Privacy Policy

1. Who We Are

Khidma is a private online guidance platform connecting Muslim users with verified Islamic scholars and Muslim psychologists for one-on-one audio sessions, private questions, and guided reflection.

2. What Data We Collect

Information you provide directly

• Name and contact details (email address, phone number)
• Account credentials (email and password, or Google sign-in)
• Demographic information (age, gender, location/region)
• Information submitted through our intake forms and Nafs Assessment
• Your story, reflections, and answers within the guided path and reflection features
• Journal entries, written or voice-recorded
• Questions submitted through our private Q&A, and your messages with experts
• Audio during one-to-one sessions you book, and, where you consent to transcription, the transcript and session notes derived from it (see §5)
• Safety signals: an automated check reviews what you write in the Nafs Assessment and guided path to identify situations involving crisis, risk of harm, or questions requiring a scholar, so that we can route you to a person rather than generate reflective content. Where such a signal is identified, it is recorded on your journey so that the content you are shown stays appropriate to your situation
• Payment and booking history (card details are processed by our payment provider and never stored by us)
• Feedback, support requests, and anything you send us by email or WhatsApp

Information collected automatically

• Device type, operating system, app version, browser type
• General region (from your account details or network; we do not access your device's GPS location)
• Usage information: screens visited, features used, time spent, crash and diagnostic logs
• Device identifiers and push-notification tokens (to deliver notifications you enable)
• Cookie data on the website (see our Cookie Policy)

3. Sensitive Data (Special Category Data)

The nature of Khidma's Services means we handle sensitive personal data:

• Emotional wellbeing and psychological concerns you share with us
• Religious beliefs and practices — faith-related questions and spiritual matters

Under UK GDPR, EU GDPR, India's Digital Personal Data Protection Act 2023, the UAE PDPL, and applicable US law, this data receives the highest level of protection. We process it only to provide the Services you request, and — where the law requires — with your explicit consent, which you may withdraw at any time.

We do not use your sensitive data for marketing, advertising, or profiling. We never sell it.

We recognise that religious guidance, counselling, and spiritual reflections are deeply personal. We never use information shared during sessions, journals, assessments, or private questions for advertising, profiling, or personalisation outside the Services you explicitly request.

Our processors — including Razorpay, LiveKit, Google Meet, Anthropic, PostHog, WATI (WhatsApp Business), Brevo, MailerLite, and cloud hosting — act under written contracts requiring them to process your data only on our instructions and to protect it to the standards described in this policy. Where harm is caused solely by a processor, or by an expert, acting outside our lawful instructions, responsibility for that harm rests with that processor or expert to the fullest extent permitted by law.

We may share your data with the legal authorities upon official demands or if such sharing of the data is necessitated by the actions of any users that may be illegal or promote self-harm.

4. How We Use Your Data

Under India's DPDP Act 2023, we process your personal data on the basis of your consent and for the legitimate uses permitted by that Act.

5. Audio, Microphone, and Sessions

The app requests microphone access only for features you initiate: live audio sessions with an expert and voice journal entries. We never record in the background.

We do not record or store session audio. At the start of each session you choose, through an in-call prompt, whether that session is transcribed. If you consent, audio is transcribed in real time by our AI service provider solely to create the transcript, your session notes, and a summary; the audio itself is never stored. If you decline, the session is not transcribed and no session notes or summary are produced for it. Transcripts and session notes are retained with your session records under §8, are shared with your expert, are visible to you in summary form, and are never used for marketing or advertising. Sessions are conducted through our in-app audio infrastructure (provided by LiveKit) or, for some web bookings, via Google Meet; the relevant provider processes call audio to deliver the call.

6. Who We Share Your Data With

We do not sell your personal data. We share it only with:

• Scholars and counsellors — only what is necessary to deliver your session or answer your question
• Service providers acting under contract on our behalf: payment processing (Razorpay), in-app audio (LiveKit), video calls for web bookings (Google Meet), AI processing (Anthropic), product analytics and crash reporting (PostHog), transactional messaging (WhatsApp Business platform via WATI), email delivery and customer messaging (Brevo), newsletter delivery (MailerLite — only if you subscribe), and cloud hosting
• Advertising measurement (website only): our website uses Google Ads and Meta (Facebook/Instagram) tools to measure the effectiveness of our advertising, which may involve sharing limited, hashed interaction data with Google and Meta. If you have accepted advertising cookies and you pay for a session or package on our website, we also send Google a hashed (SHA-256) copy of the email address and phone number on your account, so Google can match the booking to an ad click (Google calls this "enhanced conversions"). Google uses it only to measure our ads. Your use of the mobile app is not shared with Google or Meta for advertising, and nothing you share in assessments, sessions, journals, or questions is ever used for advertising. You can control website cookies via our Cookie Policy.
• Legal authorities — where required by law, or where necessary to protect someone from serious harm

7. International Data Transfers

We serve users in India, the UK, the EEA, the UAE, and the USA, and our service providers may process data in other countries. Where data crosses borders we apply appropriate safeguards, including UK GDPR International Data Transfer Agreements / EU Standard Contractual Clauses where required, and transfer only to jurisdictions permitted under India's DPDP Act and the UAE PDPL.

8. How Long We Keep Your Data

• Account data: for as long as your account is active
• Session-related records, including transcripts, session notes and summaries: maximum 2 years, unless you request earlier deletion
• Session audio: never recorded or stored (see §5)
• Journal entries, paths, assessments: until you delete them or your account
• Payment and invoicing records: as required by tax and accounting law
• Anonymised, aggregated statistics (which no longer identify you): may be retained

9. Your Rights

India (DPDP Act 2023): right to access a summary of your personal data and processing; right to correction and erasure; right to grievance redressal; right to nominate a person to exercise your rights in the event of death or incapacity. Complaints may be made to the Data Protection Board of India after first contacting our Grievance Officer (§13).

UK and EEA (UK GDPR / EU GDPR): rights of access, rectification, erasure, restriction, portability, and objection; right to withdraw consent at any time; right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local EEA supervisory authority.

UAE (PDPL 2021): rights to access, correct, and request deletion of your personal data, and to object to certain processing.

USA: depending on your state (including California under CCPA/CPRA), rights to know, access, correct, and delete personal information, and to opt out of "sale" or "sharing" of personal information. We do not sell your personal information. Website advertising measurement may qualify as "sharing" under California law; you can opt out via the cookie controls on our website. You will not be discriminated against for exercising your rights.

To exercise any right, email connect@khidma.live or use our account and data deletion page. We respond within 30 days (or sooner where the law requires).

10. Deleting Your Account

You can delete your account at any time:

• In the app: Account → Delete account
• On the web: khidma.live/account-deletion

Deletion removes your account, assessments, paths, journal entries, questions, and session history, subject to the limited retention in §8 (e.g. invoicing records we must keep by law).

11. Security

Your data is encrypted in transit and stored on encrypted servers. Access is restricted to those who need it to provide the Services. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant authorities as required by law.

12. Children

The Services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us immediately and we will delete it.

13. Grievance Officer (India)

14. Changes to This Policy

We will update the "Last updated" date when this policy changes, and notify you by email or in-app notice for significant changes.

15. Contact

connect@khidma.live · www.khidma.live