Qiraa Corpus Privacy Notice

Qiraa Corpus is designed as a collaborative, versioned and attributable Islamic data infrastructure.

Public browsing of the Corpus does not ordinarily require a Corpus contributor account. To access contributor tools, you must first have a Qiraa account and request Corpus access.

If your request is approved:

• a public Corpus contributor profile may be created;
• your full name, work email, organisation, role and verification status may be publicly displayed;
• profile information that you choose to add, such as your biography, experience, qualifications and profile photograph, may also be public;
• your published Corpus contributions, reviews, commits, merges, discussions and other relevant activity may be permanently associated with your contributor history;
• drafts remain private unless you choose to make them public or they are otherwise submitted into a public workflow;
• additional verification is required before certain contribution, editing or review permissions are granted;
• identity and professional verification documents are not made public;
• published Corpus history is designed to be persistent and versioned rather than deleted or silently rewritten.

If you later request deletion of your personal data, Qiraa may remove or irreversibly separate your identity from historical Corpus activity where required or appropriate. The underlying Corpus contributions and non-personal historical record may continue to exist.

This is similar in principle to a source-control history: a contribution may later be corrected, superseded, merged or replaced, but the historical fact that the modification existed is ordinarily preserved.

A Qiraa account is required before you can request Corpus contributor access.

Your ordinary Qiraa account is handled under the main Qiraa Privacy Policy. This includes matters such as:

• your Qiraa login credentials;
• general account information;
• authentication and security;
• ordinary Qiraa usage data;
• cookies;
• general service communications;
• payments or donations, where applicable; and
• general Qiraa account deletion.

The Corpus internally links your Corpus contributor record to your Qiraa account.

Your underlying Qiraa account identifier and unrelated Qiraa account information are not displayed publicly through your Corpus profile.

Closing or deleting your Qiraa account does not necessarily remove material that has already been incorporated into the historical Corpus record. See Contributor deletion and QiraaDeletedUser below.

The normal Corpus access process is:

Stage 1 — Qiraa account

You create or use an existing Qiraa account.

Stage 2 — Corpus access request

You request access through the Qiraa Corpus service.

We may ask for information including:

• your full name;
• Qiraa account identifier;
• professional or work email address;
• organisation or institution;
• professional or scholarly role;
• reason for requesting access;
• proposed area of work; and
• other information reasonably necessary to assess your request.

Stage 3 — Initial approval

If Qiraa approves your application, a public Corpus profile may be created with an unverified status.

An approved but unverified account may have access to certain Corpus tools but will not automatically receive editing, review, approval or other privileged permissions.

Stage 4 — Profile completion

You may add further public profile information, including:

• qualifications;
• professional or scholarly experience;
• biography;
• profile photograph;
• areas of expertise;
• institutional affiliations; and
• other optional profile information.

The Corpus interface will identify information intended to be public.

Stage 5 — Verification

You may complete identity, qualification, role or affiliation verification.

Successful verification may be required for editing, review, validation or other privileged Corpus permissions.

Verification does not guarantee any particular permission. Qiraa may restrict permissions according to role, expertise, workflow requirements, security requirements or the Contributor Terms.

A. Access request information

We process information submitted when you request Corpus access, including your:

• name;
• work email;
• organisation;
• role;
• Qiraa account linkage;
• application information; and
• reason for requesting access.

B. Public contributor profile

Once approved, your public profile may include:

• full name;
• work email;
• organisation;
• role;
• profile photograph;
• biography;
• professional experience;
• qualifications;
• areas of expertise;
• verified or unverified status;
• verification badges;
• contribution history;
• review history; and
• other information you deliberately add to your public profile.

You should not upload information to your public profile that you do not want publicly accessible.

C. Identity verification information

Identity verification may require photographs or copies of identification documents and, depending on the verification provider, may involve photographs or video of you.

Where practicable, Qiraa uses a specialist third-party verification provider to perform identity verification.

Qiraa aims to receive only the minimum verification result required, such as:

• verification successful or unsuccessful;
• verification date;
• provider reference;
• verification method; and
• limited audit information.

Qiraa does not publicly display your passport, driving licence, identity photographs, document number, home address or other underlying identity evidence.

D. Qualification and professional verification

You may provide evidence supporting claimed:

• qualifications;
• academic credentials;
• scholarly credentials;
• employment;
• professional positions;
• institutional affiliations; or
• other relevant experience.

Qualification verification may be carried out manually by authorised members of the Qiraa team.

Supporting documents are stored separately from the public Corpus profile and are subject to restricted access.

Only information necessary to communicate the verification result is displayed publicly.

E. Employment and current-role verification

Where a current job, institutional role or professional affiliation is shown as verified, verification will normally require renewal at least once every 12 months.

If verification expires or cannot be renewed, Qiraa may remove the verified status while leaving the user-supplied role visible as unverified.

F. Corpus activity and provenance

Qiraa records activity necessary to operate and preserve the Corpus contribution process.

This may include:

• contributions;
• commits;
• amendments;
• merges;
• reviews;
• validation decisions;
• approvals;
• disputes;
• rejections;
• corrections;
• timestamps;
• affected Corpus records;
• version information;
• contributor and reviewer relationships;
• workflow actions; and
• historical changes.

Published activity may appear on your public contributor profile and within the relevant Corpus record.

G. Drafts

Draft work is private by default unless:

• you expressly publish it;
• you submit it into a public workflow; or
• the relevant Corpus feature clearly states otherwise before submission.

Qiraa may still process private drafts internally where necessary to provide the drafting functionality, maintain security or recover data.

H. Corpus discussions and messages

Messages, comments and discussions attached to public Corpus tickets, reviews, commits or similar collaborative records are intended to form part of the Corpus discussion history.

Different rules may apply to private communications with Qiraa, support requests or security reports.

I. Voice recitations and audio

Where Corpus functionality allows you to submit a voice recitation, Qiraa may process:

• the audio recording;
• passage or source information;
• recording date;
• recitation type;
• contributor identity;
• review and validation information;
• linguistic, tajweed or recitation metadata; and
• other technical metadata necessary for Corpus use.

Additional information will be shown before recording where a particular audio feature involves materially different processing.

J. Technical and security information

The Corpus may also process limited technical information necessary for security and operation, including:

• IP address;
• authentication events;
• device or browser information;
• timestamps;
• security logs;
• error information;
• session information; and
• activity required to detect abuse or unauthorised access.

K. Canonical contributor references and Master Attribution Set

Corpus records use stable internal actor references to associate structured historical activity with contributors.

Historical Corpus datasets and releases do not ordinarily embed a contributor's public profile information directly within each Contribution record. Instead, structured activity may contain a canonical Qiraa Actor ID.

Public attribution associated with those Actor IDs is maintained separately through Qiraa's current Master Attribution Set.

The Master Attribution Set may contain information necessary to resolve an active Actor ID to the relevant public contributor profile, including the contributor's name, organisation, role and verification information.

Qiraa periodically regenerates the public Master Attribution Set so that changes to contributor status and applicable de-identification requests can be reflected without rewriting the underlying historical Corpus data.

General Qiraa handling of this information is described in the main Qiraa Privacy Policy.

Qiraa Corpus is intentionally attributable.

Once your Corpus account is approved, the following information may be publicly accessible:

• full name;
• work email;
• organisation;
• professional or scholarly role;
• verification status;
• qualifications you choose to display;
• biography;
• experience;
• profile photograph;
• contributions;
• commits;
• merges;
• reviews;
• public discussions;
• public recitations and associated attribution; and
• other profile information that you choose to publish.

This information may be accessible without a Qiraa account.

Because this information is public, it may also be:

• indexed by search engines;
• cached;
• quoted;
• referenced;
• copied by researchers or developers;
• included in references or citations;
• accessed through future Corpus interfaces; or
• independently retained by third parties.

Removing information from Qiraa's own systems does not necessarily remove copies independently obtained, cached or published by third parties.

Qiraa may take reasonable technical measures to discourage abusive harvesting or misuse of contributor information, but cannot guarantee that publicly accessible information will not be copied.

Corpus contributors must normally provide a professional, institutional or work email address.

A named work email address is treated as personal information where it identifies you.

Your work email may be publicly displayed on your contributor profile so that your professional attribution can be verified and legitimate Corpus-related contact can take place.

You should not use a private or personal email address as your public Corpus work email unless you are comfortable with it becoming public.

Qiraa may choose to exclude work email addresses from bulk Corpus exports or other machine-readable datasets even where they remain visible through public contributor profiles.

Identity verification

Identity verification may be performed by a specialist third-party provider.

The provider may collect identity documents, photographs or other information required to verify your identity.

Where facial matching or another biometric recognition process is used, additional privacy information may be provided at the point of verification.

Qualifications

Qualification documents may be reviewed manually by authorised Qiraa personnel.

Original supporting evidence is not displayed publicly.

Qiraa may record:

• the qualification;
• awarding institution;
• verification outcome;
• verification date;
• verification reference; and
• relevant reviewer information.

Employment and affiliation

Current employment or affiliation claims may require evidence such as:

• an institutional email;
• staff identification;
• employment documentation;
• institutional confirmation; or
• another suitable form of evidence.

Current employment verification normally expires after 12 months and must be renewed if the contributor wishes to continue displaying the role as verified.

Failed automated verification

Where an automated verification system cannot verify you, Qiraa may provide an alternative or manual review route where appropriate.

An automated verification failure does not necessarily mean that Qiraa has determined that your information is false.

Qiraa may process Corpus-related personal information to:

• evaluate Corpus access requests;
• create and administer contributor accounts;
• determine eligibility for contribution or review permissions;
• verify identity;
• verify qualifications and institutional affiliations;
• prevent impersonation and fraudulent attribution;
• maintain contributor accountability;
• attribute Corpus work to its contributors;
• operate contribution and review workflows;
• resolve disputes;
• preserve research and data provenance;
• maintain historical Corpus versions;
• provide public contributor profiles;
• operate discussion and collaboration tools;
• maintain the security and integrity of the Corpus;
• investigate misuse or policy breaches;
• respond to legal obligations;
• defend legal claims;
• improve Corpus reliability and workflows; and
• otherwise operate Qiraa Corpus.

Depending on the processing involved, Qiraa may rely on one or more lawful bases under applicable data protection law.

Contract

Where processing is necessary to provide contributor functionality or perform obligations associated with the Corpus contributor relationship.

Legitimate interests

Qiraa has legitimate interests in:

• maintaining a trustworthy Corpus;
• preventing impersonation and fraud;
• providing verifiable scholarly attribution;
• maintaining contributor accountability;
• preserving provenance;
• maintaining version and contribution history;
• securing the service;
• investigating abuse;
• preserving data integrity; and
• enabling reliable use and citation of Corpus releases.

Where we rely on legitimate interests, we consider the necessity of the processing and its effect on your rights and interests.

Legal obligations

We may process information where necessary to comply with applicable law, regulatory requirements or lawful requests.

Consent

Where a particular activity legally requires consent, we will request it separately.

This may apply, for example, to certain biometric verification processes or optional processing that is not necessary for the ordinary Corpus relationship.

Where special-category personal data is processed, Qiraa will also identify an applicable legal condition where required.

Qiraa Corpus is designed around a versioned, append-oriented historical model.

Published contributions are therefore not treated like ordinary social-media posts or editable account content.

Once a change has been committed to the Corpus, it may form part of:

• an immutable commit history;
• a published Corpus version;
• a downstream dataset;
• a research reference;
• an API response;
• a derived dataset;
• a validation history; or
• a later Corpus build.

A published contribution may subsequently be:

• amended;
• corrected;
• superseded;
• merged;
• disputed;
• reverted in a later version; or
• replaced by another contributor.

However, the historical record showing that the earlier change existed may remain.

Qiraa does not ordinarily rewrite an earlier Corpus release so that it represents information differently from the version originally published.

Where personal attribution associated with a historical contribution must be removed or restricted, Qiraa may modify the attribution layer without deleting or altering the underlying non-personal Corpus contribution.

If you close your Corpus account or make a valid request that requires the removal or de-identification of personal information, Qiraa may remove or de-identify personal information associated with your contributor profile and historical Corpus activity where appropriate.

This may include:

• your name;
• work email;
• organisation;
• role;
• profile photograph;
• biography;
• public qualifications;
• profile links; and
• other identifying profile information.

Structured Corpus Contributions

Structured Corpus records use a canonical Qiraa Actor ID rather than embedding your personal profile information directly into each historical Contribution.

Where your personal attribution is removed, the Actor ID may remain within Corpus records while its current public attribution is updated to resolve to the Qiraa institutional entity.

For example, a Contribution previously displayed as:

Contributor: [Your Name]

may subsequently be displayed as:

Contributor: Qiraa

This institutional attribution identifies Qiraa as the entity maintaining and administering the de-identified Contribution within the Corpus. It does not necessarily mean that Qiraa was the original human author of the Contribution.

Public messages and discussions

Public messages, comments and discussion records are treated differently from structured Corpus Contributions.

Where your personal attribution is removed, these records may instead be displayed under the generic identity QiraaDeletedUser.

This preserves the historical discussion without representing the original statement as having been authored by Qiraa.

Voice Contributions

Where identifying information associated with a voice Contribution is removed, Qiraa may remove the contributor profile association and other identifying metadata while retaining the underlying recording where Qiraa has a lawful basis to do so.

A voice recording will not be represented as having been personally recited or performed by Qiraa merely because its original contributor attribution has been removed.

Master Attribution Set

Qiraa maintains a separate Master Attribution Set used to resolve canonical Actor IDs to their current public attribution.

Approved attribution changes and de-identification actions are incorporated into the current Master Attribution Set without requiring Qiraa to reconstruct individual historical Corpus releases.

Historical and archived Corpus datasets containing an Actor ID should therefore be interpreted using the current Master Attribution Set where current contributor attribution is required.

Timing

Changes to your account, public profile and other live Qiraa services are processed without undue delay where an applicable request requires them.

Qiraa periodically compiles and publishes an updated Master Attribution Set. Approved attribution and de-identification changes are ordinarily incorporated into the next available public compilation.

Irreversible de-identification

Where Qiraa completes an irreversible de-identification process, the link between your former personal identity and the affected historical Corpus activity may be permanently severed.

Once that link has been irreversibly removed, Qiraa may be unable to restore your previous personal attribution.

Where Qiraa retains information that can still reasonably be used to reconnect an Actor ID with you, that information remains subject to applicable data-protection requirements.

A request concerning personal information does not automatically revoke intellectual-property rights or licences previously granted in relation to Corpus Contributions. Contribution ownership and licensing are governed separately by the Qiraa Corpus Contributor Terms and Contribution Licence.

Public Corpus messages and discussion records are intended to preserve the reasoning and review history surrounding Corpus changes.

Unless a particular feature states otherwise:

• a public message may be edited by its author for up to 24 hours after posting;
• after the editing period expires, the author cannot ordinarily modify or delete it;
• the message remains part of the relevant historical discussion record.

Qiraa administrators may nevertheless redact, restrict, correct or remove a message where necessary for:

• legal compliance;
• privacy;
• security;
• abuse prevention;
• confidential information;
• intellectual-property complaints;
• safeguarding;
• moderation; or
• enforcement of Qiraa policies.

If your account is deleted or your personal attribution is removed, historical messages may remain attributed to QiraaDeletedUser.

If the body of a message itself contains personal information that must be erased or restricted, merely changing the author name may not be sufficient. Qiraa may therefore redact or remove identifying information from the message while preserving the surrounding discussion structure.

Voice recitations accepted into the Corpus are intended to form part of the long-term Corpus record.

While associated with an active contributor profile, a recitation may display relevant attribution and metadata.

If you later request deletion or de-identification of your personal information, Qiraa may remove:

• your contributor identity;
• name;
• profile association;
• email;
• organisation;
• role;
• personal profile metadata; and
• other direct links between the recording and your contributor identity.

Qiraa may seek to retain the underlying audio as part of the Corpus where it has a lawful basis to do so.

However, removing account metadata does not necessarily make a voice recording anonymous. Where the audio itself remains personal information because you can still reasonably be identified from it, Qiraa will consider any applicable request for erasure, restriction or objection in accordance with applicable law.

Where necessary, Qiraa may:

• delete the recording;
• further de-identify or transform it;
• restrict its use;
• restrict public access;
• retain it where applicable law permits continued retention; or
• retain an effectively anonymised version.

Submitting a Corpus recitation may also be subject to the Qiraa Corpus Contributor Terms and Contribution Licence.

Different Corpus information is retained for different periods depending on its purpose.

Access applications

Application information is retained for as long as reasonably necessary to:

• process the application;
• administer appeals or follow-up requests;
• prevent repeated abuse or fraud;
• maintain security; and
• meet legal obligations.

Information no longer reasonably required is deleted or anonymised according to Qiraa's retention procedures.

Public profile information

Public profile information is generally retained while your contributor account remains active or while it remains necessary for attribution.

You may update current profile information through the available profile controls.

Verification documents

Underlying identity and qualification documents should be retained only for as long as required to perform verification, resolve reasonable disputes and satisfy applicable compliance requirements.

Where a third-party verification provider holds the original document, its own documented retention period may apply.

Qiraa may retain a substantially smaller verification record after the original evidence is no longer necessary.

Verification outcomes

Verification status and audit information may be retained for as long as necessary to administer contributor permissions, preserve provenance and demonstrate the integrity of historical Corpus activity.

Employment verification

Current-role verification normally expires after 12 months.

Evidence submitted for a renewed verification should not be retained indefinitely merely because an earlier document existed.

Contributions and provenance

Published Corpus contributions and non-personal version history may be retained for the lifetime of the Corpus and its historical releases.

Personal attribution attached to that history is subject to the principles and rights described elsewhere in this Notice.

Messages

Public Corpus discussions may be retained as part of the permanent review and provenance history, subject to legal, privacy and moderation requirements.

Audio

Accepted Corpus audio may be retained for long-term Corpus use where lawful and necessary.

Security information

Security logs and technical information are subject to limited or rolling retention unless they are required for an active security investigation, dispute, legal obligation or claim.

Qiraa does not sell personal information as advertising or customer-profile data.

We may disclose relevant personal information to:

• identity verification providers;
• verification and credential providers;
• secure hosting or storage providers;
• authentication providers;
• infrastructure and security providers;
• communications providers;
• professional advisers;
• auditors;
• regulators;
• courts;
• law-enforcement bodies where legally required; and
• other processors reasonably necessary to operate the Corpus.

Public Corpus information is, by its nature, also available to members of the public.

Corpus data itself may be distributed, licensed, accessed through APIs or otherwise made available in accordance with Qiraa's Corpus licences and Contributor Terms.

Qiraa may exclude or minimise personal contributor information in bulk or machine-readable releases even where equivalent information remains visible through a public contributor profile.

A third-party verification provider may act as Qiraa's processor, an independent controller, or in another legally recognised role depending on the service being provided. Where appropriate, the provider's own privacy information will be made available during verification.

Some Qiraa service providers may process information outside the United Kingdom.

Where applicable data protection law requires additional safeguards for an international transfer, Qiraa will use an appropriate transfer mechanism and assess the protection available for the information.

The main Qiraa Privacy Policy contains additional information about Qiraa's general international data-transfer practices.

Qiraa applies technical and organisational measures appropriate to the nature and risk of Corpus information.

Corpus design should separate:

• public contributor information;
• private account information;
• authentication information;
• verification evidence;
• internal audit information; and
• Corpus content.

Access to identity and qualification evidence is restricted to authorised personnel and providers who require it for the relevant purpose.

Qiraa also uses security controls intended to detect unauthorised access, abuse and attempts to compromise contributor or Corpus systems.

No internet-connected system can be guaranteed to be completely secure.

You are responsible for keeping public profile information reasonably accurate.

You should update Qiraa if:

• your work email changes;
• you leave your organisation;
• your professional role changes;
• a displayed qualification is incorrect;
• your affiliation changes; or
• other publicly displayed information becomes inaccurate.

Changing your current profile does not necessarily rewrite historical records.

For example, a historical contribution may legitimately record the organisation or role you held at the time that work was performed.

Where personal information is inaccurate for the purpose for which it is held, Qiraa may correct the attribution layer without altering the underlying historical Corpus contribution.

Your use of an Islamic Corpus, profile biography, qualifications or professional role may in some circumstances reveal information that receives additional protection under data protection law.

Qiraa does not ask contributors to provide unnecessary sensitive information.

You should not place sensitive personal information in:

• public biographies;
• commit messages;
• reviews;
• discussions;
• drafts intended for publication; or
• other Corpus content

unless it is genuinely necessary and appropriate for the relevant Corpus purpose.

Where Qiraa intentionally processes special-category personal information, it will identify an appropriate legal basis and additional condition where required.

Identity verification may involve automated technology operated by a specialist provider.

Where automated processing materially affects whether you can complete verification, Qiraa will provide appropriate information about the process and any rights that apply.

Where appropriate, you may be able to request manual consideration if automated verification fails.

Qualification verification is ordinarily carried out manually.

Qiraa does not intend to make significant scholarly contribution or review decisions solely on the basis of automated identity-verification technology.

Depending on applicable law, your location and the lawful basis used for a particular processing activity, you may have rights including the right to:

• be informed about how your information is used;
• access personal information held about you;
• correct inaccurate or incomplete information;
• request deletion of information in applicable circumstances;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to a relevant supervisory authority.

These rights are not identical in every circumstance.

In particular, the right to deletion is not an unconditional right to rewrite historical Corpus data.

Where Qiraa can lawfully preserve a non-personal, anonymised or otherwise retainable Corpus contribution while removing your personal attribution, it may do so.

If Qiraa declines all or part of a rights request, we will explain the applicable reason where required by law.

You may contact Qiraa to request:

• access;
• correction;
• deletion;
• de-identification;
• restriction;
• objection; or
• another applicable data-protection right.

Qiraa may need to verify your identity before acting on a request.

For Corpus-related requests, please use the privacy contact information provided by Qiraa.

Qiraa will handle requests within the time limits required by applicable law.

Public Corpus browsing may be available more broadly in accordance with Qiraa's general terms.

Unless Qiraa expressly provides a separate approved process, Corpus contributor, editing and reviewer access is intended for persons aged 18 or over.

If Qiraa introduces contributor access for younger users in the future, additional safeguards, privacy information and approval requirements may apply.

Qiraa may update this Privacy Notice as the Corpus, applicable law, verification methods or processing activities change.

The latest version will display an updated effective date.

Where a change materially affects how contributor personal information is used, Qiraa will provide reasonable notice where appropriate.

Historical versions of this Notice may be retained for accountability.

Qiraa may make this Privacy Notice available in multiple languages.

Translations are provided to improve accessibility and understanding.

If there is an inconsistency between translated versions, the English version will be treated as the reference version to the extent permitted by applicable law.

If you have a concern about how Qiraa handles your personal information, please contact Qiraa first so that we can investigate it.

You may also have the right to complain to the Information Commissioner's Office (ICO) or another competent data-protection supervisory authority.

Exercising a data-protection right will not affect your right to raise a complaint.

Qiraa Ltd
Registered in England & Wales (Company No. 16939592)

Privacy and data-protection enquiries should be sent using the contact details stated in the main Qiraa Privacy Policy.

For general Corpus enquiries, use the contact details provided through Qiraa Corpus.

This Privacy Notice should be read together with:

• Qiraa Privacy Policy;
• Qiraa Terms of Service;
• Qiraa Cookie Policy;
• Qiraa Corpus Contributor Terms;
• Qiraa Corpus Contribution Licence; and
• any specific privacy information presented during identity verification, qualification verification or other specialist Corpus processing.