Privacy notice

The organisation that runs this platform is the controller of your data: [legal name and address of the organisation to be added]. Questions about your data go to [contact address to be added].

• Application: your name in Arabic and English, date of birth, gender, national ID number, city and address, phone and WhatsApp numbers, email address, social status, passport number and expiry date, and a scan of your passport.
• Visa and travel: visa documents, appointment and fee details, flight details and tickets, and the outcome of your visa case.
• During the exchange: your orientation confirmation, and your daily logs with their photos and videos.
• Reimbursement: the expenses you claim, receipts, and the decision on each item.
• Workshops: if you register for a community workshop, your name, email, date of birth, city and your answers to the host's questions.
• Account and security: your login email, a hashed password, optional passkeys and authenticator codes, sign-in times and the IP address used, and an audit trail of who viewed or changed sensitive records.
• Suggestions read from your documents: when you upload a passport, ticket or receipt, software on our own servers reads it and suggests values such as a flight number or a total. Suggestions are shown to you or a coordinator to accept or ignore; nothing is applied on its own.

We do not collect more than the exchange needs, and we do not buy data about you from anyone else.

The legal bases below are a draft and are to be confirmed.

• To assess your application and, if you are accepted, organise your exchange: visas, travel, orientation and reimbursement. Basis: steps taken at your request before and under an agreement with you.
• To keep you informed with emails and reminders about your application and exchange. Basis: the same agreement, and our legitimate interest in running the programme.
• To publish approved photos, videos and stories about the exchange, for example on social media. Basis: your consent, which you can withdraw. Nothing is published without a coordinator's approval.
• To run community workshops and contact the people who registered. Basis: your consent and the registration you made.
• To keep the platform secure, prevent abuse and investigate incidents. Basis: our legitimate interest.
• To report on impact. Reports use totals only, and groups that are too small to be anonymous are hidden. Basis: our legitimate interest.
• To meet legal duties such as financial record keeping. Basis: legal obligation.

• All traffic uses HTTPS.
• National ID and passport numbers are encrypted in the database and never written to logs.
• Identity, visa and receipt files sit in private storage. They are opened only through links that expire within a minute and only after an access check, and each opening is recorded.
• Access depends on role and project: coordinators see only their own projects, and participants see only their own records.
• Sign-in is rate limited, and accounts can use passkeys or an authenticator app.
• Uploaded files are checked before they are made available.

We do not sell your data. These providers process it on our behalf, only as needed to run the service:

• Oracle Cloud: hosting of the application, database and file storage.
• Cloudflare: DNS, traffic protection and, where switched on, a bot check on public forms.
• SMTP2GO: delivery of emails such as confirmations, invitations and reminders.
• Optional publishing and messaging services (Meta, LinkedIn, WhatsApp): used only if the organisers connect them. They receive approved posts, or the messages sent to people who gave a WhatsApp number.

Some of these providers may process data outside your country. Details of the transfer safeguards are [to be added by legal]. We also disclose data when the law requires it.

We keep data only as long as it is needed for the purposes above. The periods below are placeholders until they are confirmed.

You can ask us at any time to:

• show you the data we hold about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or anonymise your account, where the law allows;
• restrict or stop certain uses, including publication of your media;
• withdraw a consent you gave, without affecting what happened before;
• send your data to you in a common format.

Write to [contact address to be added]. We will check it is really you before we act. If you are not satisfied with our answer you can complain to your data protection authority.

We use one cookie, a session cookie that keeps you signed in. It is strictly necessary, so we do not ask for consent. Your light or dark theme choice is saved in your browser's local storage for the same functional reason. We use no analytics, advertising or tracking cookies.

Questions about this notice: [contact address to be added]. When the notice changes in a way that matters to you, we will say so on this page. See also our terms of use.