Privacy Policy
Last updated: 21 April 2026
1. Data Controller
The data controller responsible for your personal data on this Site is the ayatulkursi.org editorial collective, an informal team of volunteers operating this website.
Contact: [email protected]
As an informal collective operating in the EU, we act as joint controllers with our service providers (Google, affiliate networks) where applicable. For data protection enquiries, the email above is the fastest route.
2. What Personal Data We Collect
We collect the minimum data needed to run the Site. Specifically:
2.1 Information you provide voluntarily
- Contact form submissions — your name, email, subject, and message when you write to us.
- Email correspondence — anything you send to [email protected].
- Newsletter signups — email address, if we operate a newsletter you subscribe to.
- Comments — name, email (not published), website (optional), and comment text if the Site has a comment system enabled.
2.2 Information collected automatically
- Usage data via Google Analytics 4 (GA4) — pages visited, session duration, approximate geographic location (city-level), device type, browser, referring site. IP addresses are anonymized by GA4 before storage.
- Advertising data via Google AdSense — cookies and similar technologies used to serve and measure ads. This may include interest categories, ad interactions, and pseudonymous identifiers.
- Affiliate tracking — when you click an affiliate link (e.g., to Amazon), that provider sets its own cookie to attribute purchases. We do not see your Amazon order.
- Server logs — IP address, user agent, referer, and time, retained briefly for security and abuse-prevention.
3. Legal Basis for Processing (GDPR Art. 6)
| Processing activity | Legal basis |
|---|---|
| Serving Site pages, security logs | Legitimate interest — running the Site securely (Art. 6(1)(f)) |
| Analytics cookies | Your consent via the cookie banner (Art. 6(1)(a)) |
| Advertising cookies | Your consent via the cookie banner (Art. 6(1)(a)) |
| Contact form & email replies | Performance of a request you initiated (Art. 6(1)(b)) |
| Newsletter | Your consent at signup (Art. 6(1)(a)) |
4. Cookies & Similar Technologies
We use cookies to run analytics and to serve ads. You can accept, reject, or manage your choices at any time through our consent banner or your browser settings. For a full list of cookies, their purpose, duration, and third parties, see our Cookie Policy.
5. Third-Party Services
We share or allow access to data with these processors:
- Google LLC — Analytics (GA4) and AdSense. Google Privacy Policy.
- Amazon Associates — affiliate link tracking. Amazon Privacy Notice.
- Hosting provider — standard server logs for the web host running the Site.
We do not sell your personal data. We do not share your data with any third party except the processors above, unless we are required to do so by law.
6. International Data Transfers
Some of our processors (notably Google) transfer data outside the European Economic Area, including to the United States. These transfers rely on the EU-U.S. Data Privacy Framework and, where needed, Standard Contractual Clauses approved by the European Commission.
7. Data Retention
- Analytics (GA4): user and event data are retained for 14 months by default, then deleted.
- Contact emails: kept for up to 24 months after the conversation ends, then deleted unless required for a legal obligation.
- Comments: retained indefinitely to preserve the discussion, unless you request deletion.
- Newsletter: retained until you unsubscribe, plus a short suppression-list period.
- Server logs: typically 30 days.
8. Your GDPR Rights
If you are in the EU, UK, or EEA, you have the following rights under the GDPR:
- Access — request a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure (“right to be forgotten”) — request deletion of your data.
- Restriction — ask us to pause processing your data.
- Portability — receive your data in a machine-readable format.
- Object — to processing based on legitimate interest, including direct marketing.
- Withdraw consent — at any time, for any consent-based processing (cookies, newsletter).
- Lodge a complaint — with your national data protection authority. In the EU, find yours at edpb.europa.eu.
To exercise any right, email [email protected] from the address associated with your data. We respond within 30 days.
9. Children
The Site is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, email us and we will delete it.
10. Do Not Track
We respect the Global Privacy Control (GPC) signal and Do Not Track (DNT) headers where technically feasible. When GPC is detected, we treat it as a signal to withhold non-essential cookies.
11. Security
We use HTTPS across the Site, keep our software up to date, and limit access to administrative accounts. No method of transmission over the Internet is 100% secure, but we take reasonable precautions.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced on the Site. The “Last updated” date above reflects the most recent version.
13. Contact
Privacy questions or rights requests:
Email: [email protected]