Privacy policy

1. Who we are, and who is responsible for the register

MyNikkahMate (the iPhone and Android apps, the web app and this website) is provided by Purple Loop Limited, a company registered in England and Wales with company number 08069332, whose registered office is at 195 High Street, Lye, Stourbridge, DY9 8LH.

For your account (your email address, name, sign-in details, devices, subscription and the technical data below) we are the data controller: we decide how and why it is used, and we are responsible for looking after it.

For the register itself, that is the details of the people on your nikkah entries, their ID photos and their signatures, the position is different. Those are records that your institution (the mosque, centre or imam that holds the account) chooses to keep about other people, for its own purposes. Your institution is the data controller for them and is responsible for telling those people what it records, for keeping it accurate and for the lawful basis on which it keeps it; we are your institution’s data processor: we store and sync those records on your instructions, keep them secure, use them for nothing else, and delete them when you tell us to (by deleting a draft, a file or the whole account). These terms are the processing agreement between us; if your institution needs a separate written agreement, email us.

If you have any questions about this policy or your data, email [email protected].

2. What we collect

Your account

• Email address: to identify your account, sign you in and send you account emails (see below). We also record whether you have confirmed it.
• Display name: the name you choose to show in the app.
• Password: if you sign up with email, we store only a secure one-way hash of your password, never the password itself.
• Apple or Google sign-in: if you choose Sign in with Apple or Sign in with Google, we receive and store the unique account identifier that Apple or Google gives us for you, together with the email address and, if they share it, the name they provide (which we use as your display name). If you use Apple’s “Hide My Email”, we receive Apple’s relay address instead of your real one. We do not receive your Apple or Google password.
• Account settings: your account’s short name and your preferred currency.

Your institution

What your register prints on every nikkah nama: your institution’s name as printed, address, phone number, email address, website, charity or company number, header and footer lines, the number your register continues from, and your logo.

Your register: the nikkah entries

Everything your institution chooses to record about each nikkah, so that we can store it and sync it between your devices and print it on the nikkah nama. This includes:

• the entry itself: the date of the nikkah, the venue, the register number, the officiant, the mahr (the amount, its terms and your notes), the nikkah fee and when it was paid, notes, and whether the entry is a draft, registered or void (with the reason);
• the people on the entry: the groom, the bride, the attorney for the bride (wakil), the witnesses and the officiant: their names, their fathers’ names (and whether the father is deceased), addresses, phone numbers, email addresses, dates of birth or ages, the groom’s and the bride’s marital status (never married, divorced or widowed), and the type, number and expiry date of the identity document each one showed;
• ID photos: photographs of those identity documents (a passport, driving licence, biometric residence permit, national ID card or birth certificate), front and back, taken with the app or chosen from the phone;
• signatures: the signature each person draws on the registrar’s phone or tablet, saved as an image with the date and time it was drawn;
• the checklists you run before the nikkah and which items were ticked, marked not needed or skipped;
• document records (type, title, reference number, issuer, issue and expiry dates, notes) and the photos or PDFs you add to them: a decree absolute, death certificate, consent letter, civil marriage certificate or conversion certificate on an entry, an officiant’s authorisation, your charity registration, insurance or premises licence;
• photos and scans you add to an entry (a scanned paper copy, ceremony photos) and their details such as the file name, type and size;
• the certificate copies you email: who they were sent to, when, and whether they arrived.

Some fields are free text, so they will contain whatever you type into them. The people on an entry are not users of the app and cannot see it; your institution is responsible for telling them what it records about them (your nikkah nama and your registration process are the natural place), and for recording only what it needs. Please take ID photos only of the documents the person shows you for the nikkah, and never of anything else.

Your officiants

You can keep a list of the people who perform your nikkahs (the imam, a visiting scholar): their name, and if you choose to add them, their address, phone number, email address, registration number and notes, plus documents such as their authorisation with its number and expiry date. An officiant’s name and registration number are recorded on the entries they perform and printed on the nikkah nama. Officiants do not have their own sign-in and cannot see the app; the information is held in your account.

Photos and files

When you add an ID photo, a signature, a scan or a PDF, it is uploaded and stored with your account, so you can open it on your other devices and in the web app, and so it can be printed on the nikkah nama. Your files are only available to you, through your signed-in account; they are never made public. Before a photo is uploaded, the app resizes and converts it, which also removes any location information stored inside the photo. The phone apps keep a copy of your files on the phone so they work offline. The app only uses your camera or photo library when you choose to add a file; it never reads your contacts and never uses your location.

The nikkah nama and emailed copies

When you print a nikkah nama, our servers build the PDF from the entry (the details above, the ID details and the signature images) and send it only to you. When you email copies, our servers send one email per recipient you chose (the groom, the bride, anyone else you name) with the PDF attached, through our email delivery provider (section 5). The PDF contains the entry as printed, including the signatures; it never contains the ID photos. We keep a record of each copy sent (the address, the name, the time and whether it was delivered) so you can see it in the app.

Your devices

When you sign in, the app registers the device with your account so it can keep you signed in and sync correctly. For each device we store:

• a random identifier created by the app when it is first installed (not a hardware or advertising identifier);
• the device name (the name you have given your phone, such as “Sam’s iPhone”, or otherwise its make and model; in a web browser, simply “Web browser”);
• the platform (iOS, Android or web) and the app version;
• when the device was last seen.

We also keep secure sign-in tokens for each signed-in device (stored in a hashed form) so you don’t have to enter your password every time.

Error reports

If the app or our servers run into an error or crash, a report is sent to our error-monitoring service so we can fix the problem. It describes what went wrong, together with technical details such as the app version, the type of device and its operating system. It is set up not to include personal data such as your name, email address or the contents of your register.

Technical information

Like any online service, our servers necessarily receive your device’s IP address when the app connects to them. We use it to limit repeated sign-in and password-reset attempts, which protects accounts from being guessed. Our hosting and network providers may also record IP addresses and request details in short-lived technical and security logs.

When you contact us

If you email us, we will have your email address and whatever you include in your message.

3. What we don’t do

• We don’t show adverts, and we don’t use your data for advertising.
• We don’t include any third-party analytics, tracking or advertising tools in the apps or on this website.
• We don’t sell or rent your personal data, or the data of the people on your entries, to anyone.
• We don’t use your data to make automated decisions that have legal or similarly significant effects on you or on the people on your entries. The app’s refusal to register an entry where the groom or the bride is under 18 on the nikkah date is a rule your institution applies by using the app, shown to you on the screen; it decides nothing on its own and sends nothing anywhere.
• We don’t use your location, and the app never asks for it.
• We don’t look at the contents of your register except to support you when you ask us to, or to keep the service running (for example to restore a backup).
• We don’t send marketing emails. We only send emails about your account: confirming your email address, password resets, security notices, and notices about your free trial and subscription. The certificate copies you choose to email are sent on your behalf, to the people you choose.

4. How we use it, and our lawful bases

UK data protection law requires us to have a lawful basis for each way we use personal data. For your account data, ours are:

For the people on your entries, your institution decides the lawful basis (for most institutions, keeping the register is part of the service they provide to the couple and a record they are expected to keep), and we process their data only on your instructions, as your processor. Reminders and alerts (a document about to expire, a draft left unfinished) are worked out by the app on your own device from your records; on the phone they are delivered as notifications scheduled on the device itself, and we don’t send them from our servers.

5. Who we share it with

We only share personal data with organisations that help us run MyNikkahMate, and only as much as they need. They act on our instructions and must keep it secure.

• Our hosting provider (servers in the UK): runs the servers that store your account, your register, photos, signatures and files, and their backups.
• Our website hosting provider (in the EU): hosts this website and the web app.
• A network and security provider: delivers our websites and service to you and protects them against attacks, so it processes connection details such as your IP address and the requests your device makes.
• An email delivery provider (in the EU): sends account emails such as email confirmation, password resets, security notices, and notices about your free trial and subscription, and the certificate copies you choose to email, so it processes the recipients’ email addresses and the content of those emails, including the attached nikkah nama.
• An error-monitoring service (in the EU): receives the error reports described above, and is set up not to receive personal data.

A current list of these service providers is available on request: email [email protected].

Some other organisations are involved in ways they control themselves:

• Apple and Google: if you choose to sign in with Apple or Google, they confirm your identity to us. The apps are also distributed through the App Store and Google Play, which handle your subscription payment and collect information under their own privacy policies; we never see your card details.
• The people you email copies to: a nikkah nama you email goes to the addresses you choose, with the entry as printed; once sent it is in their hands.
• Authorities: we may disclose information if we are legally required to, or to protect the rights, property or safety of our users, the people on their entries, the public or ourselves.
• A new owner: if MyNikkahMate or our business is ever sold or reorganised, your data may transfer to the new owner, who must continue to protect it in line with this policy. We will tell you before that happens.

6. Where your data is stored

Your account and your register, with its photos, signatures and files, are stored on servers in the UK. This website and the web app are hosted in the EU, and our email delivery and error-monitoring services are in the EU. Our network and security provider operates internationally. If any of our providers process personal data outside the UK, we make sure it is protected by an adequacy decision or by appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

The phone apps also keep a copy of your records and files on your phone so they work offline. The web app keeps a copy of your records in your browser’s memory while it is open.

7. How long we keep it

• Your register (every entry, the people on it, their ID photos and signatures, your documents and files) is kept for as long as your account exists. A registered entry is official paperwork: it cannot be edited or deleted in the app, only voided, and we never delete a register because a trial or subscription has ended.
• If your free trial or subscription ends and you don’t subscribe again, your account becomes read-only: you can still see, print and export everything, and nothing is deleted. There is no deletion date and we send no deletion warnings.
• Drafts, documents, files and officiants you delete in the app disappear from all your devices. When you delete a photo or file, the file itself is deleted from our storage. So that a deletion can reach every device you use, a record that the item was deleted is kept on our servers until you delete your account.
• The record of emailed copies is kept with the entry, until you delete your account.
• Backups are kept for a limited period (up to 14 days) and then deleted. Data you delete may remain in a backup until it expires, but we won’t restore it into the live service except to recover from a serious failure, and we would delete it again straight away.
• Sign-in tokens expire after 60 days without use, and are removed when you delete your account.
• Technical logs and error reports are kept only for as long as needed for security and troubleshooting, and are deleted after a limited period.
• Emails you send us are kept for as long as we need them to deal with your request.
• Data on your phone stays there until you sign out, delete your account in the app, or uninstall the app. Signing out or deleting your account removes your records and files from that device.

8. Deleting your account

You can delete your account at any time. Because this deletes the whole register, the app offers you an export first and asks you to type your institution’s name to confirm:

• In the app: go to More → Your data → Delete my account. This takes effect immediately.
• Online: follow the steps on our delete your account page.
• By email: email [email protected] with the subject “Delete my account” from the email address on your account. We will delete it within 30 days.

Deleting your account permanently removes your account, your sign-in details, your registered devices, your institution’s details, your officiants, every nikkah entry with the people on it, every ID photo and signature, your documents and files, and the record of emailed copies from our live systems. Copies in our backups are deleted as the backups expire, within 14 days. It cannot be undone.

9. Keeping it secure

We protect your data with measures including encrypted connections (HTTPS) between the apps and our servers, one-way hashing of passwords and sign-in tokens, short-lived access tokens, files that can only be opened through your signed-in account (every ID photo and signature included), secure storage on your phone for the token that keeps you signed in, and a secure, browser-protected cookie for the same purpose on the web. A registered entry is frozen on our servers as well as in the app: once registered, its details, people, signatures and ID photos are refused any change. Access to our systems is limited to people who need it. No system is perfectly secure, but if a breach affecting your data ever happens, we will act quickly and tell you and the ICO where the law requires, so that your institution can tell the people affected.

10. Your rights, and the rights of the people on your entries

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected (you can edit most of it yourself in the app);
• have your data erased;
• restrict how we use your data in some circumstances;
• object to us using your data where we rely on legitimate interests;
• data portability: receive the data you gave us in a structured, commonly used electronic format (in the app: More → Your data → Export my data: a zip with a spreadsheet for every part of the register and every photo, signature and file).

To exercise any of these rights, email [email protected]. We may need to confirm it’s really you, usually by asking you to write from the email address on your account. We will reply within one month. There is normally no charge.

If you are a person on a nikkah entry (the groom, the bride, an attorney, a witness or an officiant) and want to see, correct or erase what an institution has recorded about you, please contact that institution: it is the controller of its register, and we act on its instructions. If you cannot reach it, email us and we will help you find it. Because a registered entry is a frozen record, an institution corrects a mistake by voiding the entry and recording a new one; it can also delete a draft, a file or its whole account.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: visit ico.org.uk/make-a-complaint or call 0303 123 1113.

11. Children

MyNikkahMate is for institutions and the people who conduct nikkahs; you must be 18 or over to have an account. It is not directed at children, and we do not knowingly collect personal data from anyone under 18 as a user. If you believe someone under 18 has created an account, please contact us and we will delete it. The app refuses to register a nikkah where the groom or the bride is under 18 on the nikkah date.

12. This website

We don’t set any cookies on this website, and it doesn’t use analytics or any third-party scripts, fonts or services. Our website hosting provider and our network and security provider receive your IP address and basic request details when you visit, as any website host does, and may keep them briefly in security logs.

The MyNikkahMate web app (a separate site) uses one strictly necessary cookie to keep you signed in, and stores a random device identifier and a few preferences, such as the alerts you have dismissed, in your browser’s local storage. It doesn’t use any tracking or advertising cookies.

13. Changes to this policy

We will update this policy if the app or the way we use data changes. We will change the “last updated” date at the top, and if the changes are significant we will tell you in the app or by email before they take effect.

14. Contact us

For anything about this policy or your data, email [email protected].