Privacy Policy

Last updated 26 October 2026

In short: your agency owns its data. Pilgrims’ details, passports and payments are visible only to your own team, as you allow. We use them only to run Qafla for you. We never sell them, never show them to other agencies, and never contact your customers ourselves.

1. Who we are and what this covers

Qafla is software for Hajj, Umrah and Ziyarat agencies, run by SMK Tech Labs in Pakistan (“we”, “us”). This policy explains what information Qafla holds, why, who can see it, and the choices you have. It covers the Qafla website and app, the packages pages agencies share with their customers, and receipt links.

Agencies and their customers. When an agency uses Qafla, the agency decides what information to enter about its customers and what to do with it. The agency is responsible for that information. We store and process it only on the agency’s behalf and on its instructions. If you are a pilgrim or a customer of an agency, please contact that agency first about your information. We will help them answer you.

2. What information Qafla holds

Agency details: agency name, city, phone, branches, logo and colours, plan and billing records.
Staff accounts: each team member’s name, mobile number or email used to sign in, role, branch and permissions. Passwords are stored only in scrambled (hashed) form; nobody, including us, can read them.
Customers and pilgrims (entered by the agency): name, father’s or husband’s name, gender, date of birth, CNIC, mobile number, city, family and mahram links, bookings, room sharing, visa progress, notes, and documents the agency uploads, such as passport pages, CNIC images, photos and vaccination cards.
Passport details: passport number, names, nationality, date of birth and expiry, read from the two lines at the bottom of the passport page to check them against the booking.
Payments: amounts, dates, methods, references, installment plans and receipts.
Enquiries (leads): name, mobile number, interest and messages, whether typed in by staff or sent by a customer from the agency’s packages page.
Group trips: flights, hotels, rooms, group leaders and headcounts.
Change history: a record of who added, changed or removed important information, and when, so agencies can trace mistakes.

3. How the information is used

To run Qafla for the agency: bookings, documents, visas, payments, rooms, reports and the group leader app.
To prepare messages for the agency’s staff to send. When staff tap a WhatsApp button, Qafla opens WhatsApp on their own phone with the message ready, and the staff member chooses to send it. Qafla does not message customers itself.
To support the agency when it asks for help, and to keep Qafla secure and working properly.
For billing between the agency and us.

We do not sell information, use it for advertising, or share it with other agencies. We do not use one agency’s customer data to market to anyone.

4. Who can see it

The agency’s own team, according to the roles and permissions the owner sets. For example, staff limited to one branch see only that branch’s customers, and money and reports can be hidden from staff who don’t need them.
Group leaders see only the trips they lead: names, rooms, families and the details they need on the trip.
Customers who receive a receipt link see only that receipt, with their CNIC partly hidden.
Visitors to an agency’s packages page see only the packages and offices the agency chooses to publish.
Our team can access an agency’s account only to provide the service, fix problems or when the agency asks for help.
Service providers who host Qafla for us (see section 6), under their own security and confidentiality terms.
Authorities, only where the law of Pakistan requires us to, and we will tell the agency unless the law forbids it.

5. How it is protected

Every agency’s information is kept separate, and the database itself checks who is allowed to see or change each record. This is not left only to the app’s screens.
All connections to Qafla are encrypted (HTTPS), and stored data is encrypted by our hosting provider.
Sign-in is by invite only, and every team member has their own login, so access can be removed the moment someone leaves.
Receipts cannot be deleted, only cancelled by the owner with a reason, and important changes are recorded in the change history.
When a passport photo is checked, the two lines at the bottom are read on the staff member’s own device.

No system is perfectly secure. If we learn of a breach that affects an agency’s data, we will tell that agency promptly.

6. Where the information is stored

Qafla’s database and uploaded files are hosted by Supabase in its Singapore data centre, and the website is served by Vercel. Both are established cloud providers that host data for businesses worldwide. Information may therefore be stored and processed outside Pakistan.

7. How long it is kept

An agency’s information is kept while its account is open, so its records and history stay complete.
The owner can remove a staff member’s access at any time. To delete a customer’s record completely, the agency asks us and we delete it, except receipts and payment records the agency needs to keep its accounts honest.
Before closing its account, the owner can download all of the agency’s data. We delete the agency’s data within 90 days of closing, unless the law requires us to keep something longer.
If an agency stops paying, its account becomes read-only. Nothing is deleted because of a late payment.

8. Your choices and rights

Agencies can see and correct their information, and the owner can download all of it in one Excel file at any time from Settings. Agencies can also ask us to delete records, or to close and delete their account.
Pilgrims and customers can ask the agency they booked with to show, correct or delete their information. If an agency doesn’t respond, you can contact us and we will pass your request to them.
Staff can ask their agency owner to update or remove their account.

9. Cookies and browser storage

Qafla keeps you signed in using your browser’s storage, and remembers small preferences such as whether you dismissed the “install the app” message. When the app is installed, it also keeps a copy of some screens on the device, so the group leader app works without internet. Qafla does not use advertising or tracking cookies.

10. Children

Agencies may enter details of children travelling with their families. This is used only to arrange the trip, for example rooms and documents. Qafla accounts are for agency staff only, not for children.

11. Changes to this policy

We may update this policy as Qafla grows. We will post the new version here with a new date. If a change is important, we will also tell agency owners in the app or on WhatsApp before it takes effect.

Contact us

Qafla is run by SMK Tech Labs. For any question about this page, your data or your account, contact us on WhatsApp at 0339 1491472.