Privacy Policy

This policy covers information collected through this website by The Umrah Store.

It does not cover conversations that take place on WhatsApp, phone calls, or anything you send us by email outside this site, although we treat information received that way with the same care.

We collect only what a form actually asks for. Nothing on this site collects information silently in the background.

Depending on which forms you use, that may include:

To reply to you and to arrange what you have asked us to arrange. Flight search details are used to request route options; payment and receipt details are used to match and review a transfer for a reservation.

Specifically: to price and prepare a quotation, to check availability with hotels and suppliers, to prepare and submit visa documentation on your behalf where that is what you have asked for, to arrange flights and transport, to review a trade partnership application, and to keep a record of what was requested and what was agreed.

We also use your email address to confirm that an account belongs to you before it can be used.

We do not sell your information or use enquiry details to send marketing email. Optional analytics from Google Tag Manager and Microsoft Clarity may run only when those services are configured and you allow analytics in the consent prompt. You can change your choice using Privacy settings.

We do not send marketing email off the back of an enquiry. Email sent by this site is operational: an email verification link to you, and an internal alert to our own team telling them a request has arrived.

Uploaded documents are treated as the sensitive material they are.

They are stored outside the publicly served area of this website. There is no public address that will return one, and they are not indexed by search engines.

They can be opened only through an authenticated administrative screen by our own team. Every request for a document is checked against an administrator session first.

We check the actual content of each uploaded file rather than trusting its name or extension, and we enforce a size limit. Files that are not an accepted document type are refused.

Passwords are stored using a one-way hash with a per-account salt. They are never stored in readable form, never written to logs, and never shown on any screen — including our own administrative screens.

Because of that, nobody here can tell you your password. If you lose it, it has to be replaced rather than looked up.

Email verification links are stored only as a hash. The link itself exists only in the email we send you. Each link works once and expires.

Sessions are held in a signed cookie. Customer sessions and administrator sessions are signed separately, so one can never be used in place of the other.

Every screen that shows your requests looks them up by the account you are signed in as, taken from your session — never from anything in the page address.

Changing an identifier in the address bar will not show you another customer's request, and a customer account cannot reach any administrative screen.

We reply using the contact details you give us. If you give us a WhatsApp number and start a WhatsApp conversation, that conversation takes place on WhatsApp and is subject to WhatsApp's own privacy practices.

Our own team receives an internal notification when a request arrives. Where email delivery is configured, that notification is also emailed to our business address. Those internal alerts contain your name and contact details so we can act on the request.

The site uses strictly necessary session cookies when you sign in so your session works across pages. Optional analytics tags are controlled by the consent choice described above. We do not use the information you submit in forms to build an advertising profile.

Optional tags from Google Tag Manager and Microsoft Clarity are used only when configured and subject to your consent choice. If analytics is allowed, usage events may be sent to those providers; certain successful quote or agent-application events may include SHA-256 hashed email and phone for conversion measurement. Raw email and phone are not placed in the analytics data layer. If you reject, Google Consent Mode may still send limited cookieless measurement signals; Microsoft Clarity is not loaded. You can change your choice using Privacy settings.

We keep enquiries, account records and uploaded documents while they are reasonably needed to respond to your request, provide the service, maintain operational records, resolve a dispute or meet an applicable legal obligation.

Access to sensitive travel documents is restricted to authenticated staff who need them for the requested service. You may ask us to review or delete information. Some records may need to be retained where an applicable obligation or legitimate recordkeeping need requires it.

If a customer account is deleted, existing requests may remain as business records but are no longer linked to that account.

To arrange what you have asked for, we share what is necessary with the hotels, airlines, transport operators and visa processing channels involved — for example a traveller name and passport detail where a booking or a visa application requires it.

When you use live flight search, route, dates, passenger mix and cabin preference are sent to SerpAPI so it can request Google Flights results. Do not enter passport or payment details in the flight search fields.

We share what the arrangement needs and no more. We do not pass your details to anyone for their own marketing.

You do not need an account to use this site. Every form works as a guest.

You choose which optional fields to complete, and you choose whether to upload a document. Where a document is genuinely required for an application, the form says so.

You can ask us to correct anything we hold about you, and you can withdraw a request at any time before it becomes a confirmed arrangement.

If we change how this site handles information, we will update this page and the review date at the top of it.

For any question about this policy, or to ask what we hold about you, please contact us. Our phone number, WhatsApp number and email address are on the Contact page and in the footer of every page.