storage. The functional items are not used for advertising or tracking and are not shared:

NameTypePurposeDurationzk_currencyCookieRemembers the currency you chose1 yearzakatek_currency_recentLocal storageLists your recently used currencies firstUntil you clear browser datazakatek_currency_suggestion_checkedSession storageChecks for a currency suggestion at most once per visitUntil you close the browserzk_consentCookieRemembers whether you accepted or declined analytics cookies1 year_ga, ga<id>Cookie (Google Analytics)Distinguishes visits for usage statistics. Set only after you accept analytics; removed if you later declineUp to 2 years

6. Data Retention

We retain your account data as long as your account is active plus 3 years for backup, legal, or fraud prevention purposes. Donation and recurring support records are kept for 7 years to comply with tax laws. Card descriptor data (brand, last four digits, expiry) is retained while your payment method is active and deleted upon your request or when no active subscriptions reference it. The country used for currency suggestions is not retained. The currency preference cookie expires after one year. You may request deletion of your data, subject to legal retention obligations.

7. Your Rights

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data.

• Object to or restrict processing.

• Data portability.

• Withdraw consent at any time.

Submit requests to admin@zakatek.app. We will respond within 30 days.

8. Children's Privacy

Our service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with data, contact us to remove it.

9. Security

We implement industry-standard measures (encryption in transit via TLS, hashed passwords, access controls) but cannot guarantee absolute security. Card numbers and CVV are never transmitted to or stored on Zakatek servers — all card entry is handled via Square's Web Payments SDK, which renders a PCI-compliant iframe. In case of a data breach, we will notify affected users and regulators as required by law.

10. International Data Transfers

Your data may be stored on servers in the United States or the European Union. For transfers outside your jurisdiction, we rely on Standard Contractual Clauses or adequacy decisions.

11. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via email or a prominent notice on our website. The "Effective Date" at the top indicates when the policy was last revised.

12. Contact Us

Zakatek
Email: admin@zakatek.app