Privacy Policy

This policy covers information collected through this website by The Umrah Store.

It does not cover conversations that take place on WhatsApp, phone calls, or anything you send us by email outside this site, although we treat information received that way with the same care.

We collect only what a form actually asks for. Nothing on this site collects information silently in the background.

Depending on which forms you use, that may include:

To reply to you and to arrange what you have asked us to arrange. That is the purpose behind every field on this site.

Specifically: to price and prepare a quotation, to check availability with hotels and suppliers, to prepare and submit visa documentation on your behalf where that is what you have asked for, to arrange flights and transport, to review a trade partnership application, and to keep a record of what was requested and what was agreed.

We also use your email address to confirm that an account belongs to you before it can be used.

We do not sell your information.

We do not use it for advertising, and this site carries no advertising or third-party tracking scripts.

We do not send marketing email off the back of an enquiry. Email sent by this site is operational: an email verification link to you, and an internal alert to our own team telling them a request has arrived.

Uploaded documents are treated as the sensitive material they are.

They are stored outside the publicly served area of this website. There is no public address that will return one, and they are not indexed by search engines.

They can be opened only through an authenticated administrative screen by our own team. Every request for a document is checked against an administrator session first.

We check the actual content of each uploaded file rather than trusting its name or extension, and we enforce a size limit. Files that are not an accepted document type are refused.

Passwords are stored using a one-way hash with a per-account salt. They are never stored in readable form, never written to logs, and never shown on any screen — including our own administrative screens.

Because of that, nobody here can tell you your password. If you lose it, it has to be replaced rather than looked up.

Email verification links are stored only as a hash. The link itself exists only in the email we send you. Each link works once and expires.

Sessions are held in a signed cookie. Customer sessions and administrator sessions are signed separately, so one can never be used in place of the other.

Every screen that shows your requests looks them up by the account you are signed in as, taken from your session — never from anything in the page address.

Changing an identifier in the address bar will not show you another customer's request, and a customer account cannot reach any administrative screen.

We reply using the contact details you give us. If you give us a WhatsApp number and start a WhatsApp conversation, that conversation takes place on WhatsApp and is subject to WhatsApp's own privacy practices.

Our own team receives an internal notification when a request arrives. Where email delivery is configured, that notification is also emailed to our business address. Those internal alerts contain your name and contact details so we can act on the request.

This site sets a cookie only when you sign in — one for a customer session, one for an administrator session. They exist so that you stay signed in as you move between pages.

There are no advertising cookies, no analytics cookies and no third-party trackers on this site, which is why you are not asked to accept any.

We keep enquiries, applications and quotations as a record of what was asked for and what was arranged, because we may need to refer back to them.

If a customer account is deleted, the requests already sent from it are kept as records but are no longer linked to an account.

You can ask us to remove information we hold about you, and you can ask us what we hold. Contact us using the details on the Contact page and we will deal with it.

To arrange what you have asked for, we share what is necessary with the hotels, airlines, transport operators and visa processing channels involved — for example a traveller name and passport detail where a booking or a visa application requires it.

We share what the arrangement needs and no more. We do not pass your details to anyone for their own marketing.

You do not need an account to use this site. Every form works as a guest.

You choose which optional fields to complete, and you choose whether to upload a document. Where a document is genuinely required for an application, the form says so.

You can ask us to correct anything we hold about you, and you can withdraw a request at any time before it becomes a confirmed arrangement.

If we change how this site handles information, we will update this page and the review date at the top of it.

For any question about this policy, or to ask what we hold about you, please contact us. Our phone number, WhatsApp number and email address are on the Contact page and in the footer of every page.