Privacy Policy

AuthenticNikah is operated from Bengaluru, Karnataka, India. For the purposes of India's Digital Personal Data Protection Act 2023 we are the Data Fiduciary; for the purposes of the UK and EU GDPR we are the Data Controller.

Our Grievance Officer under the IT Rules 2021, and our Data Protection Officer for GDPR purposes, can be reached through the Contact page. Grievances are acknowledged within 24 hours.

Account data: your name, mobile number, email address, and password hash. Where a profile is managed on someone's behalf, we also collect the manager's name, relationship, number and email.

Profile data: age, location, ethnicity, languages, height, complexion, education, profession, family details, hobbies and interests.

Religious data: manhaj, madhhab, level of practice, prayer habits, Quran memorisation, hijab or beard, scholars and institutes followed. This is special-category data and we treat it as such.

Health data: any disability or health condition you choose to disclose, and blood group. Optional in every case.

Questionnaire answers: your responses on marriage expectations, finances, in-laws, children, conflict and related topics.

Identity documents: only if you seek verification. See section 6.

Usage data: searches, filters, profiles viewed, messages sent, and your conversations with Authenty AI.

Technical data: IP address, device fingerprint, browser, and approximate location derived from IP, used for security, fraud prevention and duplicate detection.

To operate the service you asked for, matching, messaging, verification, counselling, on the basis of performing our contract with you.

To process religious, health and questionnaire data, on the basis of your explicit consent, which you give when you complete those sections and can withdraw at any time.

To keep the platform safe, moderation, fraud detection, duplicate accounts, abuse reports, on the basis of our legitimate interests and our legal obligations as an intermediary.

To meet legal and tax obligations, including retaining payment records.

Other members see only what your reveal settings permit. By default your full name, photograph, exact city, employer and questionnaire answers are not visible to strangers.

Your phone number and email are stored separately from your profile and are readable only through a controlled function that first checks whether the requester has spent a contact unlock. A failure elsewhere in the application cannot expose them.

Your wali sees only the categories you grant, and can be revoked at any time.

Our staff see only what their role permits. Access to identity documents is restricted to verification officers and every single access is logged.

We do not sell your data. We do not share it with advertisers. We never disclose your religious or health data to a third party except as set out below.

Supabase (database, authentication, file storage), Vercel (hosting), Cloudflare (content delivery and security), Razorpay and Stripe (payments), Resend or Amazon SES (email), MSG91 or Twilio (SMS and WhatsApp), Anthropic and OpenRouter (AI processing), PostHog (product analytics), Sentry (error monitoring).

Before your messages or profile text reach any AI provider, personally identifying details are redacted. AI providers do not receive your phone number, email address or identity documents under any circumstances.

Each processor is bound by a data processing agreement. Where data is transferred outside India or the EEA, we rely on standard contractual clauses.

Documents are stored in a private encrypted bucket, never at a public address, and are served only through short-lived signed links.

Only staff holding the verification permission can open one, and every access writes an audit entry naming the staff member, the time and the IP address.

Documents are deleted or irreversibly redacted 90 days after a verdict is recorded. The nightly purge job cannot be disabled from the administration panel. We retain the verdict, not the document.

Active profile data: for as long as your account is open.

After you delete your account: profile, messages, questionnaire answers and Tazkiyah records are erased within 30 days. Payment records are retained for eight years as Indian tax law requires. Records of bans for fraud or harassment are retained to prevent re-registration.

Identity documents: 90 days after a verdict, then permanently deleted.

Audit logs: seven years, and they are never edited.

You may access, correct, or erase your personal data, and obtain a machine-readable export of it, all available directly from Settings, without contacting us.

You may withdraw consent for religious, health or questionnaire processing at any time by deleting those sections. This may reduce how well matching works for you, and we will say so before you confirm.

You may object to processing based on legitimate interests, and you may complain to the Data Protection Board of India or, if you are in the UK or EU, to your national supervisory authority.

We do not use your data for automated decisions that produce legal effects. Match ranking is a recommendation and is always explained.

Row-level security on every database table, default deny. Encryption in transit and at rest. Two-factor authentication mandatory for all staff. API keys encrypted and never returned to a browser.

We run an independent penetration test before public launch and annually thereafter.

If a breach affects your personal data we will notify you and the Data Protection Board of India within the periods the law requires.

The platform is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18, and we remove such accounts immediately on discovery.