Privacy policy
What happens to what you tell us
A council that asks people to raise concerns about businesses owes them a straight answer about who will see it. That answer is the middle of this page, not the small print at the end.
Effective October 25, 2026 ยท [email protected]
Who we are
This website is run by Halal Community Council, a South Carolina nonprofit in formation ("HCC"). Halal Community Council is a small membership council. Businesses are checked against a published Standard, and those that pass join and agree to a set of expectations. Community members look for the seal, read its record on the Register, and can raise a concern when something does not feel right. Both sides give us information, and the two are handled differently.
This page covers the website and the case process run through it. Where a membership agreement says something more specific, that agreement governs the membership and this page governs the site.
If you raise a concern about a business
What we will always do is tell you first. Before your name or contact details are given to a business, we ask you. If you would rather stay unnamed, say so, and we will either raise the substance without identifying you or tell you honestly that the case cannot proceed that way. You decide, not us.
When you are signed in, the concern form asks two separate questions; signed out, it asks only the second. Every box starts unticked:
- Your name. Whether HCC may tell the business who you are. Without a yes, given for that case, we never name you to the business.
- What you wrote. Whether HCC may share what you wrote with the business, without your name unless you allowed that too. Without a yes, what you wrote stays inside HCC.
You can share a concern without an account. Then we hold no contact details for you, and we cannot write back. Accounts are not open yet, so for now, if you would like a reply, use the message form on the Contact page instead, with your email address. One limit applies to everyone: HCC cannot keep a name private when a court, a regulator or the law requires it.
If you tell us about a concern another way, such as by phone or in person, a member of HCC's case staff enters it in the case system for you, in your words, and asks you the same two questions. The case also records how it reached us, which staff member entered it, and any name and contact details you gave. Your contact details are seen only by HCC's case staff and are never put in an email. Your name reaches the business only if you said yes to the first question.
How a case actually moves
-
You tell us what happened
What you write in the form: the business, where and when, what happened, and what you hope will happen. If you are signed in, your account's name and email come with it. You may also add up to 5 photos or PDF files, such as a receipt or a screenshot. They go into the same private vault as evidence from a check: no web address reaches them, only HCC staff working on your concern can open them, every opening is logged with who opened it, when and why, and they are deleted with the case file. They never go into the business's own file or its portal. If the form is unusually busy, if the files sent with concerns that day would pass the room set aside for them, or if one account sends more than 5 concerns in a day, a concern is still kept, but without its files, and the form tells you so. If we need to see another file, we ask and tell you how to send it.
-
We decide whether to open a case
Some concerns are answered directly without a case at all. If we can reach you, we acknowledge your concern within 2 business days.
-
The business is asked to respond
They see the substance of the concern. Whether they see who raised it depends on the answer you gave us.
-
You may be asked to respond in turn
And either side may appeal the outcome.
-
The case is closed and recorded
Kept as part of the Council's record of that business, and never published.
Concerns are never published with your name attached, or at all. We do not post complaints publicly, and we do not pass your details to anyone outside the Council and the business concerned. Two exceptions are about safety, not the case: if someone describes current danger to a person, we direct them to emergency services; and a credible report of illness or a health hazard is passed to the local health department, because HCC does not judge food safety.
If you are a business
A membership application gives us your business details, the people we deal with, and what you tell us about how you operate. In practice that means the location's name, address, phone and website; the owner's legal name, the business's tax number and license number; the suppliers and certifiers you name; whether you also sell non-halal items; your visit preferences; and the consents every check needs. The owners and managers who sign in to the business portal each have an account with a name and an email address.
A check adds evidence: the invoices and certificates you upload or show us, photos of products, labels, storage and equipment, and any announced recording of a walkthrough or interview. HCC records only openly. The checker announces a recording before it starts, anyone may decline, and HCC never records customers or records in secret. Photos are framed to avoid faces. Evidence is kept in a private vault outside the public part of the website: no web address reaches it, only people whose role needs it can open it, and every opening of a file is logged with who opened it, when and why.
HCC has also built a list of food businesses in Horry and Georgetown counties, South Carolina, from public records: state food permit records and public map listings. It holds each business's name, its public mailing address and, where the business publishes one, its email address. HCC will use it once, to send a one-time notice by postcard and email, and will log each notice and each "no thanks".
Through membership we also hold the case history for your business, including concerns raised, your responses, and outcomes. That record is the Council's, and it is what the seal stands on. It is not sold, not shared with other businesses, and not published as a league table.
What the public sees is your record on the Register: the level or status, the dates, what the check covered and did not cover, the dated facts with their basis, and any HCC service you used in the past year. It never shows the contents of your file, your evidence, or any concern or case. You see a preview of your record for 3 business days before it is published. A first check that does not pass publishes nothing. A record that ends shows "Not currently verified" with one neutral reason for 12 months, then comes down.
If you buy an HCC Service or a course seat
HCC Services are kept apart from checks, and so is what they collect. A services file holds what the service needs: for a readiness review, the recording and photos of the walkthrough; for a wording review, the menus, signs and pages you send and our written notes; for the supplier paperwork setup, the supplier documents you load. HCC records only openly, announces any recording at the start, and frames photos to avoid faces. A services file is never used in a check.
An order for a service holds the business account that placed it, the service, the place it is for (or, for a business not on HCC yet, its state or province), the price, the date and where the order stands. A payment adds the amount, the date and the payment processor's reference, never a card number. Staff get an email saying only that an order is waiting.
An event check records the food provider, the event and what was checked. If a host orders it, HCC keeps the host's name and contact details to arrange the visit and never publishes them. Workshop sessions may be recorded, with an announcement at the start; registered businesses that miss a session can watch the recording for 30 days.
The HCC Academy (open from January 15, 2027) runs on HCC's own website. There is no outside course platform. A learner has no account and no password. An owner or manager of a business adds each learner by name, with an email address only if they choose, and gives the learner a private link. HCC keeps that link only as a coded fingerprint that cannot be turned back into it. When the learner opens the link, their browser keeps it in a cookie for that one course, which ends when the browser closes, and the pages after that show only the course's own address, never the link. The Academy keeps which lessons a learner finished and, for each quiz attempt, the score and the date, never the answers. Nothing about the learner's device, IP address or the page they came from is kept.
A learner who passes a course's quiz gets a completion record: its number, the course, the learner's name, the business, the date and whether it is current. The business sees its own learners' progress and records. Anyone with a record number can look it up and see the course, the learner's first name and last initial, the business when it is listed on the HCC Register, the date and whether the record is current, never the full name. Record numbers carry a random part, so they cannot be guessed one from the next. At a Pillar or Keystone check, the checker sees how many current records the business has for the HCC staff course, never a name, and no staff member's name ever appears on the public record. A completion record is not a seal and not a certification. Academy pages are never cached, ask search engines not to list them, carry no visit-counting script, and never pass a learner's link on to another site.
What the website itself collects
- What you type into any of the forms, which is stored on our own server.
- Your email address, if you asked to hear from us. The notify-me list keeps your email, the state (or "any new state or province") and the date, nothing else, and nothing at all until you confirm with our link within 7 days. So that no one can use the form to fill someone's inbox, it sends one address at most one confirmation a day for each state and three in all; it counts them under a coded fingerprint of the address that cannot be turned back into it, kept for 2 days. When you take your address off the list, a coded fingerprint of the same kind stays for 9 days, so an older confirmation link cannot put it back.
- A message you send through our message form: what it is about, your words, whether you want a reply, and your name and email address only if you give them. It is stored on our own server and never published. Only HCC's case staff can read it. Staff get an email saying only that a message is waiting, never what it says. If you ask for a reply, we answer from the site's own mail system to the address you gave, and keep our reply with your message.
- A request that we check a place: the place's name, city and state or province, any note you add, and your email address only if you give it. We never ask your name, never publish the request, and never tell the business who asked. Only the HCC staff who handle applications can see it. If you left your email address, we may write to you once with one fixed sentence about what became of the request.
- An offer of a member perk from a company: the company's name, one email address to write back to, and what the company writes about the perk (what it is, who can redeem it, its value and the states it serves), with the box that says HCC may keep it. We never ask for a person's name. It is stored on our own server and never published, and HCC's check system never reads it. Only the council officers who keep the perks catalog can see it. They get an email saying only that an offer is waiting, and they write back from HCC's own address.
- An application to work with HCC, through the form on the Work with HCC page while HCC is hiring checkers: your name, your email address, your phone number if you give it, the county you live in, the days and times you could do visits, whether you have a driver's license and a car you can use for work, the experience you describe, the languages you speak, how you heard about the job, any note you add, and the box that says HCC may keep it. We never ask about your religion, your beliefs, your age, your family, your health or where you come from, and we take no resume or file at this step. It is stored on our own server and never published. Only council officers can read it, and every step it moves through is recorded with the officer and the date. They get an email saying only that an application is waiting, and they write back from HCC's own address.
- If you have an account, your name, your email address and your password, which is stored scrambled so no one can read it. When you sign in, WordPress, the software the site runs on, notes your IP address and browser type with that sign-in session, so the session can be checked and ended. Signing out ends that session and removes its record. An expired session's record is removed within a day.
- Ordinary web server records as pages load: IP address, browser type, which page and when. These are kept by our hosting and network protection services in their own logs, to run the site and block attacks. Those logs are being set to a short rolling window before the first application.
- Failed sign-ins. To block break-ins, the site's login protection keeps the IP address and the username of failed sign-ins, and of any lockout, for 30 days. Our maintenance contractor receives security alerts: the username tried in a failed sign-in, and the email address of any new administrator account.
- Seal counts. When a business shows its live seal on its own website, we count how many times each seal was shown and followed, as daily totals only, with no IP address, no referring page and no cookie.
HCC's own record, case and form software stores no IP address: not with a concern, not with a message, a request to check a place, a perk offer or an application to work with HCC, not on the notify-me list, and not with the seal counts. The only IP addresses the site keeps are the sign-in records above. Visitors who do not sign in get no cookies from the site's pages; opening the sign-in page sets a test cookie, and our hosting and network protection services may set short-lived security cookies. Signing in sets the sign-in cookies that keep you signed in, and they end when you sign out or they expire. When you send one of our forms, your own browser keeps what you typed in that tab (its session storage, not a cookie), so that if the form comes back asking you to fix something, your words are still there. It never reaches HCC unless you send the form, and it is cleared the next time a page with that form loads, or when you close the tab.
HCC counts visits with Cloudflare Web Analytics, a cookie-free visitor count from our network protection service. A small script on each page (except HCC Academy's learner pages, which carry none) reports the page viewed, the site that sent you, your browser and device type, your country and how fast the page loaded. It sets no cookie, does not follow you to other sites, and HCC sees only totals, never a person. There is no advertising pixel and no cross-site tracking on this site. Fonts and images are served from our own server, so reading a page tells no one else that you did. Nothing here is profiling you for looking up a business. HCC's weekly internal summary, which council officers receive by email on Mondays, holds counts only, never a name, a business, an email address or a word from a case or a message.
Who else can see anything
We name the companies we use by the job they do. Each one sees only what that job needs.
| Who | What they do, and what they can see |
|---|---|
| Hosting | Our hosting company hosts the site and its files, and carries the mail for HCC's own addresses. It can technically reach everything stored here, including case files and the evidence vault. |
| DNS and network protection | Points the site's address to our server and filters traffic to block attacks. It handles each visitor's IP address and the page requested as traffic passes through, and it provides the cookie-free visitor count described above. |
| Email delivery | Delivers the emails the site sends, such as confirmations, case updates and invoices, so it handles their addresses and contents. HCC's emails carry no tracking images. |
| Payments, when they open | When online payment opens, you pay on the payment processor's own page. HCC receives the amount, the date and the processor's reference, never your card number. Until then, nothing can be bought on this site. |
| Backup storage | Every night a copy of the site and its database, and of the evidence vault, is sent to a cloud storage provider so the site can be restored after a failure. The database copy is encrypted; the vault copy is not. It holds everything the site holds. Copies are deleted after 30 days. |
| Software and service providers | Other companies whose software or services help HCC run its work, such as office, document and communication tools. Each one gets only what its task needs, under terms that keep it confidential and let the provider use it only to do that work for HCC, on HCC's instructions. |
| A website maintenance contractor, to be bound by a written confidentiality agreement once HCC is filed | Builds and maintains the site over a cryptographically signed connection, reaching what an administrator reaches. It receives the security alerts described above. |
| A printing and mailing company | Will print and mail HCC's one-time notice to food businesses. It receives business names and public mailing addresses only, never anything about a person who uses this site. |
| Directories that license HCC's status | Receive only what the public Register already shows: name, city, status, dates, the scope summary and the record link, and, for a listed place whose record is not current, whether a new application is open. Never a case, a concern, evidence or personal details. |
HCC uses no advertising network and no data broker, and its only visitor count is the cookie-free one described above. Beyond those, information leaves only where the law requires it, or where someone's safety genuinely demands it. Nothing here is sold. If personal information is ever lost or reached by someone who should not have it, we tell the people affected, and the authorities the law names, as fast as we can and within 30 days.
How long we keep it
We keep what the law and our own accountability require, and no more. When a period ends, personal details are deleted or made anonymous. If a claim, a demand or a regulator's inquiry arrives, deletion of the records it touches pauses until it is resolved.
| What | How long |
|---|---|
| Case files | For the duration of the membership and a reasonable period after, because a seal means little without a record behind it. That period is 6 years after the case closes. Photos and PDF files sent with a concern are deleted with the case file. An open case is never deleted. Junk or spam that case staff close as not a concern at all is deleted with its files 30 days after it is closed, and it is never counted on our transparency page. |
| Concerns that did not become a case | 24 months after case staff close the concern without opening a case, then deleted with any files sent with it |
| Evidence from checks | While the record is published, then 6 years after it is withdrawn or replaced |
| Membership records | Through membership, then as accounting and legal duties require: financial records 7 years after the end of the fiscal year they belong to, and agreements for their term plus 6 years |
| Copies of ID and payment details | Collected as little as possible, and deleted within 90 days of the decision unless needed as evidence. Card numbers stay with the payment processor. |
| Reports about HCC itself | 6 years after the report is closed |
| The notify-me list | Until HCC opens in your state and sends its one email, or until you remove your address. If you chose "any new state or province", until you remove your address with the link in any of our emails. An address that is never confirmed is never kept. |
| Messages sent through the message form | 24 months after HCC has dealt with the message, then deleted with any reply. A message staff mark as spam: 30 days. A message no one has dealt with yet is kept until someone does, including one held because it arrived during a flood of messages; the website never marks a message as spam on its own. |
| Requests to check a place | 24 months after the request arrived, then deleted. A request staff mark as spam: 30 days. |
| Perk offers from companies | 24 months after the offer arrived, then deleted. An offer staff mark as spam: 30 days. The website never marks an offer as spam on its own; one that arrived during a flood is held for a person to sort. |
| Applications to work with HCC | If you are not hired, or you withdraw, 12 months after the decision, then deleted with the record of its steps. An application staff mark as spam: 30 days. If you are hired, it becomes part of your employment file, kept for as long as you work for HCC and 4 years after. An application with no decision yet is kept until there is one; the website never marks an application as spam on its own. |
| Services files | 3 years after the service is delivered. The order and invoice are kept as financial records. |
| Event checks | The event record is kept like the Register's history. A host's name and contact details: 3 years after the event. |
| Workshop recordings | 12 months after the session |
| HCC Academy | A learner's name, email address, private link, lessons finished and quiz scores: 24 months after the seat or the business's membership ends, or after the business ends that learner's training, then deleted. Completion records: 6 years after the course was completed, then deleted; the record keeps its own copy of the name it was issued under once the rest is gone. |
| The business notice list and its log | Until HCC publishes how long it keeps them, which it does on this page before the list is used. A "no thanks" is kept so it is always honored. |
| Ordinary email | 3 years, unless it belongs to one of the records above |
| Copies of emails the site sends | None. The site keeps no log of the emails it sends. |
| Sign-in session records | Until you sign out of that session, or within a day after it expires |
| Failed sign-in records | 30 days |
| Server and security logs | Being set to a short rolling window, then discarded, before the first application |
| The Register's history | Permanently, as dated facts about businesses, with no personal details |
| Backups | Copies are deleted after 30 days, so a deletion becomes final within 30 days |
What you can ask for
- See it. What we hold about you, whether you are a business or someone who raised a concern.
- Correct it. Particularly anything factual in a case record. A fact on the Register that is wrong is corrected right away, with the date.
- Withdraw a concern before a case is opened, and we will not proceed.
- Delete it, unless it forms part of a live case or a record we are required to keep, which we will name rather than vaguely invoke.
- Stop the email. HCC does not send marketing email to people who use this site. HCC will send a one-time notice, and may write once to a suggested business, to food businesses at their public addresses; reply "no thanks" and we stop within 10 business days. The notify-me email carries a link that removes your address at any time; for anything else, write to us.
Write to [email protected], or by mail to Halal Community Council, PO Box 2, Darlington, SC 29540. We reply within thirty days, usually sooner, and there is no charge. A line of its own for concerns about how HCC itself behaves, including how it handled your information, opens when HCC's independent directors are seated, before the first check.
Changes
When practice changes, this page changes and the date at the top changes with it. If something material changes about how case information is handled, members and anyone with a live case will be told directly.
Ready to tell us what happened?
The form asks your permission before anything is shared with a business.