Privacy Policy
Last updated
Privacy Policy
Version 1.0 — 27 August 2026. This document explains what Mouqaabala does with your data, in language you should be able to understand without being a lawyer. The articles cited are those of Regulation (EU) 2016/679, the GDPR.
TO BE COMPLETED BY THE CLIENT: this text is a draft. It must be reviewed and approved by a lawyer and by a data protection officer before publication. Every "TO BE COMPLETED BY THE CLIENT" marks information we cannot write for you: inventing it would be worse than leaving it blank.
1. The essentials, in ten lines
- Mouqaabala is a matrimonial introduction service. You declare intimate information on it: your religious beliefs, your origins, your health, your plans for married life.
- That information falls under Article 9 GDPR. It is processed only with your explicit consent, asked for separately from the terms of use, and revocable.
- During the discovery phase, nobody but the person you are talking to reads your messages — not the wali, not our team, unless a report is filed.
- If you both decide to continue, the wali appointed by the woman gains access to the complete history of the conversation, from the very first message. You agree to this conversation by conversation, in a box that is never pre-ticked.
- An automatic summary of the conversation is produced by a language model hosted in Europe and given to the wali. It is read online and cannot be downloaded.
- We cannot prevent screenshots. We will not pretend otherwise.
- The public website sets no cookies and does not measure your browsing.
- At any time you may access your data, correct it, take it with you, have it erased, withdraw a consent, and complain to the supervisory authority.
2. Who processes your data
TO BE COMPLETED BY THE CLIENT:
| Information | To be filled in |
|---|---|
| Controller (legal name, legal form) | TO BE COMPLETED BY THE CLIENT |
| Registered office | TO BE COMPLETED BY THE CLIENT |
| Company registration number | TO BE COMPLETED BY THE CLIENT |
| Legal representative | TO BE COMPLETED BY THE CLIENT |
| Contact address for data questions | TO BE COMPLETED BY THE CLIENT |
| Data Protection Officer, if appointed | TO BE COMPLETED BY THE CLIENT |
| EU representative, if the controller is established outside the EU (Article 27) | TO BE COMPLETED BY THE CLIENT |
Appointing a Data Protection Officer is mandatory where an organisation processes Article 9 data on a large scale (Article 37(1)(c)). That is the case here.
The processing described here also falls under Article 35: a data protection impact assessment is required, because special categories of data are processed on a large scale and combined with systematic monitoring of exchanges between individuals.
TO BE COMPLETED BY THE CLIENT: state whether the impact assessment has been carried out, when, and by whom. If it has not, the service must not open.
3. The data we process
3.1 What you give us to open an account
| Data | Required | Why |
|---|---|---|
| Email address | Yes | Login identifier, service notifications |
| Password | Yes | Stored as a hash, never in clear text |
| Phone number | No | Optional. It is no longer requested at signup and is not verified |
| First name | Yes | Shown to other members |
| Date of birth | Yes | Adulthood check: the service is closed to minors |
| City and country | Yes | Geographic search |
| Avatar | Yes | Default representation, before any photo |
| Language and time zone | Yes | Display, quiet hours for notifications |
3.2 What you declare on your profile
The profile has some fifty sections: marital situation, children, appearance, education, occupation, declared income, lifestyle, life plans, expectations of married life, skills, and optional photos and voice introduction.
Any section may be marked "Secret": it stays visible to you and to authorised staff, never to other members.
3.3 Special categories — Article 9
We name them, because that is the only honest way to handle them. The service collects four of the categories listed in Article 9(1):
| Category (Article 9(1)) | Sections concerned |
|---|---|
| Religious beliefs | Religion · Religious practice · Convert · Five daily prayers · Prayer at the mosque · Quran reading · Islamic study · Hajj and Umrah · Hijab |
| Racial or ethnic origin | Declared ethnicity of father and mother |
| Health data | State of health (good health, ill, chronic illness, disability) |
| Data concerning sex life | Position on polygamy · options relating to marital intimacy in the expectations sections |
Two further sections — alcohol and tobacco — are given the same reinforced protection, without formally falling under Article 9.
What this means in practice:
- These sections sit behind a dedicated consent screen, separate from acceptance of the terms of use and separate from consent to the wali's access. A single box covering everything would be worthless (Article 7(2)).
- The health, ethnic origin and polygamy sections are optional. A profile can be published without them. We do not make access to the service conditional on answering them, because consent that cannot be refused is not freely given (Article 7(4)).
- The religious sections may remain mandatory after that consent: they are the very subject of a Muslim matrimonial service. They can still be refused — refusing means not creating a profile.
- You may withdraw this consent at any time (Article 7(3)). The sections concerned are then erased from your profile. Withdrawal does not affect processing carried out beforehand.
3.4 Your exchanges
The content of your messages, their timestamps, the discovery-phase counters, the wali's emoji reactions, your decisions whether to continue, and the automatic summary described in section 5.
3.5 Photos and voice introduction
Optional, and reviewed by a person before being displayed. Your main photo may stay blurred and be revealed only to the profiles you choose to talk to.
3.6 The wali's mandate
The link between a woman and her wali: the wali's identity, the declared family relationship, the status of the mandate (holder or deputy), and the dates it was granted, activated or revoked.
Where a wali invites a woman who does not yet have an account, we temporarily keep the first name and contact details he provided, along with any information he pre-filled. This data is collected before the person concerned has had any say. It is therefore deleted automatically after thirty days without confirmation, and immediately upon an explicit refusal. The first message she receives states who invited her and how to refuse in one step.
3.7 Identity verification
The service provides for three levels of verification, each approved by a person, never by an automated process.
TO BE COMPLETED BY THE CLIENT: describe the documents requested at each level, how long they are kept, and what happens to them after a decision. An identity document kept for an undefined period is a breach in itself.
3.8 Technical and security data
IP address, session identifier, device type, connection dates, and a log of sensitive actions taken by our team (who, on what, why, values before and after).
3.9 Website waiting list
If you leave your email address on the website to be told when we open, it is used for that alone. It is never sold or used for anything else, and you may ask for its deletion at any time.
3.10 What we do not collect
The public website sets no cookies and does not measure your browsing. There is no banner, no tracker, no advertising profile. We sell data to no one.
4. The wali: what he sees, when, and on what agreement
This is the most important point in this document. Read it in full.
4.1 During the discovery phase: nothing
The discovery phase is limited to fifteen messages each. Throughout that phase the wali reads no message. He can neither read it, nor interrupt it, nor close it. His dashboard shows metadata only: that a conversation exists, that a decision is awaited. Never the content.
4.2 At the end of discovery: the complete history
If the woman and the man both answer "yes" to the question of continuing, the wali joins the conversation. From the moment he enters, he has access to the entire history, starting from the very first message — not only the messages exchanged after his arrival. He can then read in real time, write, react with emoji, and close the conversation.
This is the heart of the service, and it is also what surprises people most. We would rather write it twice than once.
4.3 How your agreement is obtained
The wali's access rests on your explicit consent within the meaning of Articles 6(1)(a), 7 and 9(2)(a). That consent is:
- separate: not a clause in the terms of use, but a box of its own;
- per conversation: agreeing once does not commit you for the next one;
- never pre-ticked, and blocking: without both agreements, the conversation does not continue;
- identical for both members, word for word;
- informed: the box shows the wali's first name, his declared family relationship and his status (holder or deputy). Consent given to an unidentified third party would be worth nothing (Article 4(11));
- revocable at any time (Article 7(3)). Revocation closes the conversation. It carries no penalty, no report, no effect on your quotas.
Each acceptance is recorded with the user, the conversation, the timestamp, the version of the terms of use and the exact version of the text accepted (Article 7(1)).
4.4 If the wali changes
Revoking a mandate, or activating a deputy, does not transfer access automatically. Both members of the conversation are asked again before the new wali enters. Either may refuse: the conversation closes, and no one is penalised.
4.5 What the wali can never do
Delete or alter a message. Write under his protégée's identity. Change her profile or her account. Prevent her from ending an exchange. Read her other conversations. Export the messages or the summary. Appoint himself as wali. Accept a request on her behalf.
These prohibitions are not display rules: the server checks them on every request, denying by default.
5. The automatic conversation summary
When the discovery phase closes, a thematic summary is generated automatically by a language model, once, and then cached.
| Point | Rule |
|---|---|
| Who produces it | A language model operated by a provider whose servers are located in Europe. The provider chosen in the design of the service is Mistral AI. |
| Who reads it | The wali, and only the wali, in the wali's language. |
| When | It is exposed only after both members have said "yes". |
| How | Online consultation only. It cannot be downloaded, and no button exports it — neither for the wali nor for you. |
| For how long | For the life of the conversation. It is purged with it. |
| Notice shown | "Automatically generated summary. Refer to the original messages if in doubt." |
Both members are told about this processing in the end-of-discovery dialogue, before they answer. It produces no decision: it scores no one, ranks no one and recommends nothing. Article 22 does not apply, as there is no automated decision producing legal effects.
TO BE COMPLETED BY THE CLIENT: confirm that the processing contract signed with the model provider expressly prohibits reuse of content for model training, and enter the provider in the record of processors (Article 28(3)).
6. Screenshots: what we cannot prevent
A web service cannot technically prevent a screenshot, nor a photograph of the screen taken with another device. No platform can, and we will not pretend otherwise.
What we do:
- there is no "download this conversation" button anywhere in the interface;
- the summary given to the wali cannot be downloaded;
- sharing a conversation, a profile, a photo or a voice recording outside the platform is prohibited by the terms of use and sanctioned under the published scale, up to permanent banning.
What we cannot do: prevent the capture itself. Write knowing that.
7. Why we process this data, and on what basis
| Purpose | Legal basis | Article |
|---|---|---|
| Creating and running your account, letting you use the service | Performance of the contract | 6(1)(b) |
| Processing the religious, ethnic, health and sex-life sections of your profile | Explicit consent | 9(2)(a) |
| Giving the wali access to the history of a conversation | Explicit consent of both members, per conversation | 6(1)(a) and 9(2)(a) |
| Producing the automatic summary given to the wali | Explicit consent, obtained in the same dialogue | 6(1)(a) and 9(2)(a) |
| Verifying your phone number, preventing duplicate accounts | Contract and legitimate interest (fraud prevention) | 6(1)(b) and 6(1)(f) |
| Moderating photos, voice recordings and reported content | Legitimate interest: member safety and rule enforcement | 6(1)(f) |
| Issuing a suspension or a ban, and keeping proof of the decision | Legitimate interest and, where applicable, legal obligation | 6(1)(f) and 6(1)(c) |
| Sending service notifications | Performance of the contract | 6(1)(b) |
| Telling you when the service opens (waiting list) | Consent | 6(1)(a) |
| Keeping accounting records | Legal obligation | 6(1)(c) |
| Responding to a judicial request | Legal obligation | 6(1)(c) |
Where we rely on legitimate interest, you may object (Article 21): see section 11.
8. Who has access to your data
| Who | To what | Within what limits |
|---|---|---|
| You | Everything in your account | No restriction |
| The person you are talking to | Your published profile and your messages | Sections marked "Secret" stay invisible to them |
| The wali | The history of one conversation, from the moment he enters | Only after both agreements, only for his protégée, never for another conversation |
| The moderation team | Profiles and reported content | Strict separation: one team for male profiles, another for female profiles. No cross access |
| The administrator | Logs, moderation accounts, billing data | Two-factor authentication required, every sensitive consultation logged |
| Processors | Only what their service requires | Contract compliant with Article 28, no reuse on their own account |
Our team's access to the content of a conversation is not open-ended. It requires a report, it is limited to the reported thread and its immediate surroundings, it requires a stated reason, it is logged, and both participants are notified afterwards.
TO BE COMPLETED BY THE CLIENT: decide the exact number of messages viewable around the reported message and the notification deadline, then state them here and in the terms of use.
No decision is taken by an algorithm: no automatic fake-profile detection, no automatic content filtering, no compatibility score, no automatic ranking of reports. The stream of profiles you see is the result of the search you declared, with no score and no profiling.
9. Where your data is hosted, and by whom
| Role | Provider | Country |
|---|---|---|
| Application and database hosting | TO BE COMPLETED BY THE CLIENT | TO BE COMPLETED BY THE CLIENT |
| Public website hosting | TO BE COMPLETED BY THE CLIENT | TO BE COMPLETED BY THE CLIENT |
| Storage of photos and voice recordings | TO BE COMPLETED BY THE CLIENT | TO BE COMPLETED BY THE CLIENT |
| SMS verification | TO BE COMPLETED BY THE CLIENT | TO BE COMPLETED BY THE CLIENT |
| Service emails | TO BE COMPLETED BY THE CLIENT | TO BE COMPLETED BY THE CLIENT |
| Mobile push notifications | TO BE COMPLETED BY THE CLIENT | TO BE COMPLETED BY THE CLIENT |
| Automatic summary generation | Mistral AI | European Union |
Two honest clarifications:
- Mobile push notifications necessarily pass through Apple's and Google's services if the application is distributed through their stores. That involves a transfer outside the European Union, governed by Articles 44 to 49. This is why no personal data is placed in the body of a notification: "You have a new request", never a first name, never an excerpt of a message.
- For any transfer outside the Union we rely on an adequacy decision (Article 45) or, failing that, on the European Commission's standard contractual clauses (Article 46(2)(c)). A copy is available on request.
TO BE COMPLETED BY THE CLIENT: complete this table provider by provider, including the actual country of the servers, and keep the record of processors up to date (Article 30).
10. How long we keep it
| Data | Duration | What happens next |
|---|---|---|
| Messages in a closed conversation | 12 months | Deletion |
| Messages in a conversation carried through with the wali | 24 months | Deletion |
| Automatic summary | Life of the conversation | Deleted with it |
| Unreciprocated expressions of interest | 6 months | Deletion |
| Article 9 profile sections | Life of the account | Deleted as soon as deletion is requested, without waiting for the grace period to end |
| Inactive account | 24 months without login | Email warning at 23 months, then deletion or anonymisation |
| Account deleted at your request | 30 days | Permanent deletion at the end of that period |
| Unconfirmed wali invitation | 30 days | Deletion. Immediate upon explicit refusal |
| Reports and moderation decisions | 3 years | Anonymisation |
| Ban log | 3 years | Deletion |
| Audit log — technical elements (IP, session, device) | 12 months | Deletion |
| Audit log — decision and reason | 3 years | Kept without the technical elements |
| Accounting records | 10 years | Statutory retention (Article L123-22 of the French Commercial Code) |
| Proof of consent | Life of the account, then as long as needed to evidence it | TO BE COMPLETED BY THE CLIENT: duration to be set with the DPO |
| Waiting-list email address | Until the service opens or until you ask | Deletion |
What happens to your messages when you leave. Your messages remain visible to the person you were talking to: it is their conversation too. They are therefore kept until the end of the period above, but your name is replaced by "Deleted member", your profile and media are erased, and the archive available to the wali is purged. That is the balance between your right to erasure and the other person's right to keep their own correspondence.
11. Your rights
You have the following rights over data concerning you:
| Right | What it lets you do | Article |
|---|---|---|
| Access | Find out whether we process your data and obtain a copy | 15 |
| Rectification | Correct inaccurate or incomplete information | 16 |
| Erasure | Have your data deleted | 17 |
| Restriction | Freeze a processing operation while a dispute is resolved | 18 |
| Portability | Retrieve your data in a machine-readable format, or have it transmitted | 20 |
| Objection | Object to processing based on legitimate interest | 21 |
| Withdrawal of consent | Withdraw an agreement at any time, as easily as it was given | 7(3) |
| Complaint | Refer the matter to a supervisory authority | 77 |
On exporting your exchanges. The interface deliberately has no "download this conversation" button: it would be a distribution tool. That does not limit your right of access in any way. Exercised formally, it covers all data concerning you: your profile, your consent logs, your conversation metadata, the messages you wrote and those you received, subject to the rights and freedoms of others (Article 15(4)). Delivery is made through a secure channel.
How to exercise them. Write to the address given in section 2. We reply within one month, extendable by two months for complex requests, with notice of the extension (Article 12(3)). We may ask for proof of identity where there is reasonable doubt (Article 12(6)) — never as a matter of routine.
Complaints. If our answer does not satisfy you, you may contact the French supervisory authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr — or the supervisory authority of the country where you live.
TO BE COMPLETED BY THE CLIENT: confirm that the CNIL is the lead supervisory authority, which presumes the controller's main establishment is in France.
12. Security
We apply the following measures (Article 32):
- passwords stored as hashes, never in clear text;
- permissions checked server-side on every request, denying by default: what the interface does not show, the server also refuses;
- strict separation of moderation teams between male and female profiles;
- two-factor authentication required for anyone accessing the back office, automatic logout after twenty minutes of inactivity;
- sensitive sections hidden by default in the back office, revealed only against a stated and logged reason;
- an audit log that cannot be edited or deleted, including by an administrator;
- no real data used in test environments.
In the event of a breach likely to result in a risk to your rights, we notify the supervisory authority within 72 hours (Article 33) and, where the risk is high, we inform you directly (Article 34).
13. Minors
The service is strictly closed to anyone under 18. Date of birth is checked at sign-up. Any profile suspected of being a minor is referred immediately to moderation and the account is closed.
If you know of a minor using the service, report it to the address given in section 2: we treat such reports as a priority.
14. Changes to this policy
This document may change. Any substantial change — a new purpose, a new processor, a new retention period — is notified to you before it takes effect. The applicable version and its date appear at the top of the page. Previous versions are kept and available on request.
End of the privacy policy — version 1.0 of 27 August 2026. In case of divergence between language versions, the French version prevails.