NikahAI / Nikah AI Ltd
Privacy notice
1. Who is responsible for your data
Nikah AI Ltd is the controller of the personal data processed through NikahAI. We are registered with the Information Commissioner's Office (ICO) under reference ZC176381. We have not appointed a data protection officer; our director is responsible for data protection. Contact: privacy@legalnikahai.com, or Nikah AI Ltd, Office 1216, 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW.
This notice describes the service as it works on 15 September 2026. Where the in-app Privacy Policy (version 1.3) says something different, this notice is the accurate description.
2. What we collect
| Type | What it includes | Required? |
|---|---|---|
| Account | Email address, password (stored only as a bcrypt hash), email-verification status, account status, notification settings, sign-up date. | Yes |
| Profile | Username, first and last name (optional), date of birth and age, gender (male or female), town or area, bio, education, profession, height, marital status, whether you have or want children, marriage timescale, photos, personality slider answers, smoking and drinking habits. | Username, date of birth, gender and location are required at sign-up. The Edit Profile screen currently also requires profession, smoking and drinking habits, prayer frequency and religiosity before it will save changes. |
| Religious belief (special category data) | That you are a Muslim (the service is only for Muslims and onboarding asks you to confirm this), plus optional details: how practising you are, sect, prayer frequency, whether you wear hijab or have a beard, Islamic preferences, modesty preference, and any religious details you write. | Muslim identity is inherent in using the service; the details are optional |
| Ethnicity (special category data) | Your ethnicity and any ethnicity preference, if you choose to add them. | Optional |
| Partner preferences | Age range, location, education, religiosity, marital status, children, ethnicity and height preferences. | Optional |
| Location from your device | If you tap the option to use your location, your device's GPS coordinates. See section 4. | Optional |
| Activity | Interest/connection requests and their status, profiles you pass on, matches and compatibility scores, messages you send and receive (with read status), blocks, unmatches, instant-message credit balance. | Created as you use the service |
| Reports and moderation | Reports you make or that are made about you, including the reason, your description and a snapshot of the reported profile, message or photo; warnings, suspensions, bans and reasons; notes our team records; an audit log of actions our team takes. | Created when used |
| Wali / chaperone details | The name and email address of a guardian you enter when inviting a wali to a conversation. | Optional |
| Consent records | Which consents you gave (terms, privacy, religious data, automated matching, optional marketing, community guidelines), the version, the time, your IP address and browser/device user agent. | Yes |
| Purchases | Whether you have Premium, its product and expiry, store transaction identifiers for credit purchases, and credits granted. We never receive your card details. | Only if you buy |
| Device and technical | Push-notification tokens and platform (if you allow notifications), a login session cookie, a security (CSRF) cookie, IP address (used for rate limiting and consent records), and settings kept in your browser or app storage. | Yes, for login and security |
| Support and deletion requests | Your name, email, category and message when you use the support form (sent to our mailbox), and your email and reason when you ask for deletion through the web form. | Only if you contact us |
| Ask NikkahAI chat | The questions you type and the recent chat history in that screen. These are not saved in our database. See section 5. | Only if you use it |
Please do not put health information, or other people's personal details, in your bio, messages or reports unless it is necessary.
3. Who can see your profile
Your profile is shown to signed-in members of the opposite gender when it is approved and set to discoverable. Any signed-in member who opens your profile can receive all of the information stored in it, including your date of birth and surname if you added them, even though the app does not display every field. You can hide your profile from browsing with the discoverable setting.
Photo files are served from web addresses that are hard to guess but do not require sign-in, so anyone who obtains a photo's link can view that photo.
4. Location
You can type your town, or tap the option to use your device location. If you use device location, your device sends its GPS coordinates directly to the OpenStreetMap Foundation's Nominatim service to look up the town name, and we store the coordinates with your profile at full precision.
In the current version, those stored coordinates form part of the profile information that other signed-in members' apps receive, although the app only displays your town. We are changing this. Until then, we recommend typing your town rather than using device location. If you have already used device location, email privacy@legalnikahai.com and we will remove the stored coordinates. The app does not collect location in the background.
5. Matching, "AI" features and outside AI
AI Match compatibility scores are calculated on our server by fixed rules that weigh religiosity, Islamic preferences, wishes about children, personality answers, location and sect. No machine-learning model or outside AI provider is used for scoring. Free accounts see up to 5 suggestions and Premium up to 20. Conversation Starters and Profile Insights are produced from built-in templates, not by an outside AI provider.
Ask NikkahAI (shown as "coming soon") answers from a built-in library of text on our server. If we switch on its OpenAI connection, your question and up to the last 10 messages of that chat are sent to OpenAI to generate a reply. We will update this notice before relying on that connection in normal use.
Scores and suggestions affect which profiles you see first. They do not make decisions with legal or similarly significant effects, and you can browse and contact members regardless of score.
6. Why we use your data and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account, showing your profile, matching, messaging, purchases | Contract (Article 6(1)(b)) |
| Using your religious-belief details for the service | Your explicit consent (Article 9(2)(a)), given by the separate religious-data checkbox at sign-up. Because the service exists to introduce Muslims for marriage, you cannot use it without that consent; withdrawing it means closing your account. You can remove some optional religious details (such as sect) in Edit Profile; to remove others, email us. |
| Using your ethnicity for the service | Your explicit consent (Article 9(2)(a)). The sign-up checkbox does not yet name ethnicity; we are adding it. The field is optional: only add it if you agree to it being shown to members and used in matching, and remove it at any time in Edit Profile. |
| Automated compatibility scoring | Contract, and the separate matching consent you give at sign-up |
| Keeping members safe: reviewing reports, moderation, preventing fraud and abuse, rate limiting, audit logs | Legitimate interests (Article 6(1)(f)) and, where it applies, legal obligation (Article 6(1)(c)), including under the Online Safety Act 2023. Where a report involves special category data, substantial public interest (Article 9(2)(g) with the Data Protection Act 2018, Schedule 1, paragraphs 10, 11 and 18: preventing unlawful acts, protecting the public from dishonesty, and safeguarding) |
| Consent and deletion-request records | Legal obligation (showing we complied with data protection law) and legitimate interests |
| Push notifications | Your device permission, and contract |
| Marketing | Consent (optional checkbox). We do not currently send marketing emails. |
| Responding to police, courts and regulators | Legal obligation, or legitimate interests where disclosure is voluntary but lawful |
7. Who receives your data
We do not sell your personal data and we do not use advertising or analytics tools. Data is shared with:
- Other members, as described in sections 3 and 4, and your messages go to the person you send them to.
- Replit, Inc. (United States): hosts the web app and server, including Replit Object Storage for photos.
- Neon (United States company): the database storing account, profile, message and moderation data.
- Email delivery: Twilio SendGrid (United States) or another SMTP provider we configure, for verification codes, password resets and account emails. Our mailboxes are provided by Zoho (for nikah-ai.com) and Google (addresses at legalnikahai.com are forwarded by Cloudflare to a Google mailbox).
- RevenueCat, Inc. (United States): records your in-app purchases and Premium status. Your NikahAI account ID is used as your RevenueCat customer ID.
- Google: Google Play billing (Android purchases), Firebase Cloud Messaging (Android push notifications, if enabled), and Google Fonts (the web app loads fonts from Google, which receives your IP address).
- Apple: App Store billing and Apple Push Notification service, if you use an iOS version.
- OpenStreetMap Foundation (United Kingdom): receives your coordinates and IP address from your device if you use device location. It acts under its own privacy policy.
- OpenAI (United States): only if the Ask NikkahAI connection is switched on (section 5).
- Police, courts, regulators and child-protection bodies (including the National Crime Agency) where the law requires it, or where it is necessary to protect someone from serious harm.
- A buyer or successor of our business, under the same protections.
Service providers process data on our instructions under their data processing terms. Where data goes to the United States, the safeguard is the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum in the provider's data processing terms. You can ask us for details.
8. How long we keep data
| Data | How long |
|---|---|
| Your account and profile | While your account exists. We do not currently delete inactive accounts automatically. |
| After you delete your account in the app | Immediately: profile details, photos references, coordinates, email and password are erased or replaced, you are signed out everywhere, and we attempt to delete photo files. Messages and connections you had stay visible to the other member for up to 30 days. After 30 days the account is permanently deleted, together with its messages, connections, matches, reports made by or about it, blocks, consent records and push tokens. |
| Our team's audit log | Kept, with the link to your account removed when the account is permanently deleted. |
| Web deletion requests (email and reason) | Kept as a record that we handled your request. We intend to set a fixed period and will update this notice. |
| Support emails | In our mailbox for as long as needed to deal with your request. |
| Purchase records | Held by Google, Apple and RevenueCat under their own retention rules and tax/accounting law. |
9. Your rights
You can ask to access, correct, delete or restrict your data, object to processing based on legitimate interests, receive your data in a portable format, and withdraw consent. You can download a copy of your data in the app under Settings, edit most profile details in Edit Profile, and delete your account in Settings. Otherwise email privacy@legalnikahai.com. We reply within one month (extendable by two months for complex requests) and may ask you to confirm your identity.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. Please contact us first so we can try to help.
10. Age
NikahAI is only for people aged 18 and over. You must give your date of birth, and our server refuses a profile showing an age under 18. We do not currently use identity documents, facial age estimation or other age-checking technology, so we rely on members' honesty and on reports. If you believe a member is under 18, report them; we will suspend the account and delete the data except what we need to keep for safeguarding.
11. Security
We use HTTPS, hashed passwords, secure session cookies, CSRF protection, rate limits and role-based access for our team. No system is completely secure. If a breach is likely to put you at high risk, we will tell you without undue delay.
12. Cookies and similar storage
We use two strictly necessary cookies: a session cookie that keeps you signed in and a security (CSRF) cookie. The app keeps some settings in your browser or app storage. We use no advertising or analytics cookies, so we do not ask for cookie consent. The web app loads fonts from Google Fonts.
13. Changes
We will update this page when the service changes and show the date at the top. For significant changes we will also tell you in the app or by email.