Privacy
This page describes what this site actually does with data, as built today. Not what we intend to do, and not what a template says a privacy policy should contain. Where something is not switched on, it says so.
The short version
We collect almost nothing about you. There is no account, no advertising tracker, no analytics, and the figures you type into the calculator never leave your device. We do not record or infer anyone's religion, and that is enforced in code rather than promised in a sentence. What the infrastructure serving these pages will process is a separate question, and it is answered honestly below rather than assumed away.
Why this page is short on legal furniture
Most privacy policies are long because the organisation collects a lot. This one is mostly a list of things that do not happen, because the site is a research publisher rather than a product with users. There is no login, no profile, no advertising relationship and no data to monetise, and the parts that would collect anything are not switched on yet.
When that changes, this page changes first, before the form appears, and the change is dated in the change log like everything else.
What we collect, in one table
| Data | Status | Detail |
|---|---|---|
| Name, email or phone number | Only if you send an enquiry | The enquiry form asks for them so we can reply. They reach our mailbox through the form relay named below, and nowhere else. Not filling the form means we never see them. |
| Figures you type into the tools | Stays on your device | Property price, deposit, term, customer type and property details are used in your browser and never sent to us. |
| An account | Does not exist | There is nothing to sign up to, so there is no profile to build. |
| Advertising cookies or trackers | None | We set none and run none. No advertising network sees you here. |
| Your religion or beliefs | Never | Not asked, not recorded, not inferred. The section below explains how that is enforced rather than promised. |
| The figures you put in an enquiry | Only what you choose to type | Property price and deposit are optional on the form. We ask for nothing about income, debts, credit history or date of birth, because assessing those is an authorised firm's job and a research site holding them would be overstepping. |
| Details passed to advisers or brokers | Nothing has ever been passed on | No introduction route is switched on and no partner firm is configured. An enquiry you send reaches us and stops there; if an introduction ever becomes possible we will name the firm and ask you first. |
The status column is read from the site's own configuration rather than typed here, so it cannot say "not collected" on a build where collection has been switched on.
On what basis. Replying to an enquiry you chose to send us is a legitimate interest: you asked a question, answering it is what we are for, and we use what you sent for nothing else. That is why the form has no consent tick. A tick that you cannot decline without losing the thing you came for is not a free choice, and we would rather rely on a basis that is honest than on a box that looks like permission. Consent is kept for the one thing that genuinely needs it, which is sending your details to somebody else: that never happens without a separate tick naming the firm receiving them, at the moment it would happen. Serving and protecting the pages themselves also rests on legitimate interests, and the infrastructure section lists who sees what.
The tools run on your device
The calculator and the eligibility checker do their work in your browser. The figures you type, your property price, deposit, term, customer type and property details, are not sent to us, not stored on our servers, and not used to contact you. There is no server-side calculation to send them to.
So the checker does not ask again for what you already told the calculator, your scenario is held in your browser's session storage while you move between the two tools. It stays on your device and nothing about it reaches us. Session storage lasts for the life of the browser tab, so closing the tab clears it. There is no timer that deletes it early: what we do is treat anything saved more than an hour ago as expired and ignore it next time. If you would rather nothing was kept between tools, close the tab in between or use a private window.
Financial figures are also kept out of URLs. Nothing you enter appears in a web address, because a URL is copied, shared, logged by intermediaries and stored in history. That is a deliberate rule rather than an accident of how the tools were built.
We do not record religion
This site is about Islamic home finance and many readers will be Muslim. Religious belief is special category data under UK data protection law, and the safest way to handle it is not to have it. So we do not ask, do not record, and do not infer anyone's religion. Using this site says nothing to us about your faith.
That is a design decision with consequences in the code rather than a reassuring sentence. Where a question could be asked either way, it is asked about the product: are you looking for Sharia-compliant home finance, never anything about your faith. The two would return similar answers and only one of them is a fact about you.
How it is enforced rather than promised
Our analytics wrapper carries a fixed list of events and, for each, a fixed list of properties. Anything not on the list is dropped rather than passed through, so a new event carrying something about a person cannot be added by accident. Keys that look like personal data are blocked outright, and so are values shaped like an email address or a phone number.
The eligibility checker is the clearest example. When someone finishes it, the only thing recorded is which route they took next, as "adviser" or "more information". An earlier version recorded an outcome, which would have labelled the person rather than the action. That was changed deliberately, and the vocabulary is now fixed so it cannot drift back.
Analytics
We run no analytics or measurement service. There is no measurement script in any page, so nothing here builds a profile of you or follows you between sites.
That is a narrower claim than "no visit information exists anywhere", and the difference matters. It is what our own code can prove. What the infrastructure serving these pages processes is a separate question, answered below.
When measurement is switched on it will be named here with what it collects, on what basis and for how long, before it goes live. The allowlist described above already exists and is what any such service would have to pass through, which is the reverse of the usual order: the constraint was built before the thing it constrains.
What the infrastructure sees, and why we cannot yet tell you
Everything above describes what our own code does. A web page also has to be delivered, and a request for one passes through a domain name service, usually a content delivery network, possibly a security layer, and a host, before any of our code is involved. Those services can process the requesting IP address, the page asked for, a timestamp and browser information, and an IP address is an online identifier that can amount to personal data.
The providers, what each receives, why, how long it is kept and where, are listed below.
| Who | What they do | What they see | How long | Where |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, DNS and content delivery for every page on this site. | IP address, user agent and requested URL, as part of serving and protecting the site. | Per Cloudflare’s own retention policy; we hold no copy and run no analytics on it. | Global edge network, including outside the UK. |
| Web3Forms | Relays the adviser enquiry form to our mailbox. Used only on that form. | Whatever you type into the enquiry form: your name, email, phone, the figures you choose to give, and your question. | Deleted at their end after one year; the copy we keep is the email in our inbox. | Outside the UK. |
| Google (Google Workspace) | Our mailbox. Receives enquiries and any email you send us directly. | The contents of the message and your email address. | Kept while the enquiry is live and for our own records afterwards; ask us to delete it and we will. | Outside the UK. |
Why this section exists at all. An earlier version of this page said no visit data was being collected or sent anywhere. That is true of a site running on a laptop and would have become false the moment it was deployed behind a delivery network, without anyone editing a word. A claim that quietly stops being true is worse than one that was never made.
The rules that apply to storing anything on your device
Storing or reading information on your device is regulated in its own right, separately from data protection. The rules cover more than cookies: they apply to browser storage generally, and they apply whether or not the stored information identifies anyone. So "it never leaves your device" answers a different question from "was this allowed".
What we store is one thing: the scenario you typed into the calculator, held in session storage so the checker does not ask you for it again, cleared when the tab closes. The exception we consider applicable is the strictly necessary one, which covers recording the information or selections a user makes on a service they asked to use.
Considering it applicable is not the same as deciding it applies. That classification is not yet reviewed, and it is on the list of things to settle before launch rather than after. The wrong response here would be to add a consent banner reflexively: a banner for storage that does not need one trains people to dismiss banners, which makes the ones that matter worse.
Things that are not live, stated as not live
- Email alerts (not live)
- We do not collect email addresses anywhere on this site. There is no form. When alerts launch, this section will say exactly what is stored, where, and how to leave the list, before any form appears.
- The enquiry form (live)
- This is live. The form on our tool and guide pages sends what you type to our mailbox through the relay named in the infrastructure section above, so that we can reply. It is not an application, it reaches no provider, and it goes to no adviser: there is no adviser to send it to, which is the next row.
- Specialist introductions (not live)
- We do not pass anyone’s details to advisers, brokers or providers, because we do not collect them. No introduction route is switched on and no partner firm is configured. When one exists, the consent will name the exact firm receiving your details, and this page will describe it beforehand. We will never share details with a firm the consent did not name.
Both of those read from the site's configuration. If either is ever switched on without this page being updated, the words above change on the same build, which is the point of writing them this way. How the introduction model would work commercially is on how we make money.
Your rights
UK data protection law gives you rights over personal data an organisation holds about you. They apply here in an unusual way, because at the moment we hold none: there is nothing to access, correct, export or delete. They are set out anyway, because they matter the moment anything changes.
| Right | What it means |
|---|---|
| Access | A copy of the personal data held about you. |
| Rectification | Correction of anything inaccurate. |
| Erasure | Deletion, where there is no overriding reason to keep it. |
| Restriction and objection | Limiting or objecting to how it is used. |
| Portability | A machine-readable copy where the right applies. |
| Withdrawing consent | At any time, where consent was the basis. |
The honest position on exercising them. There is a contact route published below, which is a gap rather than a policy. A privacy notice needs a named controller and a route a person can actually use, and both are on the list of things that must exist before this site goes public rather than after. You can complain to the Information Commissioner's Office whatever we publish; that right does not depend on us.
Who is responsible for this
Islamic Mortgage Guide is an independent publishing project run from the United Kingdom by H Ali, trading as Islamic Mortgage Guide, who is the data controller for anything this site collects. It is a sole trader rather than a limited company, so there is no company registration number to give you, and we are not going to print one that does not exist. Write to hello@islamicmortgageguide.co.uk about anything on this page, including exercising any of the rights above.
The code enforces this rather than trusting the prose. The enquiry form cannot render on a build where the controller is unnamed, the contact route is missing, or the processors carrying your data are not listed. It is a build failure, not a warning: a form that takes a phone number cannot ship before the notice explaining where it goes.
We are not a lender, broker or adviser, and nothing on this site is personal financial advice. On transfers outside the UK: we collect nothing ourselves to transfer, and where the delivery infrastructure processes technical information the location will be stated once the audit above is done rather than assumed to be domestic.