Your information stays part of a private process.

• Account identity, verified email, profile name, and security information.
• Survey answers about religious practice, values, family expectations, and goals.
• Privacy choices, consent timestamps, blocks, reports, and account visibility.
• Compatibility scores, introduction decisions, imam reviews, and family messages.
• Meeting-package and membership payment status; full card details stay with Stripe.
• Operational logs needed to diagnose errors and protect the service.

Mithaq uses member data to operate private matchmaking, apply the fixed compatibility rubric, support human imam review, arrange family-involved meetings, provide safety controls, process payments, and meet legal obligations. Compatibility results support a decision; they do not make a final introduction automatically.

Compatibility scoring begins only after an adult member accepts this notice and gives explicit compatibility consent. The fixed Mithaq rubric remains the main score. When separately consented, anonymised multiple-choice answers may be sent to an AI service provider for a limited secondary review. Names, contact details, account IDs, and free-text answers are excluded, and the request asks the provider not to store model input.

Consent can be withdrawn in Privacy & settings. Withdrawal stops future processing; it does not invalidate processing already completed before withdrawal.

• Supabase hosts the database and authentication service.
• Vercel hosts the web application, functions, analytics, and performance metrics.
• An AI service provider is used only for the consented, bounded compatibility review described above.
• Stripe processes payments after the relevant member and imam approvals.

Provider agreements, international-transfer safeguards, and the subprocessor list are reviewed as part of Mithaq’s ongoing privacy governance.

These are controlled-pilot operational targets. Legal holds, safeguarding duties, chargeback evidence, or statutory rules may require a longer period, which must be documented.

Signed-in members can hide or pause a profile, limit anonymous fields, block a member, report a concern, download a structured copy of their data, withdraw future compatibility consent, and delete their account after a recent sign-in.

UK data-protection rights can also include access, correction, erasure, restriction, objection, portability, and a review of significant automated processing. Mithaq’s formal controller contact and ICO complaint details will be published before the controlled pilot opens beyond invited members.

Sensitive trust records are not directly exposed to member clients. Administrator actions require multi-factor authentication and are recorded in append-only audit history. Imam access is limited to verified, active imam accounts. No online service can promise absolute security; suspected incidents should be reported through the signed-in safety controls while the public contact route is finalised.