Privacy Policy
Last updated: July 2026
The short version: we keep nothing
We store no images at all. Your passport scan is never uploaded anywhere — that tool runs entirely in your browser. Your portrait is transmitted once, over an encrypted connection, to Google, whose image model reformats it to the required specification; the result comes straight back to you and neither of us keeps it. We built HajjPhotos this way deliberately — pilgrims upload identity documents, and the safest data is data that is never kept.
1. Who we are
HajjPhotos (hajjphotos.com) is operated by Novamira. We provide an automated photo-formatting service for Hajj and Umrah applications. We are not affiliated with the Ministry of Hajj and Umrah or the Nusuk platform. You can reach us at mail@hajjphotos.com.
2. What we process, and for how long
- Passport scans: never leave your device. The cropping tool is plain JavaScript running in your browser — no upload, no server, no third party.
- Portrait photos: sent once over an encrypted connection to Google, whose image model performs the reformatting, and returned to you immediately. We operate no image storage of any kind, so there is nothing on our side to retain, and the image is not used to train models.
- Email address: used once to send your receipt and finished photo, and retained only in that email correspondence.
- Payment data: handled entirely by Stripe, a certified PCI-DSS Level 1 payment processor. Your card number never touches our systems.
- Usage data: standard analytics (page views, approximate location, device type) via Google Tag Manager, used to improve the service.
3. What we never do
- We never sell your personal data or images to anyone.
- We never use your photos to train models, and our provider is contractually barred from doing so.
- We never send your images to anyone beyond the single processing provider named above.
- We never upload your passport scan anywhere — it stays on your device.
4. Security
All traffic is encrypted with HTTPS. Payments run exclusively through Stripe's secure infrastructure. Because images are not retained, there is no stored-photo attack surface: the most privacy-protective architecture is the one with nothing to steal.
5. Your rights
You may request access to, correction of, or deletion of any personal data we hold (in practice: receipt emails and support correspondence) by writing to mail@hajjphotos.com. We respond within 30 days, usually much faster.
6. Changes to this policy
If we change this policy, we will update this page and the date above. Material changes will be noted prominently on the site.