Privacy Policy

When a family comes to ShadiSunnah looking for a marriage match for their son or daughter, they place an enormous amount of trust in us. They share photographs of their children, details about their family background, and personal identity documents. We do not take that trust lightly.

This Privacy Policy explains, in plain and straightforward language, what personal information we collect from you, why we collect it, how we use it, who we may share it with, and what rights you have over your own data. It applies to every person who visits, registers on, or uses the ShadiSunnah platform at www.shadisunnah.com.

We are required by law to publish this document — specifically under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU GDPR for users in the European Economic Area. But we have written it this way because we believe you deserve to understand exactly how your information is handled, not because a regulator told us to bury it in legal jargon.

If you have any questions after reading this, please contact us at privacy@shadisunnah.com.

1. Who We Are

ShadiSunnah Ltd is the Data Controller for all personal information collected through the Platform. This means we are responsible for deciding how and why your data is used, and we are accountable to you and to the Information Commissioner's Office (ICO) in the United Kingdom.

Contact details:

• Email: privacy@shadisunnah.com
• Support: www.shadisunnah.com/support
• Address: ShadiSunnah Ltd, United Kingdom

2. What Information We Collect

2.1 Information You Give Us Directly

When you register an account:

• Your first and last name
• Your email address
• Your phone number (including country dialling code)
• Your password (stored as a one-way cryptographic hash — your actual password is never stored or readable by anyone, including us)
• Your relationship to the profile subject (father, mother, brother, sister, uncle, aunt, etc.)
• Your national identity document number — either a Pakistani CNIC (13-digit national identity card) or a passport number
• Scanned images or photographs of your identity documents

When you create a profile for your family member:

• Their first and last name
• Date of birth and age
• Gender
• Religion and religious sect
• Caste (optional)
• Nationality and country of residence
• City of residence
• Marital status (including whether previously married, divorced, or widowed)
• Education level and field of study
• Profession and approximate income range
• Physical attributes including height, complexion, and body type
• Hobbies, interests, and languages spoken
• A personal description written by the family
• Profile photograph and any additional gallery images

When you make a payment:

• Cardholder name
• Billing address (street, city, postal code, country)
• Card type (Visa, Mastercard, etc.) and last four digits
• Card expiry month and year

Important: Your full card number, CVV security code, and complete card details are never transmitted to or stored on ShadiSunnah servers at any point. All payment processing is handled exclusively by Stripe Inc., a global payment processor certified to PCI-DSS Level 1 — the highest level of payment security certification available. We receive only a tokenised reference and the limited display details listed above.

When you contact support:

• The contents of support tickets you raise
• Messages exchanged with our support team
• Reports you submit about other profiles
• Any other correspondence you send us

2.2 Information We Collect Automatically

When you use the Platform, certain technical information is recorded automatically:

• Your IP address at the time of registration and each login
• The type of device you are using, your operating system, and your browser
• Pages you visit on the Platform and how long you spend on them
• How you navigate through the Platform (what you click on, what you search for)
• Your approximate country of location, derived from your IP address — used solely to display the correct currency and pricing

We run our own internal analytics system. We do not use Google Analytics, Facebook Pixel, TikTok Pixel, Hotjar, or any third-party tracking service that follows you across the internet. What happens on ShadiSunnah stays on ShadiSunnah.

2.3 Information From Third Parties

• Stripe Inc. — when you make a payment, Stripe confirms to us whether it was successful, and provides us with a customer reference ID and payment method token
• MaxMind GeoIP — we use MaxMind's database to detect your country from your IP address for pricing purposes. Your personal data is not shared with MaxMind.

3. Why We Use Your Information

We are required by law to have a lawful basis for every use of your personal data. We use your data for the following purposes:

3.1 To Deliver the Service You've Signed Up For (Contract)

This is the core of what we do. We use your information to:

• Create and manage your account
• Verify your identity before your profile goes live
• Display your family's profile to other verified families on the Platform
• Process your payment and activate your package
• Show you search results and match suggestions
• Send you transactional emails (account confirmation, email verification, payment receipts, expiry reminders, password resets)
• Allow you to send and receive connection requests
• Manage your support tickets

3.2 To Keep the Platform Safe (Legitimate Interests)

We have a responsibility to protect every family on the Platform from fraud, fake profiles, and abuse. We use your information to:

• Review identity documents before approving profiles
• Log IP addresses to detect and block suspicious registration patterns
• Detect and reject disposable email addresses commonly used in fraudulent signups
• Identify and investigate reports made against profiles
• Take action against accounts that violate our Terms & Conditions

We have carefully balanced these interests against your privacy rights and concluded that maintaining a safe platform is proportionate and necessary.

3.3 To Meet Legal Obligations (Legal Obligation)

• We retain payment records for seven years to comply with HMRC requirements
• We may retain certain data if required to cooperate with a law enforcement investigation
• We maintain records as required under UK company law

3.4 With Your Consent (Consent)

At present, we do not send marketing emails or newsletters. If we introduce this in future, we will only do so with your explicit opt-in consent, and you will be able to withdraw it at any time.

4. Who We Share Your Information With

We do not sell your personal data. We do not allow advertisers anywhere near it. We share it only in the specific circumstances below.

4.1 Our Service Providers

We work with a small number of trusted companies who process data on our behalf, under strict contractual agreements:

• Stripe Inc. (United States) — payment processing
• Postmark or Sendgrid — sending transactional emails
• Cloudflare — content delivery and security (processes IP addresses as part of protecting the site from attacks)
• Our hosting provider — the physical servers that run the Platform
• MaxMind — GeoIP lookups (no personal data is shared)

None of these companies are permitted to use your data for their own purposes.

4.2 Other Families on the Platform

When your profile is approved and active, the following information is visible to other verified and logged-in families:

• Your family member's name, age, city, religion, education, profession, and personal description
• Their profile photograph and gallery images (watermarked)

The following information is never visible to other families under any circumstances:

• Your email address
• Your phone number
• Your identity document details or document images
• Your IP address
• Your payment information

4.3 Law Enforcement and Regulatory Bodies

If we are required by a valid court order, law enforcement request, or regulatory authority to disclose personal data, we will comply with that legal obligation. Where permitted by law, we will notify you before doing so. We will never voluntarily hand over personal data to a government authority without a legal basis.

4.4 Business Transfers

If ShadiSunnah Ltd is ever acquired, merged with another company, or its assets are transferred, personal data may form part of that transaction. We will give you advance notice and ensure the receiving party is bound by equivalent privacy obligations.

5. International Data Transfers

Some of our service providers are based outside the United Kingdom. When we transfer personal data internationally, we ensure appropriate legal safeguards are in place — specifically Standard Contractual Clauses (SCCs) approved by the UK ICO, or adequacy decisions where applicable. Stripe Inc. in the United States is covered under an adequacy framework. All other providers are contractually restricted to processing your data within the UK or EEA, or under approved transfer mechanisms.

6. How Long We Keep Your Data

We do not keep your data longer than we need it.

7. Your Rights

You have the following rights under UK GDPR. To exercise any of them, email privacy@shadisunnah.com. We will respond within 30 days, free of charge.

Right of Access — You can request a copy of all personal data we hold about you.
Right to Rectification — You can ask us to correct any inaccurate or incomplete data.
Right to Erasure — You can ask us to delete your personal data. We will do so except where we are legally required to retain it.
Right to Restriction — You can ask us to stop processing your data in certain circumstances while a dispute is resolved.
Right to Data Portability — You can request your data in a structured, machine-readable format to transfer to another service.
Right to Object — You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your rights.
Right to Complain — If you are unhappy with how we've handled your data, you have the right to complain to the UK Information Commissioner's Office:

• Website: www.ico.org.uk
• Telephone: 0303 123 1113

8. Security

We take security seriously and have implemented the following measures:

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS everywhere — no HTTP access)
• Passwords are hashed using bcrypt with a minimum cost factor of 12
• Identity document images are stored on private, non-publicly accessible server directories
• Payment card data is processed exclusively by Stripe and never touches our servers
• All uploaded images are scanned for malicious code and re-encoded from scratch to strip any embedded payloads
• Session tokens are cryptographically generated and regenerated at every login
• Admin access to the platform requires multi-factor authentication
• Database access is restricted to application-level credentials with least-privilege permissions

In the event of a personal data breach that poses a risk to your rights, we will notify the ICO within 72 hours and notify affected individuals without undue delay.

9. Children

ShadiSunnah is strictly for adults. Account holders must be 18 or older. Profile subjects must be 18 or older. We do not knowingly collect any personal data from minors. If we discover a profile has been created for someone under 18, we will immediately suspend the account and delete the data.

10. Changes to This Policy

When we make material changes to this Policy, we will notify you by email at least 14 days before the changes take effect and display a notice on the Platform. The effective date at the top of this document shows when it was last updated.