Noble Nikah
Legal

Privacy Policy

Last updated 15 May 2026

Working draft — pending counsel review. This page reflects our current operating practice but is not yet a legally executed agreement. For an authoritative answer about the terms in force, email hello@noblenikah.net and we'll reply within 24 hours.

1. Who we are

Noble Nikah (Pvt) Ltd (Reg. No. PV 00432891), 42 Bauddhaloka Mawatha, Colombo 04, Sri Lanka, is the data controller for the personal information described in this policy. You can reach our Data Protection contact at hello@noblenikah.net.

2. Legal framework

We comply with:

  • Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) — the primary regime governing your data.
  • EU General Data Protection Regulation (GDPR) for visitors from the European Economic Area and the UK.
  • The Sri Lanka Data Protection Authority's complaint process is your external recourse if we don't resolve a concern; their contact details are at the DPA website.

3. What we collect

  • Account & identity: email, password (hashed), display name, date of birth, gender, NIC or passport (for verification only — not surfaced to other members), profile photos.
  • Profile content: biography, education, profession, religious practice fields, language, district, family information, partner preferences.
  • Behavioural: matches viewed, interests sent / received, messages exchanged, login timestamps, device fingerprint (for fraud / suspended-account detection), country of access.
  • Payment: Stripe customer ID, last-4 of card, billing country. We never store full card details on our servers — Stripe holds them.
  • Communications: email opens / clicks (for unsubscribe accuracy), in-app messages (encrypted in transit; admin-readable only in documented abuse-investigation scenarios).

4. How we use it

  • Show your profile to other members consistent with your visibility settings (Verified members / Mutual only / Wali sees first).
  • Match you with candidates per your stated partner preferences and observed behaviour.
  • Verify your identity (NIC + selfie + optional mosque endorsement).
  • Enforce community guidelines (e.g. block-list, suspension).
  • Send transactional emails (interest received, mutual match, security alerts) and, with your consent, the monthly Mahr newsletter.
  • Bill subscriptions via Stripe.

5. Wali / family-chat — product-specific disclosure

Noble Nikah supports a Wali (family guardian) flow. When you invite a wali:

  • They receive a private, signed link giving them read-only access to your profile, saved profiles, and interest history.
  • If you start a family-chat with a match, your wali and the match's wali (if invited) see every message in that thread.
  • Walis cannot send interests, messages, or modify your profile.

You can revoke a wali invitation at any time from /account/family-invites. Revocation is immediate; the wali's access stops on their next page load.

This disclosure exists because Noble Nikah's family-aware design shares more data with non-account-holders than a typical platform — we want that explicit, not buried.

6. Who sees your data

  • Other members see your profile per your visibility settings, with private fields (NIC, exact contact, annual income unless opted in) redacted by tier and match state.
  • Walis you invite see what's described in §5.
  • Endorsing mosques see only the fields you authorise on the endorsement form.
  • Vendors you contact see your name + the specific inquiry; not your full profile.
  • Our service providers — Stripe (payments), Resend (email delivery), AWS (hosting), Anthropic / OpenAI (where used for content moderation only, never to train external models on your data).
  • Authorities — only when legally compelled (Sri Lankan court order, valid international request via mutual legal-assistance treaty). We push back on overbroad requests.

We do NOT sell your data, run third-party ad pixels, or share profiles with marketing partners.

7. Your rights under PDPA + GDPR

You have the right to:

  • Access the data we hold on you — request a JSON export from /account/settings (Data section).
  • Correct inaccurate data — most fields you can edit yourself; for the rest, email us.
  • Delete your account — irreversible after a 30-day grace period.
  • Restrict processing — pause your profile via /profile/me without deleting.
  • Object to processing for marketing — unsubscribe from any email removes you from non-essential lists; security emails are unconditional.
  • Port your data — the JSON export is portable.
  • Withdraw consent — applies to non-essential processing (marketing, analytics); essential processing (verification, fraud prevention) is required for the service to function.

To exercise any right, email hello@noblenikah.net and we'll respond within 14 days. If you're unhappy with our response, you can complain to the Sri Lanka DPA or — for EU / UK residents — your national data protection authority.

8. Retention

  • Active profiles: while you keep the account.
  • Deleted accounts: 30-day grace, then hard-deleted from primary storage. Backups are purged on a 90-day rolling basis.
  • Suspended accounts: retained while the suspension is active + 90 days for appeal.
  • Married-and-closed accounts: profile + match history anonymised 90 days post-marriage closure (so post-marriage conversations aren't searchable by future matches). Audit logs retained 7 years for compliance.
  • Payment records: 7 years per Sri Lankan tax / accounting requirements.

9. Security

  • Passwords hashed (Cognito-managed), never stored in plaintext.
  • Sessions on HTTP-only, secure cookies — never accessible to client JavaScript.
  • In-transit encryption (TLS 1.2+).
  • At-rest encryption (KMS-managed) on every datastore.
  • Photo originals encrypted; only thumbnails served to other members via signed URLs with short expiry.

10. Cookies

We use cookies necessary to keep you signed in + a CSRF protection cookie. We do not run advertising / tracking cookies. See the (forthcoming) Cookie Policy.

11. Children

Noble Nikah is not for users under 18. We do not knowingly collect data from under-18 users. If you believe a minor has registered, email us and we'll delete the account.

12. Changes

If we materially change how we handle your data, we'll notify you in-app and by email at least 14 days before the change takes effect.

13. Contact

Data Protection: hello@noblenikah.net. We acknowledge requests within 48 hours and resolve within 14 days.