Privacy
Privacy policy
20 Oct 2026 · Faisal Amjad
This policy explains what the Khalyfa Code collects about you, why we collect it, who else handles it, and how to have it deleted.
Draft for review: it needs checking by a solicitor or data protection adviser before it goes live.
The short version
- Your report sits behind a private link that only you receive. Nobody sees it unless you share it.
- We use your email to send your results, a link to resume if you stop part way, and occasional emails from Khalyfa that you can turn off at any time.
- Your answers can reveal your faith, so we ask for your explicit consent before you begin.
- Research use is optional, anonymised and separate. Saying no changes nothing about your result.
- We never sell your data. You can ask us for a copy of it, or ask us to delete it, at any time.
Who we are
The Khalyfa Code is run by Second Golden Age Limited, trading as Khalyfa, a company registered in England and Wales (company number 14876629), at 2 Highfield Road, Nottingham, NG16 1BS. In this policy, "we" and "us" means that company.
We are the data controller for the personal data described here. That means we decide how it is used and we are responsible for looking after it.
We are registered with the Information Commissioner's Office (ICO) under registration number C2064135.
For anything about your data, email info@khalyfa.com and put "Privacy" in the subject line.
What we collect
- What
- Contact details
- Examples
- Your email address, and your name if you give it
- Where it comes from
- You, at checkout or when you start
- What
- Payment details
- Examples
- Amount paid, date, Stripe reference, billing country
- Where it comes from
- Stripe. We never see or store your card number
- What
- Access codes
- Examples
- A workshop or invitation code, if you used one
- Where it comes from
- You
- What
- Assessment answers
- Examples
- Your choice on each of the 63 questions
- Where it comes from
- You
- What
- Your results
- Examples
- Your three-letter code, cluster scores, domain lean and written report
- Where it comes from
- Produced from your answers
- What
- Work questions
- Examples
- Your role, your sector, and how alive your work makes you feel
- Where it comes from
- You
- What
- Your Statement
- Examples
- The words you write into the blanks on your report
- Where it comes from
- You
- What
- Guide conversations
- Examples
- The messages you send the Guide and its replies
- Where it comes from
- You, and the AI that writes the replies
- What
- Research answers
- Examples
- Your consent choice and any optional background questions, such as age band and country
- Where it comes from
- You, only if you choose to answer
- What
- Technical data
- Examples
- Browser type, device, pages visited, approximate location from your IP address
- Where it comes from
- Your device, through essential cookies and, if you accept them, analytics cookies
- What
- Messages to us
- Examples
- Anything you write when you email us
- Where it comes from
- You
- What
- Practitioner waitlist
- Examples
- Your name, email, role and roughly how many people you work with
- Where it comes from
- You, only if you join the waitlist. We use it to tell you about the programme, with your consent, until you unsubscribe
We do not ask for your religion directly. But a faith-based assessment, and the answers you give in it, can reveal your religious beliefs. We treat it as sensitive data for that reason, and the next sections explain how.
Why we use it, and our lawful basis
UK data protection law says we must have a lawful basis for each use of your data. Here is ours.
- What we do
- Take your payment and give you access
- Lawful basis
- Contract: we need it to provide what you bought
- What we do
- Score your answers, write your report and keep it at your private link
- Lawful basis
- Contract, plus your explicit consent for the faith-related parts (see the next section)
- What we do
- Email you your results and a link to resume
- Lawful basis
- Contract
- What we do
- Answer your Guide messages
- Lawful basis
- Contract, plus your explicit consent
- What we do
- Keep your Guide conversation after it ends
- Lawful basis
- Your consent, which you give or refuse at the time
- What we do
- Use your anonymised answers for research
- Lawful basis
- Your explicit consent, which is separate and optional
- What we do
- Send you occasional emails about Khalyfa
- Lawful basis
- Your consent or, if you are a customer, the "soft opt-in" the law allows for similar products. Every email has an unsubscribe link
- What we do
- Analytics cookies
- Lawful basis
- Your consent, through the cookie banner
- What we do
- Keep the site secure, prevent fraud and fix problems
- Lawful basis
- Our legitimate interest in running a safe, working service
- What we do
- Keep payment records
- Lawful basis
- Legal obligation: tax and accounting law
- What we do
- Answer your emails to us
- Lawful basis
- Our legitimate interest in replying to you
How your code and reading are produced
Your three-letter code is worked out by a fixed scoring method. Each answer adds points to one or two of the fifteen clusters, and the highest scores give your letters. The same answers always give the same code.
Parts of your report, the personal reading and the Guide’s replies are written by an AI model, Claude, made by Anthropic. To write them, we send Anthropic your code, your scores and the relevant answers, and your work answers and Guide messages where they apply. We do not send your payment details. Under its commercial terms, Anthropic does not use data sent this way to train its models.
Your report is reflective. It is not therapy, diagnosis, or religious or career advice, and no decision with legal or similarly significant effects on you is made from it. A person can always review it with you: email us and Faisal will look at it himself.
Research
With the Muslim Purpose Institute, we study what the Khalyfa Code shows across the Ummah: how codes are spread, whether they hold steady over time, and how they relate to work. Our white paper at khalyfacode.com/research sets out the questions.
You can help, but only if you choose to. There is a separate box for it, left unticked. If you tick it:
- We use your answers, scores, work answers and any optional background answers for research.
- Before analysis, we remove your name and email and anything else that could identify you.
- We publish only combined findings, never anything about one person, and never in groups small enough to single you out.
- The Muslim Purpose Institute sees only the anonymised data.
You can change your mind at any time by emailing us. We will remove your data from future research. Findings already published cannot be unpublished, but they never identified you.
International transfers
Some of the companies above are based in, or store data in, the United States. Where your data leaves the UK, we make sure it stays protected, using one of the safeguards UK law recognises: the UK Extension to the EU-US Data Privacy Framework where the company is certified, or the UK International Data Transfer Agreement or Addendum. You can ask us for details.
Your stored answers and reports are held in Ireland, in the European Union, which the UK recognises as giving data an equivalent level of protection.
How long we keep it
Your report is meant to be something you come back to, so we keep it until you ask us to delete it. Everything else has a limit.
- Data
- Your answers, report and Statement
- How long
- Until you ask us to delete them, or 3 years after your last visit, whichever comes first
- Data
- An assessment started but not finished
- How long
- 90 days, then deleted
- Data
- Guide conversations you chose to keep
- How long
- 12 months
- Data
- Payment records
- How long
- 6 years, as tax law requires
- Data
- Email list membership
- How long
- Until you unsubscribe
- Data
- Research data
- How long
- Anonymised data can be kept for as long as the research needs it, because it no longer identifies you
- Data
- Emails you send us
- How long
- 2 years
- Data
- Backups
- How long
- Overwritten within 30 days of a deletion
Keeping it safe
Your data travels over encrypted connections and is stored with providers that encrypt it at rest. Access is limited to the few people who need it to run the service. Our AI and payment keys are kept on our servers and never reach your browser.
About your private link. Your report lives at a long, random web address that only you receive. It works like a key: anyone who has the link can open the report. Keep it as you would a password, and share it only with people you want to see your result. If you think someone has it who should not, email us and we will issue a new link.
Your rights
You have the right to:
- See your data. Ask for a copy of everything we hold about you.
- Correct it. Ask us to fix anything that is wrong.
- Delete it. Ask us to erase your data.
- Take it with you. Ask for your data in a format you can use elsewhere.
- Restrict or object. Ask us to pause or stop a use of your data, including anything based on our legitimate interests.
- Withdraw consent. Take back any consent you gave, for the assessment, research, the Guide, emails or cookies.
To use any of these, email info@khalyfa.com. We will reply within one month, and there is no charge. We may ask you to confirm your identity first, usually by replying from the email address you used.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
The Khalyfa Code is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you think a child has taken it, email us and we will delete their data.
A version for young people is planned. It will come with its own privacy notice and parental consent before it launches.
Changes and contact
If we change this policy, we will update the date at the top. If the change affects how we use data you have already given us, we will email you before it takes effect.
Questions, requests or concerns: info@khalyfa.com, or write to Second Golden Age Limited, 2 Highfield Road, Nottingham, NG16 1BS.
Questions about your data: info@khalyfa.com