Last updated: October 30, 2026
PLEASE READ THIS POLICY CAREFULLY
This Policy describes how Amal Invest ("Amal Invest," "we," "our," or "us") collects, uses, shares, retains, and protects your personal information when you use our website and app (the "Services"), and sets out the rules for acceptable use of the Services. It is incorporated by reference into our Terms of Service.
Amal Invest is a software service that helps you screen funds and stocks for Shariah compliance and build and manage a halal portfolio. We are not a broker, custodian, or investment adviser and we are not a regulated financial institution. We do not hold your money or your investments. Trades are placed through your own account at a third-party broker such as Trading 212 or Alpaca Securities LLC.
We operate from Bahrain. For the purposes of data protection law, including the UK GDPR and the EU General Data Protection Regulation ("GDPR"), we are the data controller for the personal information described in this Policy.
When you connect a broker account, we store the credentials needed to act on your behalf (an OAuth token for Alpaca, or an API key and secret for Trading 212) and read your holdings, cash balance, orders, and account activity so we can screen, rebalance, and report on your portfolio. We do not collect or store the identity documents, tax numbers, or bank account details you provided to your broker. Those stay with the broker.
Subscriptions are processed by Stripe. Stripe collects and stores your card details. We store your Stripe customer identifier, subscription plan, and payment status, not your card number.
Where GDPR applies, we rely on performance of our contract with you, our legitimate interests in running and improving the Services, your consent for marketing emails and non-essential cookies, and compliance with legal obligations.
We do not sell your personal information. We share it with:
We are based in Bahrain and our service providers process data in the United States, the European Union, and the United Kingdom. Where we transfer personal information out of the UK or EU, we rely on the recipient's adequacy status or on standard contractual clauses.
We protect your information with encryption in transit, hashed passwords, encrypted storage of broker credentials, optional two-factor authentication, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
We keep your information for as long as your account is open and for as long afterwards as we need it to resolve disputes, meet legal and accounting obligations, or enforce our terms. When your account is deleted, we delete or anonymise your personal information and revoke stored broker credentials, except for records we are required to keep.
Depending on where you live, you may have the right to:
To exercise any of these rights, email [email protected]. You can disconnect your broker at any time from within the app, and we will delete your account on request.
The Services are not directed at anyone under 18 and we do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.
We may update this Policy to reflect changes in the Services or the law. For significant changes we will give at least 30 days notice by email or in the app. Continued use of the Services after a change means you accept the updated Policy.
When using the Services you agree not to:
We may suspend or close accounts that breach these rules and cooperate with authorities where required.