Privacy Policy

Campus Ummah is run by Hatem Samad, an individual based in Malaysia ("we"). For anything about your data, email campusummahsupport@gmail.com.

Each society decides what to ask its attendees and how to use their answers. Once a society has your registration details, it is responsible for how it uses them.

• Your account: your name, email address and password, or your name, email address and picture from Google if you sign in with Google. We never see your Google password.
• Your profile, if you add it: your picture, phone number, gender and university.
• Your location: a rough location from your IP address, a place you choose, or your device's location if you allow it.
• Your registrations: the events you register for, your ticket and check-in record, your answers to the society's questions, and any notes or files you add.
• Payment evidence: a payment reference or receipt, if an event asks for one. We don't take payments or collect card details.
• Your activity on the site: events you save, societies you follow, and notifications.
• If you run a society: the society's details and payment details, the representative's name, role and WhatsApp number, and the documents and contacts given to verify the society.
• Technical data: our hosting and security providers process your IP address and browser details to run and protect the site.

We don't ask for your religion, and your profile has no place for it. Most events are open to everyone, so registering for an event or following a society doesn't mean you hold any particular belief.

Your gender is used for brothers-only or sisters-only events. A society's own questions may ask for sensitive information, such as dietary or health needs. By answering, you explicitly agree to that information being shared with the society for its event. Only answer if you're comfortable doing so.

• To run your account, register you for events and issue your tickets.
• To show you events near you and send you notifications about your events and societies.
• To check that societies are genuine, and to prevent abuse and keep the site secure.
• To send account and event emails, such as confirming your address, resetting your password, and updates on your registrations, events and society.
• To meet our legal obligations.

We don't sell your data, show advertising or use advertising trackers.

• The societies running an event you register for, including any co-hosts, can see your name and email. The host society's team can also see your answers, notes, payment evidence and your history of registrations with that society, and can download all of this. The event page tells you when there are co-hosts.
• Other visitors can see public society and event pages. They can't see your registrations, profile or answers.
• Our admin can see account, society and verification records in order to run and protect the site.
• Authorities, if the law requires us to share it.

• Supabase: database, accounts and file storage, hosted in Singapore.
• Vercel: website hosting.
• Cloudflare: encrypted backup storage.
• GitHub: runs our nightly backups.
• Resend: sends our emails.
• Google: Google sign-in, if you use it.
• OpenStreetMap: maps and address lookups. It receives event addresses, the location you choose, and your IP address when a map loads.

These companies may process data outside your country, including in the United States and elsewhere. By using the site, you agree to this transfer. We choose established providers and use only what's needed to run the service.

We use only what the site needs: cookies that keep you signed in, and a cookie that remembers your location for up to a year. Google may set its own cookies when you use Google sign-in. We don't use analytics or advertising cookies.

• Your account and registrations: until you ask us to delete them, unless we need to keep something by law or to deal with abuse or a dispute.
• Database backups: daily copies for 30 days, and the first copy of each month for a year.
• Uploaded files in backups: these aren't removed automatically. Ask us when you request deletion and we'll remove them.

Copies a society has already downloaded are the society's responsibility, so please contact the society directly about those.

We limit access to your data, keep receipts and verification documents private, and encrypt backups. No website is completely secure. If a breach seriously affects you, we'll tell you and the authorities as the law requires.

You can change most of your profile in your dashboard. Email campusummahsupport@gmail.com to see a copy of your data, correct it, delete your account or withdraw your agreement. We aim to reply within 21 days, and may need to confirm it's really you. Without some of this data, we can't provide the service.

Your country's laws may give you other rights. You can complain to your local data protection authority. In Malaysia, that's the Personal Data Protection Commissioner.

You must be at least 16 to use Campus Ummah. If you're under 18, you need permission from a parent or guardian. If you think someone under 16 has created an account, email campusummahsupport@gmail.com and we'll remove it.

If this policy changes, we'll update it here and change the date at the top. We'll give notice on the site or by email for important changes, including if the person or country responsible for the site changes.