Privacy

This page is written to meet India’s Digital Personal Data Protection Act, 2023. We have tried to say it in plain words rather than legal ones. If anything here is unclear, write to us and we will explain it.

• Mailing list: your email, so we can tell you when MihrabUmmah reaches your city and when signed-in members can contact graduates directly. Nothing more.
• Your account: the name and email address your sign-in provider gives us, so we know the account is yours.
• Graduate profile: the details you choose to publish — name, city, credentials, roles — so people looking for someone like you can find you.
• Contact details: the phone or WhatsApp number you give, so a signed-in person can reach you.
• Certificates: the document you upload, so a reviewer can check your credential is real. See below — this one has the most care around it.

We use each of these only for the reason listed next to it. If we ever want to use something for a new reason, we will ask you first.

A madrasa certificate usually carries your full name, your father’s name, your roll number and your date of birth. That is exactly the set of details someone would need to impersonate you, so we do not publish it — not to employers, and not to anyone browsing the site.

What an employer needs to know is whether your credential was checked, and a label answers that. So we keep the document private and publish the outcome.

• What we store: The certificate file you upload, kept privately. We do not publish it.
• Why we store it: So a reviewer can check that the credential you listed is real. That is the only reason we ask for it.
• Who can see it: You, and the MihrabUmmah reviewer who checks it. Not employers, not other visitors, not search engines.
• What other people see: A label on your credential — “Self-declared”, “Certificate uploaded”, or “Verified by a Reviewer”. Never the document itself.
• How long we keep it: Until you delete it, or until you delete your profile — whichever comes first.
• Changing your mind: You can delete the certificate at any time, from the same place you uploaded it. The credential stays on your profile and goes back to “Self-declared”.

You will be asked to agree to exactly these points before you upload anything, and nothing is uploaded until you do. Uploading is optional — you can list a credential without one. The version of this consent you agreed to is recorded with your upload, so you can always ask us what you agreed to and when. The current version is 2026-09-14.

One thing we will not claim: a document that is on file has not been checked yet, and its label says so. We never describe an unchecked certificate as verified.

We keep your number, your position, the imam’s name, the street and the photos to check this Claim. Only our Reviewers see them. The photos and your number are deleted if the Claim is declined, or when you stop representing the Institution.

You agree to this with one tick before you send a Claim, and the version you agreed to is kept with it. The current version is 2026-11-07.

You need only an account to look. We keep more once you reach out to someone:

• Your details: the pincode you gave (and the city it belongs to), what you are asking for, the institution’s name if you gave one, and that you confirmed you are 18 or older. Only you can read them; the graduate never sees your pincode.
• Your requests: the role you asked about and the short note you wrote. The graduate reads them and can accept or decline. Each stays about a year after it ends, then it is deleted.
• Who you contacted: a log that you opened a chat with a graduate, the same log the graduate can see. It is kept for a year, then deleted.
• Reports you send: kept for a year after we close them.
• Emails: when you send or answer a request, we email the person it concerns through Resend, our email service. It handles the address and the message only to deliver them.
• Counting visits: we count visits, searches, chats started and requests sent with our own Umami, through our own site and with no cookies. It sees the address of each page you open, with what is in it: search words and filters, the campaign a link came from, and the rough area (about 4 km) of a Near me search. It never sees your name, email or phone number. Your IP address is used to tell your country and city, and is not kept.
• Fixing errors: when a page breaks, our own GlitchTip records what failed and on which page, for 30 days, with your IP address cut short (its last part removed). It carries no name, no email, no phone number and nothing you typed.

You can delete your account from Settings. Your details, your requests and your account go at once. The one-year log of who contacted whom stays until its year is over, as above.

A graduate’s phone/WhatsApp is never public and never placed in a web address. It’s revealed only to a signed-in person for the purpose of making contact, and that reveal is logged — so you can see who asked for your number.

We don’t sell your data, we don’t share it with advertisers, and we don’t compile hidden profiles about you. Public profile information is public by the graduate’s own choice.

Data is stored with our infrastructure provider (Supabase) under access rules that keep private fields private. We keep your information while your profile exists. Deleted means hidden for 7 days, then gone for good: after that, the profile, your contact details and any certificates you uploaded are deleted. The log of who asked for your number is kept for a year, then deleted, even if you or they leave.

You can ask us to:

• Show you what we hold about you, and what we have done with it.
• Correct anything wrong or out of date — most of it you can edit yourself.
• Delete your profile or any single certificate.
• Take back your consent for the certificate. It is as easy as giving it — delete the file, and the credential goes back to “Self-declared”.
• Nominate someone to exercise these rights for you if you die or cannot act for yourself.

Write to salaam@mihrabummah.com and we will act on it. If your profile is already published, remember that search engines may hold a copy for a while after we delete ours; we can ask them to drop it, but we cannot force it.

You must be 18 or older. The law requires a parent’s verified permission for anyone younger, and we are not set up to check that properly — so rather than do it badly, we don’t accept profiles from under-18s at all. A young hafiz is welcome to join once they turn 18.

If your data is exposed by a breach, we will tell you and the Data Protection Board.

If you are unhappy with how we have handled your data, write to us first at salaam@mihrabummah.com — that is our grievance contact, and we will reply. If we do not resolve it, you can complain to the Data Protection Board of India.

If we change how we handle your data, we will update this page and, where it affects something you consented to, ask you again rather than assume.

Draft — to be reviewed with a professional and finalised before launch.