Privacy Policy

Barakah is accountable for personal information under Canada's private-sector privacy law and Quebec's private-sector privacy requirements where they apply. The person responsible for these practices is the Privacy Officer.

Contact: info@joinbarakah.com. Use the subject “Privacy Request” and do not email passwords, payment-card details, or government identification.

Member information may include name, email, phone number, mailing address, household or family details, membership status, contribution selection, billing status, benefit activity, account settings, and support communications. We use it to create and secure accounts, provide member benefits, administer billing, communicate service information, prevent misuse, and meet legal obligations.

Business information may include owner or representative contact details, public business details, locations, categories, images, logos, offer terms, application answers, review notes, and sponsorship information. Only approved business-facing information is intended for the public directory.

We also receive limited technical information needed to operate and secure the service, such as authentication events, request identifiers, and provider delivery results. We do not ask for payment-card numbers; Stripe handles hosted checkout and billing management.

We request consent in clear, separate language at member signup. You may withdraw consent for optional uses at any time, subject to legal or contractual restrictions. Essential account, security, and transaction processing cannot be disabled while the related service remains active.

Optional PostHog analytics is off until you choose to allow it. We disable session replay, form-content capture, automatic interaction capture, and identified user profiles. Use “Privacy Choices” in the site footer or member profile to change your choice. Withdrawal applies going forward.

We use limited providers to operate Barakah, including Vercel and database hosting, Payload CMS, Stripe, Mailgun, Cloudflare R2, Google Places, and—only with your optional consent—PostHog. A provider receives only the information needed for its function and remains subject to contractual and security controls.

Some providers may process information outside Quebec or Canada. Before a new material transfer, Barakah assesses privacy and security risks, contractual safeguards, location, access controls, deletion terms, and applicable foreign-law access. Information may be disclosed when required by law or to investigate fraud, security incidents, or threats to safety.

Barakah does not sell personal information.

We keep identifiable information only while it is needed for the stated purpose, an active relationship, or a documented legal obligation. Pending signup records are reviewed after their unfinished signup period expires. Support and email delivery logs are retained only for troubleshooting and accountability, then deleted or anonymized under the retention schedule.

When an account deletion request is fulfilled, the member profile, login, authentication sessions, contact details in delivery logs, and related activity are deleted or anonymized. Recoverable audit snapshots are scrubbed so the audit trail records that erasure occurred without preserving the erased profile. Anonymized payment or accounting records may remain for tax, fraud, chargeback, or dispute obligations. Any exception is documented with its reason and destruction date.

Provider backups follow restricted rolling retention cycles. If a backup must be restored, completed deletion records are reapplied before restored information is returned to normal use.

You may request access to personal information, correction of inaccurate information, an explanation of its use and disclosure, withdrawal of optional consent, deletion where permitted, or a portable copy of computerized information in a commonly used format.

Send access, portability, correction, consent, or deletion requests to the Privacy Officer. We may ask for proportionate identity verification and will not request a password by email. We aim to respond within 30 days or explain any legally permitted extension or refusal and available recourse.

You may raise a concern with Barakah first and may also contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada, as applicable.

A member must confirm they are at least 14 or have parent or guardian authorization. The student contribution option does not itself prove age. If we learn that personal information from a person under 14 was collected without valid authorization, we will suspend the account and delete or regularize the information as required.

Safeguards include role-based access, separate staff and member sessions, hosted payment pages, credential redaction, environment separation, provider access controls, and a recoverable staff audit trail. No system can be guaranteed perfectly secure.

Barakah maintains a confidentiality-incident register, assesses the risk of serious harm, contains incidents, and notifies affected people and regulators when required.

The date above identifies this version. We will provide appropriate notice before a material change that creates a new use or disclosure and will request new consent when the law requires it. Archived versions and consent records are retained for accountability.