The short version, before the detail

We collect the least we need to run your website and talk to you. We don't sell your data, we don't sell your visitors' data, and we don't use any of it for advertising. Every client's data sits in its own separate database, and we never store bank card details.

The full detail is below — laid out in tables, because this kind of thing is easier to understand as a table.

1. Who this policy covers

Three groups, and our role differs for each:

This distinction matters in practice: if you visit a clinic's site built on Qurb and send a message, that data belongs to the clinic, not to us. A request to delete it goes to the clinic first, and we act on what they ask of us.

Data controller: [[FILL: full legal entity name]], [[FILL: address]], Republic of Yemen.

2. What we collect from visitors to our site

What we don't collect from site visitors: card details, ID numbers, health data, or any sensitive category. If you volunteer something like that in the contact form, please don't — and if it reaches us, we delete it.

3. What we collect from our clients

a) Account and contact data

• Name, business name, email, phone/WhatsApp.

• Your password — stored as a one-way hash. Neither we nor anyone else can read it, and we will never ask you for it on a call or in a message.

• A billing email, if it differs from the account email.

• The role and permissions of each of your team members.

b) Subscription and billing data

• Your plan, its start date, renewal date and status.

• Invoices: line items, amounts, discount, tax, totals.

• Manually recorded payments: amount, date, method, and whatever reference you give us.

• A log of reminder messages sent to you.

Important: our payments are manual — transfer or cash. We never store or process bank card data at all, not even the last four digits. There is no payment gateway in the system to begin with.

c) Your website content (you enter it)

Your pages and their sections, posts and news, images and files, menus, your form designs, your logo and colors, your addresses, phone numbers, branch locations and working hours, and any social accounts you link.

d) Operational data we generate

• Your domain and its verification status.

• SSL certificates: issuance and renewal dates, and issuance attempts.

• A record of backups and restores.

• An activity log: who on your team changed what, and when — used for diagnostics and security review.

• Performance measurements of your public pages (load speed) — see §7.

4. What's collected from visitors to our clients' sites

Here we're the processor and the client is the controller. What gets stored in the client's database:

A note for our clients: telling your visitors how their data is used, and getting their consent where required, is your responsibility. We recommend publishing a privacy page on your own site. [[FILL: do you give clients a ready privacy-policy template for their sites? If yes, mention it here — it's a genuinely useful differentiator.]]

A note for visitors: if you want to know about, or delete, your data on a client's site, contact that site's owner directly. If you can't reach them, write to us at [[FILL: privacy@...]] and we'll help you get through.

5. Cookies

On our site we use only the essentials:

None of these are used for advertising or shared with advertisers. You can delete or block them in your browser settings, but some are necessary and the site won't work properly without them.

On our clients' sites: the same essential cookies above. If a client adds an external analytics tool (Google Analytics, say) with their own ID, that tool sets its own cookies under its owner's policy — that's an optional addition by the client, not something enabled by default.

[[FILL: have you installed Google Analytics on the Qurb marketing site itself? If yes, add an explicit line here naming Google Analytics and the cookies it sets. The table above is written assuming you haven't.]]

6. How we use data

And what we never do:

• We don't sell your data or your visitors' data to anyone. Not now, not later.

• We don't use your website content or images in our marketing without your written permission.

• We don't read your form submissions except for technical diagnosis at your request.

• We don't send you marketing messages without your consent — operational notices (an invoice, a renewal, an outage) are part of the service, not marketing.

• We don't make purely automated decisions that affect your rights.

7. Who we share data with

We only share with providers we genuinely need to run the service, and only as far as necessary:

An explicit note about SSL certificates: domain names that get certificates are published in public Certificate Transparency logs — that's a global standard for all certificates, not something specific to us. It means your domain name becomes publicly searchable. Domain names only, and nothing from your data.

The provider list may change. We update this page on any material change, and notify clients when a change meaningfully affects their data.

8. How we protect data

• A dedicated database per client. This is our single most important measure: every client's data lives in its own separate database with its own username and password. There's no shared table across clients, and no chance a mistaken query reaches another client's data.

• Encryption in transit: HTTPS enforced on every platform and client site, no exceptions.

• Passwords stored as one-way hashes. We cannot read them at all.

• Sensitive secrets encrypted in the database — database connection credentials, the Google Drive link token, and the reCAPTCHA secret key.

• Role-based permissions inside your account, and least-privilege access inside our team.

• An activity log recording significant operations for review and diagnosis.

• Scheduled backups with a documented, tested restore procedure.

• Continuous monitoring of our servers with instant alerts.

• Security updates applied to the platform regularly.

And honestly: no system anywhere is 100% impenetrable. We put real, professional effort into this, and we can't promise absolute security — anyone who promises you that isn't telling the truth.

9. How long we keep data

Backups — in full honesty: Backups aren't deleted the instant live data is, because they're managed on a tapering schedule:

So: a snapshot of your data may persist inside a yearly backup for up to two years after deletion. We're telling you plainly rather than promising an immediate, complete wipe that wouldn't be accurate. If you want accelerated deletion from backups, write to us at [[FILL: privacy@...]] and we'll explain what's technically possible.

[[FILL: important decision — see the note at the top of this file. If you choose a shorter promise, you must change config/backup.php first, then change this table.]]

10. Your rights

You have the right to:

How to exercise a right: write to [[FILL: privacy@...]] from the email registered on your account. We reply within [[FILL: e.g. 30 days]], and we may ask you to verify your identity — that's protection for you, because we don't want to hand your data to someone impersonating you.

The service is free. If a request is clearly repetitive or excessive, we may decline or ask for a reasonable fee, and we'll explain why.

11. Children's privacy

Qurb is aimed at business owners and organizations, not at children. We don't knowingly collect data from children under [[FILL: e.g. 18]]. If we learn we've collected a child's data without a guardian's consent, we delete it. If you're a guardian and you notice something like this, write to [[FILL: privacy@...]].

If a client's site belongs to a school or an activity involving students, the client is responsible for handling children's data and obtaining parental consent.

12. Data breaches

If a security incident affects your data:

1. We stop the impact and secure the system first.

2. We establish what leaked and how many clients were affected.

3. We notify affected clients within [[FILL: e.g. 72 hours]] of confirmed knowledge of the incident — telling you what happened, what was affected, what we're doing, and what you should do.

4. We notify the authorities where the law requires it.

5. We publish a report on the lessons and corrective measures [[FILL: are you committing to this publicly? If not, delete this line]].

We don't hide incidents or stay quiet about them. We write this commitment down because we intend to keep it.

13. Transfers outside Yemen

Our servers are in [[FILL: country]], and some of the providers in §7 are outside Yemen (Google services and the email provider, for instance). So your data may be processed outside the country.

We choose providers that meet recognized protection standards, and we share only the minimum needed.

[[FILL: when you expand to clients in the Gulf or Europe, this section needs expanding — you may need standard contractual clauses or a stated legal basis for transfers. Review with a lawyer before taking clients from there.]]

14. Changes to this policy

We may update this policy when the service, our providers, or the law changes. We always update the "last updated" date at the top, and we notify clients at their registered email at least [[FILL: e.g. 30 days]] before any material change affecting their data takes effect.

15. Privacy contact

For security researchers: if you find a vulnerability, write to us rather than publishing it. We'll respond and coordinate with you, and credit you publicly if you'd like. [[FILL: do you offer a bounty? If not, delete this last sentence.]]