Sofouw Privacy Policy
Effective date: 3 October 2026
Your privacy at a glance
- Who we are. Sofouw is run by Nader Alsouqi, an individual developer. We are responsible for your information (the "controller").
- Adults only, marriage only. Sofouw is for Muslims aged 18 or over who are looking for marriage. We introduce men to women only.
- One standard everywhere. Sofouw is available in the countries where it is offered on Google Play. We give everyone the same protection, plus anything extra their own country's law requires (section 18).
- Your faith is sensitive information. We use it only with your explicit consent, and only to help you find a spouse.
- Nationality is collected so that you, your matches and your families can take it into account. It is used only for matching and is shown on your biodata.
- Khala is an AI, powered by Anthropic's Claude in the United States. Your profile, your messages to Khala and your photos (for safety checks) are sent to Anthropic. Your chats with your matches are not — except to write weekly summaries for a wali you have given "weekly summary" access.
- Photos are blurred until you match, unless you choose otherwise. Hijab and niqab are welcome.
- No GPS. You choose your country and town or city from a list. Distances are in kilometres.
- No adverts, and we never sell your data.
- Premium is optional. If you subscribe, Google Play takes the payment; we never see your card details.
- You are in control. You can see and delete what Khala remembers, choose who sees your photos, and delete your account at any time. When you delete your account, your matches and conversations are deleted for both people.
1. Who we are
Sofouw ("Sofouw", "we", "us", "our") is a matchmaking app for Muslims who are looking for marriage. Sofouw is operated by Nader Alsouqi, an individual developer.
We are the controller of the personal data described in this policy. This means we decide why and how your information is used, and we are responsible for protecting it.
You can contact us about privacy at any time:
- Email: support@sofouw.com
Data protection contact. For data protection questions, contact Nader Alsouqi at support@sofouw.com.
Local representatives, registrations and permits. Some of the laws that apply to Sofouw require a company based outside the country to appoint a local representative, or to register with, or obtain a licence or permit from, the national regulator. [CONFIRM WITH LOCAL COUNSEL which of these apply.]
| Country | Local representative | Registration, licence or permit |
|---|---|---|
| Saudi Arabia | [SAUDI ARABIA REPRESENTATIVE NAME AND ADDRESS, if required] | [SDAIA NATIONAL REGISTER OF CONTROLLERS NUMBER, if required] |
| United Arab Emirates | [UAE REPRESENTATIVE NAME AND ADDRESS, if required] | [UAE DATA OFFICE REGISTRATION, if required] |
| Egypt | [EGYPT REPRESENTATIVE NAME AND ADDRESS, if required] | [EGYPT PDPC LICENCE NUMBER, if required] |
| United Kingdom | [UK REPRESENTATIVE NAME AND ADDRESS — required under Article 27 UK GDPR if we are not established in the UK] | [ICO REGISTRATION NUMBER] |
| Other countries | [OTHER LOCAL REPRESENTATIVES, if required] | [OTHER REGISTRATIONS, LICENCES AND PERMITS — e.g. Qatar, Oman, Bahrain, Morocco, Tunisia, Algeria, Lebanon] |
This policy covers the Sofouw mobile app, the web page used by walis (guardians), and our account deletion page at https://sofouw.com/delete-account. Please read it alongside our Terms of Use, Community Guidelines and Child Safety Standards. This policy is available in English and Arabic (section 23).
2. Which laws apply
Sofouw is available to people who live in the countries where it is offered on Google Play. The data protection law of the country where you live usually applies to how we handle your information. The law of the country where we are established may apply as well.
These laws differ from one another. Rather than offering different levels of protection in different places, we apply one standard to everyone, built on the strictest requirements we follow, and we add anything extra that your own country's law requires. If you live in a country that does not have a comprehensive data protection law, you still receive the same protection and the same rights described in this policy.
Section 18 ("Your country") lists the main data protection law and regulator for each country where Sofouw is available.
In this policy, "sensitive data" means the types of information that the different laws protect most strongly. The UK calls this "special category data"; laws in Saudi Arabia, the UAE, Bahrain, Oman, Egypt, Jordan and elsewhere call it "sensitive data" or "sensitive personal data"; and Qatar's law calls it "personal data of a special nature".
3. The information we collect
3.1 Information you give us
Almost all of your profile is collected in a conversation with Khala, our AI matchmaker, rather than in a form.
- Sign-in details: your phone number, in international format (if you sign in with a phone number and a code sent by WhatsApp or SMS), or your email address and Google account identifier (if you sign in with Google). When we send your code by WhatsApp, we keep a record of the request (your number, when it was sent, whether it was delivered and how many times a code was tried) for 7 days, to stop abuse; the code itself is stored only in scrambled (hashed) form.
- Language: whether you use Sofouw in English or Arabic.
- Your interview with Khala: your first name, gender, date of birth (other users only see your age), nationality, the country and town or city where you live, sect, how often you pray, your marriage intentions and timeline, how involved your family will be, your "ideal weekend", job, education, height, marital history (never married, divorced or widowed), whether you have children, whether you were born Muslim or are a revert, a description of your family, and optional "About you" text. Khala uses your "About you" text to describe you to potential matches; it is not shown to them word for word.
- Photos you share with Khala.
- Preferences: the age range you are looking for; the maximum distance, in kilometres; whether you are "Open to other countries"; nationality (any, the same as mine, or a list you choose); sect; prayer frequency; timeline; whether you are open to reverts; and whether Khala may suggest someone just outside your age or distance range (Khala always asks you first).
- Conversations with Khala: your interview answers, the messages you type to Khala, and the facts Khala remembers about you.
- Activity on Sofouw: who you like and pass, your matches, the chat messages you send and receive, reports and blocks, and your settings (such as photo visibility, icebreakers, read receipts, introduction notifications, pausing your profile, or marking that you have found someone).
- Premium: if you subscribe to Sofouw Premium, a record of your subscription (section 3.3). We do not receive your card or other payment details.
- Wali details: if you invite a wali, their name, their relationship to you, their phone number, their preferred language, and the access level and permissions you choose (section 8).
- Messages to us: anything you send to our support or safety teams.
3.2 Information collected automatically
- Push notification token: a code that lets us send notifications to your device.
- Usage timestamps: for example, when you last opened the app, and when you liked, matched or sent a message.
- Time zone: worked out from the town or city you choose, so that introductions and notifications arrive at a sensible time.
- Technical information: limited information our servers receive when the app connects, such as IP address, device type, operating system and app version, used for security and troubleshooting [confirm].
- AI usage records: which Khala feature was used, when, and how much processing it needed, so that we can manage fair use and costs. These records do not contain the content of your messages.
We do not use GPS or track your location (section 10).
3.3 Information from other sources
- Google: when you sign in, Google's Firebase Authentication confirms your phone number or Google account to us.
- Meta (WhatsApp): when your sign-in code is sent by WhatsApp, WhatsApp tells us whether it was delivered, so we can send it by SMS instead if it couldn't be.
- Google Play: if you subscribe to Sofouw Premium, Google Play tells us which plan you chose, the purchase token and order number, when your subscription started and when it renews or ends, whether it is set to renew, whether it was a test purchase, and later changes such as renewals, cancellations and refunds.
- Other users: for example, if someone reports you or sends you a message.
- Your contacts (optional): only in the form of one-way hashes, if you turn on "Hide me from my contacts" (section 11).
4. Nationality: why we ask
Khala asks for your nationality during your interview. It is shown on your biodata to the people you are introduced to. You can also choose to be introduced to people of any nationality, of the same nationality as you, or of the nationalities you select.
We ask because nationality often matters in marriage decisions. Many families take it into account, and some countries — including some Gulf states — require their citizens to obtain government permission before marrying a foreign national [CONFIRM WITH LOCAL COUNSEL]. Knowing someone's nationality early can help everyone avoid disappointment later.
We use your nationality only to suggest and filter introductions and to show it on your biodata. We do not use it for advertising or for any other purpose, and we share it only as described in this policy. Because nationality can sometimes indicate ethnic origin, which some laws treat as sensitive data, we protect it with the same care as sensitive data. Please be honest about your nationality; our Community Guidelines require it. Sofouw does not give advice on marriage permits, visas, residency or immigration.
5. Your faith and other sensitive data
Information that reveals your religious beliefs — such as your sect, how often you pray, whether you are a revert, and your wishes about family and wali involvement — is sensitive data under the laws that apply to Sofouw and is given extra protection. Some laws (for example Qatar's) also treat information about marital relations, such as your marital history, as sensitive [CONFIRM WITH LOCAL COUNSEL]. Because Sofouw only introduces men to women for marriage, your use of the app may also reveal information about your sex life or sexual orientation, which UK law treats as sensitive. Your chats and "About you" text may contain other sensitive data if you choose to include it.
We use this information on the basis of your explicit consent, which we ask for separately and clearly when you sign up. We use it only to provide Sofouw: to build your profile, to help Khala understand you, to suggest and introduce suitable matches, to show your profile to potential matches, and to run the features you choose to use. Where we need to use it to keep people safe or to deal with legal claims, we may rely on the other grounds the law allows (section 6).
Some countries require us to obtain a permit or authorisation from the regulator before we process sensitive data (for example Qatar and Oman) [CONFIRM WITH LOCAL COUNSEL]. We will obtain these where they are required.
You can withdraw your consent at any time. Because faith is central to how Sofouw matches people, we cannot offer matching without it. You can withdraw consent by removing optional answers [confirm which fields are optional], by deleting facts in "What Khala knows about you", or by deleting your account. Withdrawing consent does not affect our use of your information before you withdrew it.
6. How we use your information and our legal bases
The laws that apply to Sofouw only allow us to use personal data where we have a valid legal reason (a "legal basis"). The table below shows the main purposes and the bases we rely on. Not every law recognises every basis. In particular, several laws in the region rely more heavily on consent, and some do not allow "legitimate interests" to be used for sensitive data. Where your country's law requires your consent for a purpose, we ask for it [CONFIRM WITH LOCAL COUNSEL].
| What we use your information for | Legal basis |
|---|---|
| Creating and securing your account and signing you in | Contract (providing the service you asked for) |
| Khala's interview, building your profile, suggesting and writing introductions, and showing your profile to suitable people | Contract; explicit consent for sensitive data |
| Using your nationality, country and town or city for matching, filters and distances | Contract; explicit consent where the law treats this information as sensitive |
| Sending information to Anthropic to power Khala and photo moderation (section 7), including transferring it outside your country (section 14) | Contract and legitimate interests; explicit consent for sensitive data, and wherever the law requires consent to the transfer |
| Letting matches chat, and sending push notifications | Contract; your device permission for notifications |
| Automated photo moderation | Legitimate interests (keeping users safe and preventing fake, explicit or unlawful content) and legal obligation |
| Handling reports and blocks, moderation, keeping evidence of reported content, enforcing our Terms, and suspending or banning accounts | Legitimate interests and legal obligation; for sensitive data, the grounds the law allows for preventing or detecting unlawful acts and safeguarding children and people at risk |
| The wali feature (section 8) | Contract (you ask us to provide it) and explicit consent; for information about your matches, legitimate interests together with the notice they are shown |
| "Hide me from my contacts" (section 11) | Your consent; for the people in your contacts, legitimate interests |
| Service messages, such as changes to our Terms or security alerts | Contract and legitimate interests |
| Selling and providing Sofouw Premium: confirming purchases with Google Play, unlocking Premium features, and handling renewals, cancellations and refunds | Contract; legal obligation (tax and accounting records) |
| Keeping the app secure, fixing problems and understanding how features are used | Legitimate interests |
| Complying with the law and responding to lawful requests from the police, prosecutors, courts or regulators | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests; for sensitive data, the legal claims ground |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this balancing, and you have the right to object (section 17). Section 18.1 sets out the specific legal provisions for users in the UK.
7. Khala, our AI matchmaker
Khala is an AI persona, not a person. Khala is powered by the Claude API provided by Anthropic, PBC, which acts as our processor (service provider). Anthropic processes data in the United States on our instructions under a data processing agreement. Khala talks to you in English or Arabic, as you choose.
What is sent to Anthropic:
- your interview answers and biodata, including your free-text answers so that Khala can understand them;
- the messages you type to Khala, and the facts Khala remembers about you;
- the profile details of people being introduced to you (and, in the same way, your profile details when you are introduced to someone else), so that Khala can write introductions, "Khala's word", icebreakers and suggested openers;
- photos you upload, for automated moderation (section 9);
- if your wali asks Khala about your matches, the wali's questions and those matches' profile details;
- messages in your match chats, only to write a weekly summary for a wali who has "weekly summary" access (section 8).
Icebreakers and suggested openers come from profiles, not from chats. Khala writes them using profile information only. Khala does not read your conversations to write them, and your chat messages are not sent to Anthropic for this purpose. You can turn off Khala's icebreakers at any time in [SETTINGS LOCATION — confirm].
The only time chat messages are sent to Anthropic is when a user has given their wali "weekly summary" access. Once a week, that week's messages in that user's chats are sent to Anthropic so that Khala can write a short summary for the wali. Everyone in those chats is told that a wali is present and at what level.
What is not sent to Anthropic: your phone number, your email address, your exact date of birth (Khala sees your age), your wali's phone number, and your contact hashes.
Anthropic does not use data submitted through its commercial API to train its models, and keeps it only for a limited period under its terms [confirm against Anthropic's current commercial terms and data processing addendum].
What Khala knows about you: you can view the individual facts Khala remembers about you and delete any of them in the app. When you delete a fact, Khala stops using it and we remove it from our live systems; copies in backups are overwritten within our normal backup cycle (target 30 days). Khala is instructed not to remember health, sexual or financial details, or personal details about other people.
AI can be wrong. Khala's introductions, summaries and suggestions are generated automatically. They may be inaccurate or incomplete, and they rely on what users have told Khala. Please check important things for yourself.
Profiling and automated decisions: we use your answers and preferences to work out who may suit you and to write introductions. This is a form of profiling. Khala never makes decisions about you that have a legal or similarly significant effect: you decide who to like, who to talk to and whether to marry. If automated photo moderation rejects a photo and you think it got it wrong, contact support@sofouw.com and a member of our team will review it [confirm process].
8. The wali feature
You can invite one wali (for example your father, brother, uncle or imam). The app prepares a text message (SMS) containing a private link, which you send from your own phone — we do not send the message, and your mobile operator's normal charges may apply. Your wali opens the link in a web browser (no app needed) and enters the last four digits of their phone number to see the wali page. We store the secret part of the link only in a scrambled (hashed) form, and repeated wrong attempts temporarily lock the page.
You choose your wali's access level:
- Full chats: your wali can read your match chats in full, including your matches' messages.
- Weekly summary: Khala writes a weekly summary of your chats, and your wali sees the summary rather than the messages. To do this, that week's messages are sent to Anthropic (section 7).
- Matches only: your wali sees who you are talking to and when you matched.
You can also choose to let your wali approve photo reveals, and to let your wali ask Khala about your matches' profiles. You can change or remove your wali at any time; once removed, their link stops working [confirm: immediately].
Everyone in the chat is told. When a wali is present, both you and the person you are talking to are shown that a wali is present and what their access level is, so that the other person can decide what to share or choose to unmatch. We rely on legitimate interests to show your matches' information to your wali: involving a wali or family in marriage discussions is a recognised practice that users of a Muslim marriage app can reasonably expect, and the notice keeps it transparent [CONFIRM WITH LOCAL COUNSEL the legal basis for showing a match's messages, including any sensitive data, to a wali — especially in countries where consent is the main legal basis, such as Saudi Arabia].
Information about walis: we process the details you give us about your wali (name, relationship, phone number and language), when they use the wali page, their photo-reveal decisions, and the questions they ask Khala (which are sent to Anthropic). Please make sure your wali agrees before you share their number with us, and tell them about this policy; the wali page also links to it. Anyone with both the link and the four digits could open the wali page, so ask your wali to keep the link private. Your wali may live in a different country from you (section 14).
9. Photos and who can see them
By default, your photos are blurred for other people until you match. You can choose a different visibility level: after match, people I like, or everyone. If you have turned on wali approval, your clear photo is only revealed once your wali approves.
Blurred versions are created on our servers, so your clear photo is never sent to the device of anyone who is not entitled to see it under your settings.
Every photo is checked by automated moderation before it is shown. It must be a real photo of an adult who could plausibly be the account holder. Modest coverings such as hijab and niqab are completely fine. Your face should be clearly visible; with niqab, your eyes should be clear. Photos are rejected if they contain nudity or sexualised poses, show a child as the main subject, show no real person (for example memes, scenery or AI-generated images), contain contact details, show anyone other than you, do not show your face clearly, show violence, weapons or hateful symbols, or appear to be a celebrity, stock or professional model photo.
Please remember that people who can see your photos could still take screenshots. Sharing other people's photos is against our Community Guidelines, and may be a crime in some countries, but we cannot completely prevent it.
10. Your location and distances
We do not use GPS or track your location. You choose your country and your town or city from a list. To calculate distances, we use the approximate central point of the town or city you chose — not your actual position. Distances are shown in kilometres.
By default, you are only introduced to people who live in the same country as you. If you turn on "Open to other countries", you can be introduced to people who live in other countries where Sofouw is available, and your profile can be shown to them. You can turn this off at any time.
11. Hide me from my contacts (optional)
If you turn on "Hide me from my contacts", the app asks for permission to read your phone's contacts. On your device, the phone numbers in your contacts are converted to international format and then into one-way hashes using SHA-256. Only these hashes are uploaded — we never receive names, readable phone numbers or any other contact details. To make this work in both directions, we also keep a hash of your own phone number.
We use the hashes solely to avoid showing you to people in your contacts, and to avoid showing them to you. We do not use them to contact anyone, to suggest matches, or for any other purpose, and we do not share them. Because hashed phone numbers could in theory be matched back to numbers, we treat them as personal data and protect them accordingly.
Contacts permission is optional, and Sofouw works without it. You can turn the feature off in the app, and withdraw the permission in your phone's settings, at any time. When you turn it off, we delete the uploaded hashes [confirm timing].
12. Safety, moderation and reporting
You can report, block or unmatch anyone. When you report a profile or a conversation, we save an evidence snapshot — a copy of the reported profile and the recent conversation — so that our moderators can review it. The snapshot is kept even if either account is later deleted (section 15). Our moderators may also look at the relevant profiles, photos and account history.
We do not routinely read your chats. A moderator will read a conversation when it has been reported to us, or where we are required to by law. Photos are checked by automated moderation (section 9). We may suspend or ban accounts that break our Terms or Community Guidelines, and we keep a limited record of banned accounts to stop them re-joining [confirm what is kept and for how long].
Where the law requires it, or where it is necessary to protect someone from serious harm, we may share information with the police, public prosecution or other competent authorities in the relevant country. This includes reporting suspected child sexual exploitation and abuse (see our Child Safety Standards).
13. Who we share your information with
- Other users: your profile (showing your age, not your date of birth), including your nationality and your town or city; your photos, in line with your visibility settings; and the messages you send to your matches. We never show your phone number or email address to other users.
- Walis: your wali sees what your chosen access level allows. If a match has a wali, that wali may see information about you, and you will be shown a notice.
- Our service providers (processors):
- Google (Firebase Authentication and Firebase Cloud Messaging) — sign-in, sending SMS sign-in codes, and push notifications. Google processes your phone number or Google account details, and technical information such as IP address, to sign you in and prevent abuse.
- Meta Platforms (WhatsApp Business Platform) — sending sign-in codes by WhatsApp. Meta processes your phone number and the code message to deliver it.
- Anthropic, PBC — the Claude API, which powers Khala and automated photo moderation (section 7).
- [HOSTING PROVIDER, REGION — e.g. GCC region, confirm] — hosting our servers, our database, and the storage where photos are kept.
- Google Play: if you subscribe to Premium, Google is the seller and handles your payment under its own privacy policy. So that a purchase is credited to the right account, we give Google Play a scrambled (hashed) identifier for your Sofouw account, never your name, phone number or profile.
- Authorities: the police, public prosecution, courts, regulators or other public bodies, where the law requires it or to protect people from serious harm.
- Professional advisers: such as lawyers, accountants and insurers, under a duty of confidentiality.
- A new owner: if our business is sold or merged, your information may pass to the new owner, who must protect it in line with this policy. We will tell you before this happens.
We never sell your information, and we do not share it with advertisers. When you download Sofouw from an app store, such as Google Play, the store handles some information under its own privacy policy.
14. Where we store your information and international transfers
14.1 Where your information is stored
Our servers, database and photo storage are hosted by [HOSTING PROVIDER, REGION — e.g. GCC region, confirm]. Unless that region is in your own country, storing your information there is itself an international transfer.
14.2 Who receives it outside your country
- Anthropic — in the United States (Khala and photo moderation);
- Google (Firebase) — in the United States and other countries (sign-in, SMS codes and push notifications);
- Meta (WhatsApp) — in the United States, Ireland and other countries (sign-in codes sent by WhatsApp);
- Google (Google Play) — in the United States and other countries (Premium subscriptions);
- our hosting provider — in [HOSTING PROVIDER, REGION — e.g. GCC region, confirm];
- other users and walis in other countries — if you turn on "Open to other countries", your profile may be shown to people living in other countries where Sofouw is available; your wali, or your matches' walis, may also live in another country.
14.3 How we protect your information when it is transferred
Wherever you live, we transfer only the information that is needed. Our service providers are bound by contracts that require them to keep your information confidential and secure and to use it only on our instructions, and we assess the risks of each transfer. In addition, we follow the transfer rules of each country:
| Where you live | How transfers are protected |
|---|---|
| United Kingdom | An approved safeguard, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK–US "data bridge" where the recipient is certified [confirm the safeguard used for each provider] |
| Saudi Arabia | The PDPL and the Regulation on Personal Data Transfer outside the Kingdom (as amended in 2024): transfers only for permitted purposes, limited to the minimum necessary, protected by an approved safeguard such as SDAIA's standard contractual clauses, and supported by a transfer risk assessment where required, including for sensitive data. [CONFIRM WITH LOCAL COUNSEL: the Saudi transfer rules may require an additional risk assessment, your explicit consent, or other measures before Saudi users' data — including information about religious beliefs — is sent to Anthropic in the United States. Consider whether hosting or processing within the Kingdom is needed.] |
| United Arab Emirates | The PDPL allows transfers to countries with adequate protection or, otherwise, under contractual safeguards or with your express consent [CONFIRM WITH LOCAL COUNSEL — the executive regulations are still pending]. DIFC or ADGM rules apply only if we are established in one of those free zones. |
| Qatar, Bahrain, Oman, Jordan | Transfers are permitted subject to conditions, such as adequate protection in the destination country, contractual safeguards, regulator approval or your consent [CONFIRM WITH LOCAL COUNSEL for each country] |
| Egypt | Transfers abroad may require a licence from the Personal Data Protection Center and your explicit consent or adequate protection in the destination country [CONFIRM WITH LOCAL COUNSEL] |
| Morocco, Tunisia, Algeria | Transfers abroad generally require prior authorisation from the regulator (the CNDP, the INPDP or the ANPDP respectively) [CONFIRM WITH LOCAL COUNSEL] |
| Other countries | The same contractual and security safeguards described above, together with any requirements of local law [CONFIRM WITH LOCAL COUNSEL] |
Where the law of your country requires your consent to a transfer, we will ask for it separately in the app before the transfer takes place [confirm consent flow]. You can ask us for more information about these safeguards, or for a copy of them, at support@sofouw.com.
15. How long we keep your information
| Information | How long we keep it |
|---|---|
| Account, profile (including nationality), photos (including blurred versions), preferences, Khala memories and introductions | While your account is active. When you delete your account, we delete them promptly — our target is within 30 days, including backups |
| Records of sign-in codes sent by WhatsApp (your number, when, whether delivered, tries) | 7 days |
| Premium subscription records | While your account is active; deleted with your account. Google Play keeps its own records of your purchases as the seller [CONFIRM WITH LOCAL COUNSEL whether we must keep our own purchase records for tax or accounting, and for how long] |
| Individual Khala facts you delete | Removed from live systems straight away; backups overwritten within our normal cycle (target 30 days) |
| Matches and chat messages | While the match exists and both accounts are active [confirm what happens to chats after an unmatch]. When either person deletes their account, the match and the whole conversation are deleted for both people — the other person will see the conversation disappear |
| Evidence snapshots of reported content (the reported profile and recent conversation) | [RETENTION PERIOD, e.g. 12 months] after the report is resolved, even if either account has been deleted, or longer if needed for a legal claim or a request from the police, prosecutors or a regulator |
| Contact hashes | Until you turn off "Hide me from my contacts" or delete your account |
| Wali details, weekly summaries and the wali's questions to Khala | Until you remove your wali or delete your account [confirm retention of past summaries] |
| Push notification token | Until you sign out or delete your account |
| Server logs | [LOG RETENTION PERIOD — confirm] |
| AI usage records | [AI USAGE RECORD RETENTION PERIOD — confirm] |
| Records of banned accounts | [BAN RECORD RETENTION PERIOD — confirm] |
Some laws require us to keep certain records for a minimum period, or to delete information sooner; where they do, we follow them [CONFIRM WITH LOCAL COUNSEL]. We may also delete accounts that have been inactive for a long period, after giving notice [confirm inactivity policy].
Because conversations are deleted for both people when either account is deleted, a conversation with someone may disappear if they delete their account.
Pausing and closing your profile: pausing your profile hides you from new introductions. Choosing "I found someone, alhamdulillah" closes your profile to new introductions. In both cases your information is kept until you delete your account.
Deleting your account: you can delete your account in the app (Me → Account → Delete account) or on our website at https://sofouw.com/delete-account.
16. How we protect your information
We use appropriate technical and organisational measures to protect your information. These include encryption in transit, [encryption at rest — confirm], access controls so that only staff who need information can see it, server-side photo blurring, hashing of contact numbers on your device, and protection of the wali page by a private link (stored only in hashed form), the last four digits of the wali's phone number, and a temporary lock after repeated wrong attempts.
No system is completely secure. If a data breach occurs, we will notify the relevant regulators within the time limits set by law — for example, within 72 hours under the UK GDPR and Saudi Arabia's PDPL [CONFIRM WITH LOCAL COUNSEL the deadlines in other countries] — and we will tell you without undue delay where the law requires it or where the risk to you is high.
17. Your rights
Depending on where you live, the law gives you some or all of the rights below. We offer all of them to every user, wherever they live, unless the law prevents it or a legal exception applies. You have the right to:
- be informed about how we use your information (this policy);
- access your personal data and receive a copy of it;
- rectification — have inaccurate or incomplete data corrected (you can edit most of your profile in the app);
- erasure — have your data deleted;
- restriction — ask us to limit how we use your data;
- portability — receive data you gave us in a structured, machine-readable format, or have it sent to another organisation;
- object to processing based on legitimate interests;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects;
- complain to the data protection regulator in your country (section 18).
Many of these you can do yourself in the app: edit your profile, view and delete "What Khala knows about you", change who sees your photos, remove your wali, or delete your account. For anything else, email support@sofouw.com. We may need to confirm your identity first.
We will respond within 30 days, or within one month for UK users, or sooner if your country's law requires it. If your request is complex, we may extend this where the law allows (for example, by up to two further months in the UK), and we will tell you why. There is usually no charge.
18. Your country
The table below lists the main data protection law and regulator for each country where Sofouw is available. Laws and regulators change, and some of the details below still need to be confirmed. Where a country has no comprehensive data protection law, we apply the same standard described in this policy.
| Country | Main data protection law | Regulator | Notes |
|---|---|---|---|
| Algeria | Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended by Law No. 25-11 of 2025 | National Authority for the Protection of Personal Data (ANPDP) | Applies to foreign companies; registration, a DPO and authorisation for transfers abroad may be required [CONFIRM WITH LOCAL COUNSEL] |
| Bahrain | Law No. 30 of 2018 on Personal Data Protection | Personal Data Protection Authority (its functions are currently exercised by the Ministry of Justice, Islamic Affairs and Waqf) [CONFIRM WITH LOCAL COUNSEL] | Notification or prior authorisation may be required for some processing of sensitive data [CONFIRM WITH LOCAL COUNSEL] |
| Comoros | No comprehensive data protection law that we are aware of [CONFIRM WITH LOCAL COUNSEL] | — | Our global standard applies |
| Djibouti | No comprehensive data protection law that we are aware of [CONFIRM WITH LOCAL COUNSEL] | — | Our global standard applies |
| Egypt | Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (2025) | Personal Data Protection Center (PDPC) | Licences, a DPO, a local representative for foreign companies, and a licence and consent for transfers abroad may be required [CONFIRM WITH LOCAL COUNSEL] |
| Iraq | No comprehensive data protection law that we are aware of [CONFIRM WITH LOCAL COUNSEL] | — | Our global standard applies |
| Jordan | Personal Data Protection Law No. 24 of 2023 | Personal Data Protection Council, supported by the Ministry of Digital Economy and Entrepreneurship [CONFIRM WITH LOCAL COUNSEL] | — |
| Kuwait | No comprehensive data protection law. CITRA's Data Privacy Protection Regulation (Decision No. 26 of 2024) applies to licensed telecommunications and IT service providers [CONFIRM WITH LOCAL COUNSEL whether it applies to Sofouw] | Communication and Information Technology Regulatory Authority (CITRA) | Our global standard applies |
| Lebanon | Law No. 81 of 2018 on Electronic Transactions and Personal Data | Ministry of Economy and Trade [CONFIRM WITH LOCAL COUNSEL] | Declarations or licences may be required for some processing [CONFIRM WITH LOCAL COUNSEL] |
| Libya | No comprehensive data protection law that we are aware of [CONFIRM WITH LOCAL COUNSEL] | — | Our global standard applies |
| Mauritania | Law No. 2017-020 on the protection of personal data | Personal Data Protection Authority [CONFIRM WITH LOCAL COUNSEL whether it is operational] | — |
| Morocco | Law No. 09-08 of 2009 on the protection of individuals with regard to the processing of personal data | National Commission for the Control of Personal Data Protection (CNDP) | Prior declaration or authorisation; transfers abroad generally require CNDP authorisation [CONFIRM WITH LOCAL COUNSEL] |
| Oman | Personal Data Protection Law (Royal Decree No. 6/2022) and its Executive Regulation (Ministerial Decision No. 34/2024) | Ministry of Transport, Communications and Information Technology (MTCIT) | A permit is required to process sensitive data [CONFIRM WITH LOCAL COUNSEL] |
| Palestine | No comprehensive data protection law that we are aware of [CONFIRM WITH LOCAL COUNSEL] | — | Our global standard applies |
| Qatar | Law No. 13 of 2016 on the Protection of Personal Data Privacy | National Data Privacy Office, National Cyber Security Agency [CONFIRM WITH LOCAL COUNSEL] | Permission is required to process "personal data of a special nature", which includes religious beliefs and marital relations [CONFIRM WITH LOCAL COUNSEL]. The Qatar Financial Centre has its own rules, relevant only if we are established there |
| Saudi Arabia | Personal Data Protection Law (Royal Decree No. M/19 dated 9/2/1443H, as amended in 2023), in force since 14 September 2023, with its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom | Saudi Data and Artificial Intelligence Authority (SDAIA) | Strict transfer rules (section 14); registration, DPO and local representative rules may apply to us [CONFIRM WITH LOCAL COUNSEL]. See section 18.2 |
| Somalia | Data Protection Act 2023 (Law No. 005 of 2023) | Data Protection Authority [CONFIRM WITH LOCAL COUNSEL] | — |
| Sudan | No comprehensive data protection law that we are aware of [CONFIRM WITH LOCAL COUNSEL] | — | Our global standard applies |
| Syria | Law No. 12 of 2024 on the protection of electronic personal data [CONFIRM WITH LOCAL COUNSEL] | [CONFIRM WITH LOCAL COUNSEL] | — |
| Tunisia | Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data | National Authority for the Protection of Personal Data (INPDP) | Transfers abroad require INPDP authorisation [CONFIRM WITH LOCAL COUNSEL] |
| United Arab Emirates | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) | UAE Data Office | Executive regulations still pending [CONFIRM WITH LOCAL COUNSEL]. Companies established in the DIFC or ADGM free zones are instead covered by DIFC Data Protection Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021 — relevant only if we are established there. See section 18.3 |
| Yemen | No comprehensive data protection law that we are aware of [CONFIRM WITH LOCAL COUNSEL] | — | Our global standard applies |
| United Kingdom | UK GDPR and the Data Protection Act 2018, as amended (including by the Data (Use and Access) Act 2025) | Information Commissioner's Office (ICO) | See section 18.1 |
18.1 Users in the United Kingdom
- Legal bases. We rely on Article 6(1)(b) UK GDPR (contract), Article 6(1)(f) (legitimate interests), Article 6(1)(c) (legal obligation) and Article 6(1)(a) (consent). For special category data, we rely on explicit consent (Article 9(2)(a)); on the substantial public interest conditions in Schedule 1 of the Data Protection Act 2018 (such as preventing or detecting unlawful acts, and safeguarding children and individuals at risk) for safety and moderation; and on Article 9(2)(f) for legal claims.
- Rights. You have all the rights listed in section 17. We will respond within one month, which we may extend by up to two further months for complex requests.
- Transfers. Transfers outside the UK are protected as described in section 14.3.
- Online safety. We take steps to protect users from illegal and harmful content in line with our duties under the Online Safety Act 2023.
- Complaints. Please contact us first. You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
18.2 Users in Saudi Arabia
- Scope. The PDPL applies to our processing of personal data of people living in the Kingdom, even though we are based outside it [confirm if we are established in the Kingdom].
- Sensitive data. Information about your religious beliefs is sensitive data under the PDPL, and we process it only with your explicit consent. We do not rely on legitimate interests for sensitive data.
- Rights. Under the PDPL you have the right to be informed, to access your personal data, to obtain a copy of it in a clear and readable format, to have it corrected, completed or updated, to have it destroyed when it is no longer needed, and to withdraw your consent. You also have the other rights in section 17.
- Transfers. Transfers outside the Kingdom are made only as described in section 14.3 [CONFIRM WITH LOCAL COUNSEL].
- Registration and representative. [SDAIA NATIONAL REGISTER OF CONTROLLERS NUMBER, if required]; [SAUDI ARABIA REPRESENTATIVE NAME AND ADDRESS, if required] [CONFIRM WITH LOCAL COUNSEL].
- Complaints. Please contact us first. You can complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) at sdaia.gov.sa.
18.3 Users in the United Arab Emirates
- Scope. The PDPL applies to our processing of personal data of people living in the UAE, even though we are based outside the UAE [confirm if we are established in the UAE, and whether in the DIFC or ADGM].
- Sensitive data. Information about your religious beliefs is sensitive data under the PDPL, and we process it only with your express consent.
- Rights. You have the right to receive information about our processing, to access and receive a copy of your data, to data portability, to correction and erasure, to restriction, to stop processing, and to object to decisions based solely on automated processing. You also have the other rights in section 17.
- Complaints. Please contact us first. You can complain to the UAE Data Office [CONFIRM WITH LOCAL COUNSEL the current complaints procedure].
18.4 Users in other countries
Several countries require us to obtain a licence, permit or prior authorisation before processing sensitive data or transferring data abroad, or to appoint a local representative or data protection officer — for example Qatar, Oman, Egypt, Bahrain, Morocco, Tunisia, Algeria and Lebanon [CONFIRM WITH LOCAL COUNSEL]. We will meet these requirements before offering Sofouw in those countries, and we will list any registration numbers in section 1. You can complain to the regulator listed for your country in the table above.
19. Children
Sofouw is strictly for adults aged 18 and over, or the age of legal majority in your country if that is higher [CONFIRM WITH LOCAL COUNSEL]. We do not allow anyone under 18 to use Sofouw, even where local law allows marriage below that age. We do not knowingly collect information from anyone under 18. If we learn that a user is under 18, we will close the account and delete their information, except where we must keep it for safety or legal reasons. If you are concerned that a child is using Sofouw, contact support@sofouw.com. Our Child Safety Standards explain how we protect children.
20. Cookies and similar technologies
We do not use advertising or tracking cookies. The app stores a small amount of information on your device that it needs to work, such as your sign-in session and settings. The wali page and the account deletion page use only cookies or similar storage that are strictly necessary for them to work securely [confirm].
21. Changes to this policy
We may update this policy from time to time. If we make important changes, we will tell you in the app before they take effect and, where the law requires it, ask for your consent again. The effective date at the top shows when this policy was last updated.
22. Complaints
If you have a concern about how we use your information, please contact us first at support@sofouw.com and we will try to put it right. You also have the right to complain to the data protection regulator in your country, listed in section 18.
23. Language versions
This policy is published in English and Arabic. Both versions are intended to have the same meaning. If there is any difference between them, the [PREVAILING LANGUAGE — confirm; some jurisdictions may require the Arabic version to prevail] version prevails, except where the law of your country requires otherwise.