Privacy Policy

When a family comes to ShadiSunnah looking for a marriage match for their son or daughter, they place an enormous amount of trust in us. They share photographs of their children, details about their family background, and personal identity documents. We do not take that trust lightly.

This Privacy Policy explains, in plain and straightforward language, what personal information we collect from you, why we collect it, how we use it, who we may share it with, and what rights you have over your own data. It applies to every person who visits, registers on, or uses the ShadiSunnah platform at www.shadisunnah.com.

ShadiSunnah operates primarily under the Personal Data Protection Act 2025 (PDPA) of Pakistan and additionally respects the data protection frameworks applicable in the United Kingdom, the European Union, the United Arab Emirates, and Saudi Arabia for users based in those regions. We have written this policy in plain language because we believe you deserve to understand exactly how your information is handled, not because a regulator told us to bury it in legal terms.

If you have any questions after reading this, please contact us at privacy@shadisunnah.com

1. Who We Are

ShadiSunnah is the Data Controller for all personal information collected through the Platform. This means we are responsible for deciding how and why your data is used, and we are accountable to you and to the applicable data protection authorities in each jurisdiction we operate in.

Under the Personal Data Protection Act 2025 of Pakistan, ShadiSunnah is a personal data controller as defined under that Act, meaning we determine the purposes and means of processing your personal data and are obligated to handle it lawfully, fairly, and transparently.

Contact details:

Email: privacy@shadisunnah.com

Support portal: www.shadisunnah.com/support

2. What Information We Collect

2.1 Information You Give Us Directly

When you register an account:

• Your first and last name
• Your email address
• Your phone number including country dialling code
• Your password, stored as a one way cryptographic hash your actual password is never stored or readable by anyone including us
• Your relationship to the profile subject such as father, mother, brother, sister, uncle, or aunt
• Your national identity document number, either a Pakistani CNIC thirteen digit national identity card number or a passport number
• Scanned images or photographs of your identity documents

When you create a profile for your family member:

• Their first and last name
• Date of birth and age
• Gender
• Religion and religious sect
• Caste, which is optional
• Nationality and country of residence
• City of residence
• Marital status including whether previously married, divorced, or widowed
• Education level and field of study
• Profession and approximate income range
• Physical attributes including height, complexion, and body type
• Hobbies, interests, and languages spoken
• A personal description written by the family
• Profile photograph and any additional gallery images

When you make a payment:

• Cardholder name
• Billing address including street, city, postal code, and country
• Card type such as Visa or Mastercard and the last four digits
• Card expiry month and year

Important: Your full card number, CVV security code, and complete card details are never transmitted to or stored on ShadiSunnah servers at any point. All payment processing is handled exclusively by Stripe Inc., a global payment processor certified to PCI DSS Level 1, the highest level of payment security certification available. We receive only a tokenised reference and the limited display details listed above.

When you contact support:

• The contents of support tickets you raise
• Messages exchanged with our support team
• Reports you submit about other profiles
• Any other correspondence you send us

2.2 Information We Collect Automatically

When you use the Platform, certain technical information is recorded automatically:

• Your IP address at the time of registration and each login
• The type of device you are using, your operating system, and your browser
• Pages you visit on the Platform and how long you spend on them
• How you navigate through the Platform including what you click on and what you search for
• Your approximate country of location, derived from your IP address, used solely to display correct pricing

We run our own internal analytics system. We do not use Google Analytics, Facebook Pixel, TikTok Pixel, Hotjar, or any third party tracking service that follows you across the internet. What happens on ShadiSunnah stays on ShadiSunnah.

2.3 Information From Third Parties

• Stripe Inc. when you make a payment, Stripe confirms to us whether it was successful and provides us with a customer reference ID and payment method token
• MaxMind GeoIP we use MaxMind's database to detect your country from your IP address for pricing purposes. Your personal data is not shared with MaxMind.

3. The Legal Basis for Processing Your Data

Under the Pakistan Personal Data Protection Act 2025, we are required to have a lawful basis for every use of your personal data. The lawful bases we rely on are as follows.

3.1 Performance of a Contract

We use your data to deliver the service you signed up for. This includes:

• Creating and managing your account
• Verifying your identity before your profile goes live
• Displaying your family's profile to other verified families on the Platform
• Processing your payment and activating your package
• Showing you search results and match suggestions
• Sending you transactional emails including account confirmation, payment receipts, expiry reminders, and password resets
• Allowing you to send and receive connection requests
• Managing your support tickets

3.2 Legitimate Interests

We have a responsibility to protect every family on the Platform from fraud, fake profiles, and abuse. We use your information to:

• Review identity documents before approving profiles
• Log IP addresses to detect and block suspicious registration patterns
• Detect and reject disposable email addresses commonly used in fraudulent signups
• Identify and investigate reports made against profiles
• Take action against accounts that violate our Terms and Conditions

We have carefully balanced these interests against your privacy rights and concluded that maintaining a safe platform is proportionate and necessary. You have the right to object to processing based on legitimate interests at any time.

3.3 Legal Obligation

• We retain payment records for the period required under applicable Pakistani tax and financial regulations, generally seven years
• We may retain certain data if required to cooperate with a lawful investigation by Pakistani law enforcement or a court order
• We maintain records as required under applicable company and regulatory law

3.4 Consent

At present we do not send marketing emails or newsletters. If we introduce this in future, we will only do so with your explicit opt in consent and you will be able to withdraw it at any time without affecting anything else.

4. Sensitive Personal Data

The Pakistan PDPA recognises certain categories of data as sensitive, requiring a higher standard of care. Some of the information we collect falls within these categories, specifically:

• Biometric data identity document images including CNIC photographs
• Religious information religion, sect, and related beliefs
• Personal life information marital history

We collect this data solely for the purpose of identity verification and profile creation. It is never shared with third parties for any commercial purpose. It is never used for profiling beyond what you consented to when registering. Religious information is collected because it is a central and expected part of a halal matrimonial search and users knowingly provide it for that specific purpose.

5. Who We Share Your Information With

We do not sell your personal data. We do not allow advertisers anywhere near it. We share it only in the specific circumstances described below.

5.1 Our Service Providers

We work with a small number of trusted companies who process data on our behalf under strict contractual agreements:

• Stripe Inc. payment processing
• Resend sending transactional emails
• Cloudflare content delivery and DDoS protection, which processes IP addresses as part of protecting the platform from attacks
• Our hosting provider the servers that run the Platform
• MaxMind GeoIP lookups, no personal data is shared

None of these companies are permitted to use your data for their own purposes. All are bound by data processing agreements that require them to handle your data in accordance with applicable law.

5.2 Other Families on the Platform

When your profile is approved and active, the following information is visible to other verified and logged in families:

• Your family member's name, age, city, religion, education, profession, and personal description
• Their profile photograph and gallery images

The following information is never visible to other families under any circumstances:

• Your email address
• Your phone number
• Your identity document details or document images
• Your IP address or technical data
• Your payment information

5.3 Law Enforcement and Regulatory Authorities

If we are required by a valid court order, law enforcement request, or regulatory authority to disclose personal data, we will comply with that legal obligation. Where permitted by law and where doing so would not compromise an investigation, we will notify you before disclosing your data. We will never voluntarily hand over personal data to any authority without a valid and documented legal basis.

In Pakistan, this means we will comply with valid requests from the Federal Investigation Agency, the National Commission for Personal Data Protection, and courts of competent jurisdiction.

5.4 Business Transfers

If ShadiSunnah is ever acquired, merged with another entity, or its assets transferred, personal data may form part of that transaction. We will give you advance notice and ensure the receiving party is bound by equivalent privacy obligations.

6. International Data Transfers

Some of our service providers are based outside Pakistan. When personal data is transferred internationally, we ensure appropriate legal safeguards are in place consistent with the requirements of the Pakistan PDPA, including:

• Contractual clauses that require receiving parties to handle your data to the same standard we apply
• Transfers only to countries or entities that provide adequate protection

Stripe Inc. is based in the United States and is subject to PCI DSS certification and applicable US financial privacy law. Cloudflare operates globally under strict data processing terms. All other providers are contractually restricted to processing your data in a manner consistent with the PDPA.

7. How Long We Keep Your Data

We do not keep your data longer than we need it. The table below sets out our main retention periods.

When your account is deleted, all data except payment records is permanently and irreversibly removed from our systems after the 30 day grace period. Payment records are retained for the legally required period only and cannot be used for any other purpose during that time.

8. Your Rights Under the Pakistan PDPA

Under the Personal Data Protection Act 2025, you have the following rights. To exercise any of them, email privacy@shadisunnah.com with the subject line Data Rights Request and we will respond within 30 days, free of charge.

Right to Be Informed You have the right to know what data we collect, why we collect it, and how we use it. This Privacy Policy fulfils that obligation.

Right of Access You can request a copy of all personal data we hold about you.

Right to Correction You can ask us to correct any inaccurate or incomplete data we hold about you.

Right to Erasure You can ask us to delete your personal data. We will do so except where we are legally required to retain it.

Right to Restriction You can ask us to stop processing your data in certain circumstances while a concern is being resolved.

Right to Data Portability You can request your data in a structured, machine readable format such as CSV or JSON to transfer to another service.

Right to Object You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your rights.

Rights Related to Automated Decision Making Our compatibility scoring algorithm is automated processing but does not produce any legally significant decision about you. All actual decisions are made by families themselves. You have the right to ask us how the algorithm works by contacting privacy@shadisunnah.com

Right to Complain If you are unhappy with how we have handled your data, you have the right to complain to the relevant supervisory authority:

Pakistan: National Commission for Personal Data Protection (NCPDP), established under the PDPA 2025. You may also contact the FIA Cybercrime Wing at www.fia.gov.pk

United Kingdom: Information Commissioner's Office at www.ico.org.uk, telephone 0303 123 1113

UAE: UAE Data Office at www.uaedataoffice.gov.ae

Saudi Arabia: Saudi Data and Artificial Intelligence Authority (SDAIA) at www.sdaia.gov.sa

We always prefer to resolve concerns directly. Please contact us first at privacy@shadisunnah.com and we will do our best to resolve the matter promptly.

9. Security

We take security seriously and have implemented the following measures:

• All data in transit is encrypted using TLS 1.2 or higher HTTPS everywhere with no HTTP access permitted
• Passwords are hashed using bcrypt with a minimum cost factor of 12
• Identity document images are stored in private, non publicly accessible server directories and deleted after verification
• Payment card data is processed exclusively by Stripe and never touches our servers
• All uploaded images are re encoded from scratch to strip any embedded malicious payloads
• Session tokens are cryptographically generated and regenerated at every login
• Admin access to the platform requires multi factor authentication
• Database access is restricted to application level credentials with least privilege permissions

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware and will notify affected individuals without undue delay.

10. Children

ShadiSunnah is strictly for adults. Account holders must be 18 years of age or older. Profile subjects must be 18 years of age or older. We do not knowingly collect any personal data from minors. If we discover that a profile has been created for someone under 18, we will immediately suspend the account, delete the data, and notify the relevant authority where required by law.

11. Cookies

We use only technically necessary cookies required for the platform to function for example, to maintain your login session. We do not use advertising cookies, tracking cookies, or any third party cookies that follow you across other websites. For full details, please read our Cookie Policy.

12. Changes to This Policy

When we make material changes to this Policy, we will notify you by email at least 14 days before the changes take effect and display a prominent notice on the Platform. The date at the top of this document shows when it was last updated. Continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy.

For all privacy and data protection enquiries: privacy@shadisunnah.com Support portal: www.shadisunnah.com/support Response commitment: within 30 days of your verified request, free of charge