Privacy policy

1. Who we are

WEBNFLIX LIMITED (a company registered in England and Wales, company number 15937416) operates ziyarahcheck.com, an independent review and verification service for Ziyarah tour operators. WEBNFLIX LIMITED is the data controller for the personal data described here. You can contact us at privacy@ziyarahcheck.com or by post at Downton House, South Kilworth Road, Welford, Northampton, NN6 6HH. WEBNFLIX LIMITED is registered with the Information Commissioner's Office under reference ZC244860.

2. What we collect and why

Account details. When you sign in with Google we receive your name, email address and profile picture, and we store an account record with the date you joined. We use this so that each zair can hold one account, to keep reviews honest, and to contact you about your own reviews or submissions. Lawful basis: performance of a contract (providing the service you asked for) and our legitimate interest in preventing fake reviews.

Reviews. The review text, ratings, trip details (destination, season, year, departure country and city) and the display name you choose are published on the site and are visible to anyone. Your email and full name are never published. We process this information in order to receive, moderate and publish the review you have asked us to publish. Lawful basis: performance of our contract with you. We also have a legitimate interest in moderating reviews, maintaining the integrity and usefulness of the review service, preventing abuse and, where appropriate, maintaining an accurate historical record of published reviews.

Travel evidence. After your review is published, we may email you a private link and invite you to send us something showing you took the trip — a payment or booking confirmation, a boarding pass, or a hotel confirmation. Sending it is optional; your review stays published either way, in your own words. We never ask for a passport, a visa or any identity document, and we do not verify identity. What you send is stored privately, seen only by a moderator, and never published. We use it for one purpose: to decide whether your review carries the Verified traveller tick. Please black out anything that is not needed before you send it, such as an account number or another person's name. Lawful basis: consent, which you can withdraw by emailing privacy@ziyarahcheck.com.

Operator suggestions and corrections. When you suggest an operator or a correction we store what you submitted, and optionally your name and email so we can follow up. Your name and email are never shown publicly or shared with the operator. Lawful basis: legitimate interest in maintaining an accurate directory.

Operator representatives. If you claim an operator listing, respond to reviews or raise a dispute, we record which account did so and when. Lawful basis: performance of a contract and legitimate interest in an accountable dispute process.

Technical and anti-fraud data. Our hosting provider records IP addresses and standard server logs. We use signals such as account age, submission timing and duplicate content to route suspicious reviews to moderation. Lawful basis: legitimate interest in security and preventing fake reviews.

Search activity. We record the words or phrases entered into the site's search box so that we can understand what people are looking for and improve the directory. We do not attach these search records to your ZiyarahCheck account, email address or other user identifier. Search terms may themselves contain personal information if a person is named in the search. Lawful basis: our legitimate interest in understanding how the service is used and improving the directory.

Information about the groups we list. Our directory entries describe businesses and community karwans, not individuals. We take that information from the operator's own website, from what people who suggest a listing tell us, and from public sources. Where a group is run by one person, some of those details may also be personal information about them. We publish only business contact details — the number or address a group advertises for bookings — and never an individual's personal phone number or private address. If you are named in one of our listings and want it corrected or removed, email privacy@ziyarahcheck.com and we will deal with it.

A ziyarah you plan. When you plan a ziyarah we store the countries you are going to, the group you are going with, the occasion and the kind of journey, and your travel dates where you give them. If you tell us your group is not listed here, we also store the group's name, website, where it is based and the name of the person leading it, so that a moderator can check it and add it to the directory; please give a leader's name only where they lead groups publicly. If you add the flight number of your journey home, we store it with the ziyarah and use it for one thing: to show you a link to that flight's public tracking page. It is seen only by you and the people on your ziyarah, is never put in a shared link or an email, and is deleted with the ziyarah. A planned ziyarah is private to you. It is not published, it is not shown to the group, and we never ask for a passport, a visa or any identity document. Moderators can see how many people have planned a ziyarah with each group, as a total only, with nothing that says who they are. Lawful basis: performance of a contract (keeping the ziyarah you asked us to keep) and, where you ask us to add a group, our legitimate interest in maintaining an accurate directory. When you save a ziyarah to your account we also record the words you agreed to and the date, so that we have a record of what you were told.

Ideas you share. If you share an idea to improve the site, we store what you wrote, the type of idea, any pictures or documents you attach, and the name you chose to appear with it. A moderator reads it before anything appears. If it is published, the idea, the attachments and your chosen name are public and can be found by search engines; your email and full name are not. If it is declined, nothing is published and you are told why on your own account page. When you vote for an idea we store which account voted, so that each person votes once and so you can see your own vote — the public sees only the total. Lawful basis: our contract with you to provide the board, and our legitimate interest in keeping voting honest and in keeping a record of moderation decisions.

People travelling with you. If you record who is travelling with you on a saved ziyarah, we store the first name you type for each person and, if they join, the name they choose and the date they joined. We never ask for their email address or phone number, and we never contact anyone who has not joined — the link is yours to share. Only people on the trip see the list, and they also see the first name on the account of whoever created the ziyarah; that person is never shown whether a traveller has written a review. Lawful basis: our contract with you, and with anyone who joins; and, for the email after the trip, their consent, which they can withdraw at any time.

Reminders about a ziyarah you have saved. If you give us your travel dates you can ask us to email you about that trip: once before you go, with the checklist, and once after you are back, to ask how it went. That is at most two emails for each ziyarah you save. We send none if you do not give us dates, and none if you do not tick the box. You can stop them at any time from any of those emails or in your account. Lawful basis: your consent, which you may withdraw at any time. These are separate from the occasional emails described below and from service messages about your own account.

Following a group. If you follow a group we record which account followed it and when, so that we can show it on your account and so that a moderator can see how many zaireen follow each group, as a total only. If you also ask to be emailed about new reviews of the groups you follow, we store the words you agreed to and the date you agreed. Lawful basis: performance of a contract for the follow itself, and your consent for those emails, which you may withdraw at any time from any email or in your account.

Occasional emails, only if you ask. If you tick the box, ZiyarahCheck will email you no more than four times a year about what is new on the site and to remind you that you can review a trip you have taken. You can unsubscribe in any of those emails in one tap, or by emailing privacy@ziyarahcheck.com. We do not sell your email address or disclose it to third parties for their own marketing purposes. Our email service provider processes your email address on our behalf as described in section 4.

These emails are separate from service messages about your own account, reviews or submissions, which we may send where necessary to provide the service you have requested. Unsubscribing from marketing does not stop those service messages. Lawful basis for marketing emails: your consent, which you may withdraw at any time. If you unsubscribe, we retain only the minimum information required to record and respect your opt-out. That suppression record is not used to send you marketing.

3. Cookies and analytics

We set one strictly necessary cookie to keep you signed in. We do not use advertising cookies, and we do not track you across other websites.

We use two Vercel measurement tools. Web Analytics counts page views and shows which pages people use. Speed Insights records how quickly pages load, so we can find and fix slow ones. Neither sets cookies or stores anything on your device.

Web Analytics counts visitors using a short-lived hash derived from the request, discarded after 24 hours, and records the page address, the referring site, an approximate location (country, region and city), and your browser, operating system and device type. Speed Insights records the page address, loading-speed measurements, your connection speed, browser, operating system, device type and country. Neither is tied to your IP address, linked to your ZiyarahCheck account, or able to follow you across other websites.

We strip query parameters from page addresses before they are sent, so values such as a name typed on the sign-in form or a one-time sign-in token are never included. Because nothing is stored on or read from your device, no cookie consent banner is required; our lawful basis for the limited processing involved is our legitimate interest in keeping the service useful and fast. Browser extensions that block trackers will also block both, and the site works normally without them.

4. Who we share data with

We use trusted processors to run the service: Vercel (hosting, and both private and public file storage), Neon (database hosting), Google (sign-in), Resend (sending our email) and Anthropic (the Claude AI model, which we use in two ways: to read a tour operator's own website and pre-fill a suggested listing, and to run a daily internal check of newly published reviews against our review guidelines so that a moderator's attention goes where it is needed; no decision about your review is ever made automatically). Vercel, Neon, Google and Resend each process data on our instructions under a data processing agreement. The daily guidelines check is a stated exception: it currently runs through Anthropic's Claude desktop application rather than under a commercial agreement with us, so that one use is not covered by a data processing agreement, and we are moving it onto Anthropic's API under those terms. Only the review text and our published guidelines are sent for that check — no name, no email address and no account identifier goes with it — and, as above, no decision about your review is ever made automatically. Some of these providers may store data outside the UK; where they do, transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

You may use the site's sharing controls to copy or share a link to a listing. ZiyarahCheck does not receive information about who you choose to share a link with.

We do not sell personal data. We do not share your identity with tour operators. An operator who disputes a review sees only the public review and the moderation outcome. We may disclose data where the law requires it, for example in response to a court order.

5. How long we keep data

Published reviews may remain on the site for as long as they continue to serve the purposes for which they were submitted and we have a lawful basis for retaining and publishing them. Closing your account does not necessarily require the immediate removal of every published review, but it does not affect your rights under data protection law. If you ask us to erase personal data contained in or associated with a review, or withdraw an applicable consent, we will consider the request in accordance with data protection law. Depending on the circumstances, we may remove the review, remove identifying information, or retain limited information where we have a lawful basis to do so.

There is no delete button today: to have a review removed, or your account and its reviews erased, email privacy@ziyarahcheck.com and we will act on it — see Your rights below.

Travel evidence is deleted 90 days after we decide whether it supports the Verified traveller tick, or 90 days after we receive it if no decision is made. Where an operator has formally disputed a review, we may retain relevant evidence for as long as reasonably necessary to resolve the dispute and for an appropriate period afterwards where it remains necessary for the establishment, exercise or defence of legal claims. You can ask us to delete it sooner at any time. Operator passenger lists, if uploaded in future for invitation-based verification, are deleted 60 days after the trip ends. Account records are normally deleted within 30 days after an account-deletion request, except for information which we reasonably need to retain to comply with law, establish or defend legal claims, enforce an account restriction or ban, prevent fraud or abuse, or record and respect a marketing opt-out. Any information retained for those purposes is limited to what is reasonably necessary. Server logs are kept by our hosting provider for a short period, typically no more than 30 days.

• Records of moderation decisions (including the decision, the reason for it and when it was made) are retained while the relevant review remains published and normally for three years afterwards. Where a review is rejected and never published, the moderation decision record is retained for three years from the decision. We do not retain supporting evidence for that entire period unless a separate retention reason applies.
• Records and correspondence relating to complaints, disputes and appeals may be retained for up to six years after the matter is closed where reasonably necessary having regard to the nature of the dispute and any actual or reasonably anticipated legal claims. We may use a shorter period where there is no continuing reason to retain the information.
• Search terms that are not linked to a ZiyarahCheck account or other user identifier are deleted after twelve months. A search term may itself contain personal data if somebody enters a person's name or other identifying information.
• A ziyarah you planned but did not save to an account is deleted 30 days after you last opened it. Opening it again moves that date, so a link you still use survives and one you abandon does not. Once you save a ziyarah to your account we keep it until you delete it, or until your account is deleted. Travellers recorded on a ziyarah, and any link created to share it, are deleted with the ziyarah; a traveller who leaves is removed at once.
• If you run a group and send us your programme so that we can build your itinerary for you, the file is seen only by you and the people at ZiyarahCheck who build it, and is never shown to zaireen. It is deleted 90 days after the itinerary is published or the request is closed.
• An idea you shared stays on the board while it is published. If an idea is declined, what you wrote and anything you attached are deleted after 90 days; we keep a short record of the decision and the reason for three years. Votes are deleted when the idea is deleted or when you delete your account.
• What you tell us about a group that is not listed here is kept with our directory records, so that the listing can be checked and maintained, whether or not we publish it.
• If you start writing a review and have to sign in or create an account to publish it, we save what you have written so it is still there when you come back. That draft holds no information about who you are. If you do not finish, it is deleted within 24 hours; if you publish, it is deleted as soon as the review is saved.
• We count how many people reach each step of the review form, so that we can see where the form is losing people. Those counts hold nothing that identifies anyone and are not linked to any review.
• When someone suggests a listing and we read the group's website to fill in the form, we keep a record of the address we read and when, for twelve months.

6. Your rights

You have rights under data protection law which, depending on the circumstances, may include the right to access personal data we hold about you; have inaccurate data corrected; request erasure; restrict or object to processing; receive certain data in a portable form; and withdraw consent at any time where we rely on consent. These rights are not absolute and may be subject to conditions or exemptions under applicable law.

To exercise your rights, email privacy@ziyarahcheck.com. We will respond within the period required by law (usually one month). You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, although we would welcome the opportunity to address your concern first.

7. Reviews and other people

Reviews describe your own experience. Please do not include other people's personal data, such as names of fellow travellers or staff, phone numbers or photographs of people, unless it is necessary and fair. We may edit or remove content that contains unnecessary personal data, and anyone who believes a review contains their personal data can ask us to review it.

8. Children

The service is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

9. Changes

We will post any changes to this policy on this page and update the effective date. Significant changes will be announced on the site before they take effect.