Privacy Policy

1. Who we are (Data Controller)

NaySahul is a community platform serving the global Muslim community, operated by [COMPANY NAME] ("NaySahul", "we", "us"), registered at [REGISTERED ADDRESS]. NaySahul is the data controller for the personal data described in this policy.

Privacy contact: naysahul@sahulshah.com — we respond within 48 hours.

2. What personal data we collect and why

• Account information — name, email address, gender, country and city. Legal basis: performance of our contract with you (providing the service).
• Profile information you voluntarily provide — including profile photos and, if you use the matrimonial service, marital status and related details. Legal basis: your explicit consent.
• Religious affiliation — inferred from your use of a Muslim community platform and any faith-related details you share. Legal basis: your explicit consent (special category data — see sections 7 and 10).
• Location data — only when you explicitly grant permission for "near me" features. Legal basis: your consent.
• Usage data — pages visited, features used, search queries. Legal basis: our legitimate interest in operating and improving the platform.
• Device information — browser type and operating system. Legal basis: legitimate interest (security and compatibility).

3. Gender data — special protection

Gender information is collected once at signup and cannot be changed. This data is used solely to provide gender-appropriate services (particularly for the matrimonial section). Men cannot access women's profiles or data under any circumstances. This is enforced at the database level, not just in the user interface.

4. Matrimonial data

Matrimonial profile data is stored in gender-segregated schemas. End-to-end encryption is used for messages. We cannot read your private messages. Profiles are never sold, shared, or used for advertising. You can delete your matrimonial profile at any time.

5. Who we share data with

• Google and Microsoft — only if you choose third-party sign-in; they receive the data needed to authenticate you, under their own privacy policies.
• Service providers (processors) — hosting, database, and email providers that process data on our instructions, including Supabase and Vercel.
• Sponsors and community partners — we do not share your personal data with sponsors. Sponsors may appear on the platform but never receive your personal information.
• Authorities — only where required by law.

We never sell your data to third parties and never use it for advertising.

6. Data retention

We retain your data for as long as your account is active. Inactive accounts are deleted after 2 years of inactivity. Support and legal correspondence is kept for up to 12 months. Deletion requests are completed within 30 days, after which residual data in backups is purged on the next backup cycle. Some records may be retained longer where the law requires it.

7. Your rights — all users

You have the right to access your data, correct inaccurate data, delete your account and all associated data, download a copy of your data, and opt out of non-essential communications. To request deletion, use our Data Deletion Request page, contact naysahul@sahulshah.com, or use the account settings page.

9. United Kingdom & European Union (UK GDPR / GDPR)

Special category data (Article 9): religious affiliation is special category data. We process it only with your explicit consent, given when you create an account on a platform that is expressly for the Muslim community and when you add faith-related details to your profile.

You have the rights of Access, Erasure, Restriction, Portability, and Objection, and the right to withdraw consent at any time without affecting the lawfulness of prior processing.

Complaints: you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local EU supervisory authority.

International transfers: our servers and processors may be located outside the UK/EU (including in the United States). Where data is transferred internationally, we rely on adequacy regulations or Standard Contractual Clauses (SCCs) with supplementary safeguards as the legal transfer mechanism.

UK/EU representative: as NaySahul currently has no physical establishment in the UK or EU, a representative under Article 27 will be appointed and published here. Until then, please contact us directly at naysahul@sahulshah.com.

10. Canada (PIPEDA & Quebec Law 25)

Purpose at collection: we state the purpose for collecting personal information at or before the time of collection — see section 2 for the purpose attached to each data type.

Access and correction: you may request access to, and correction of, your personal information at any time via account settings or naysahul@sahulshah.com.

French language: a French version of this policy is available at /fr/privacy (Politique de confidentialité).

Breach notification: if a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d'accès à l'information) within 72 hours of becoming aware of the breach.

11. Australia (Privacy Act 1988)

NaySahul handles personal information in accordance with the 13 Australian Privacy Principles (APPs), covering open and transparent management, collection, use and disclosure, data quality, security, access, and correction.

Notifiable Data Breaches scheme: if an eligible data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and in any case within 30 days of becoming aware.

Overseas disclosure (APP 8): personal information may be disclosed to overseas recipients (hosting and processing providers, including in the United States). We take reasonable steps to ensure overseas recipients handle your information in accordance with the APPs.

12. Malaysia (PDPA 2010)

Sensitive personal data: religious beliefs are sensitive personal data under the Personal Data Protection Act 2010. We process them only with your explicit written consent, given at account creation and when you provide faith-related details.

Access and correction: you have the right to request access to, and correction of, your personal data by contacting naysahul@sahulshah.com.

Cross-border transfers: we do not transfer personal data outside Malaysia except to jurisdictions with substantially similar protection, or with appropriate contractual protections in place, in accordance with section 129 of the PDPA.

13. Quran & Islamic education directory

The Quran learning directory is designed for anonymous browsing. To find programs you may enter a ZIP/postal code, city, state/province or country, or optionally grant your browser's location permission. Legal basis: your consent and our legitimate interest in providing the requested search.

• No account is required, and we never ask for your name, email, phone, religion, citizenship, immigration status, passport, or date of birth to browse or search.
• Children's data: the Kids tab is educational content discovery for parents. We never collect children's personal information, and there are no child accounts. Provider registration happens on the provider's own systems.
• Browser location is requested only after your explicit permission, is used solely to identify nearby programs for that search, and precise coordinates are not retained after the search is completed.
• No sensitive inference: we never infer religion, ethnicity, nationality, income or any other sensitive characteristic from your location or your Quran/Tajweed searches.
• "Report incorrect information" submissions store the report details and, only if you choose to provide it, your email address. Reports are retained only as long as needed for moderation, fraud prevention and legal obligations.

14. Hajj & Umrah travel discovery

The Hajj & Umrah discovery feature is designed to be used anonymously. To find nearby providers you may enter a ZIP/postal code, city, state/province or country, or optionally grant your browser's location permission. Legal basis: your consent and our legitimate interest in providing the requested search.

• No account is required for provider discovery, and we never ask for passport numbers, visa numbers, immigration documents, dates of birth, or financial information to show search results.
• Browser location is requested only after your explicit permission, is used solely to identify nearby providers for that search, and precise coordinates are not retained after the search is completed.
• ZIP/postal codes are treated as coarse location signals. We never infer religion, ethnicity, nationality, immigration status, income, or any other sensitive characteristic from your location or your searches.
• Optional residency selection (e.g. U.S. citizen, lawful permanent resident) is voluntary, is never required, and is used only to show potentially relevant official government guidance links. It is not used to determine eligibility for any visa, permit, or service.
• "Report incorrect information" submissions store the report details and, only if you choose to provide it, your email address so we can follow up. Reports are retained only as long as needed for moderation, fraud prevention and legal obligations.
• Contacting a provider takes you to that third party's own website or contact method; their privacy policy and terms apply to any information you give them.

15. Changes to this policy

If we make material changes to this policy, we will notify you by email and in-app notice at least 30 days before the changes take effect.