Privacy Policy

1. Who We Are

Khidma is a private online guidance platform connecting Muslim users with verified Islamic scholars and Muslim psychologists for one-on-one audio sessions, private questions, and guided reflection.

2. What Data We Collect

Information you provide directly

• Name and contact details (email address, phone number)
• Account credentials (email and password, or Google sign-in)
• Demographic information (age, gender, location/region)
• Information submitted through our intake forms and Nafs Assessment
• Your story, reflections, and answers within the guided path and reflection features
• Journal entries, written or voice-recorded
• Questions submitted through our private Q&A, and your messages with experts
• Audio during one-to-one sessions you book, and the session notes derived from them (see §5)
• Payment and booking history (card details are processed by our payment provider and never stored by us)
• Feedback, support requests, and anything you send us by email or WhatsApp

Information collected automatically

• Device type, operating system, app version, browser type
• General region (from your account details or network; we do not access your device's GPS location)
• Usage information: screens visited, features used, time spent, crash and diagnostic logs
• Device identifiers and push-notification tokens (to deliver notifications you enable)
• Cookie data on the website (see our Cookie Policy)

3. Sensitive Data (Special Category Data)

The nature of Khidma's Services means we handle sensitive personal data:

• Emotional wellbeing and psychological concerns you share with us
• Religious beliefs and practices — faith-related questions and spiritual matters

Under UK GDPR, EU GDPR, India's Digital Personal Data Protection Act 2023, the UAE PDPL, and applicable US law, this data receives the highest level of protection. We process it only to provide the Services you request, and — where the law requires — with your explicit consent, which you may withdraw at any time.

We do not use your sensitive data for marketing, advertising, or profiling. We never sell it.

We recognise that religious guidance, counselling, and spiritual reflections are deeply personal. We never use information shared during sessions, journals, assessments, or private questions for advertising, profiling, or personalisation outside the Services you explicitly request.

4. How We Use Your Data

Under India's DPDP Act 2023, we process your personal data on the basis of your consent and for the legitimate uses permitted by that Act.

5. Audio, Microphone, and Sessions

The app requests microphone access only for features you initiate: live audio sessions with an expert and voice journal entries. We never record in the background.

We do not store recordings of your sessions. During a session, audio is transcribed in real time by our AI service provider solely to create your session notes and summary. The source audio and the full transcription are deleted within 24 hours. What we keep is the session note — a short summary and any agreed next steps — a summary of which is visible to you, and which is shared with your expert. Session notes are retained under §8 and never used for marketing or advertising. You are informed of this before your first session. Sessions are conducted through our in-app audio infrastructure (provided by LiveKit) or, for some web bookings, via Google Meet; the relevant provider processes call audio to deliver the call.

6. Who We Share Your Data With

We do not sell your personal data. We share it only with:

• Scholars and counsellors — only what is necessary to deliver your session or answer your question
• Service providers acting under contract on our behalf: payment processing (Razorpay), in-app audio (LiveKit), video calls for web bookings (Google Meet), AI processing (Anthropic), product analytics and crash reporting (PostHog), transactional messaging (WhatsApp Business platform via WATI), newsletter delivery (MailerLite — only if you subscribe), and cloud hosting
• Advertising measurement (website only): our website uses Meta (Facebook/Instagram) tools to measure the effectiveness of our advertising, which may involve sharing limited, hashed interaction data with Meta. Your use of the mobile app is not shared with Meta, and nothing you share in assessments, sessions, journals, or questions is ever used for advertising. You can control website cookies via our Cookie Policy.
• Legal authorities — where required by law, or where necessary to protect someone from serious harm

7. International Data Transfers

We serve users in India, the UK, the EEA, the UAE, and the USA, and our service providers may process data in other countries. Where data crosses borders we apply appropriate safeguards, including UK GDPR International Data Transfer Agreements / EU Standard Contractual Clauses where required, and transfer only to jurisdictions permitted under India's DPDP Act and the UAE PDPL.

8. How Long We Keep Your Data

• Account data: for as long as your account is active
• Session-related records, including session notes and summaries: maximum 2 years, unless you request earlier deletion
• Session audio and transcriptions: not retained — deleted within 24 hours of your session notes being generated (see §5)
• Journal entries, paths, assessments: until you delete them or your account
• Payment and invoicing records: as required by tax and accounting law
• Anonymised, aggregated statistics (which no longer identify you): may be retained

9. Your Rights

India (DPDP Act 2023): right to access a summary of your personal data and processing; right to correction and erasure; right to grievance redressal; right to nominate a person to exercise your rights in the event of death or incapacity. Complaints may be made to the Data Protection Board of India after first contacting our Grievance Officer (§13).

UK and EEA (UK GDPR / EU GDPR): rights of access, rectification, erasure, restriction, portability, and objection; right to withdraw consent at any time; right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local EEA supervisory authority.

UAE (PDPL 2021): rights to access, correct, and request deletion of your personal data, and to object to certain processing.

USA: depending on your state (including California under CCPA/CPRA), rights to know, access, correct, and delete personal information, and to opt out of "sale" or "sharing" of personal information. We do not sell your personal information. Website advertising measurement may qualify as "sharing" under California law; you can opt out via the cookie controls on our website. You will not be discriminated against for exercising your rights.

To exercise any right, email connect@khidma.live or use our account and data deletion page. We respond within 30 days (or sooner where the law requires).

10. Deleting Your Account

You can delete your account at any time:

• In the app: Account → Delete account
• On the web: khidma.live/account-deletion

Deletion removes your account, assessments, paths, journal entries, questions, and session history, subject to the limited retention in §8 (e.g. invoicing records we must keep by law).

11. Security

Your data is encrypted in transit and stored on encrypted servers. Access is restricted to those who need it to provide the Services. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant authorities as required by law.

12. Children

The Services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us immediately and we will delete it.

13. Grievance Officer (India)

14. Changes to This Policy

We will update the "Last updated" date when this policy changes, and notify you by email or in-app notice for significant changes.

15. Contact

connect@khidma.live · www.khidma.live