Privacy Policy

What we collect

To create and verify your Humraah profile, we collect:

• Your full name and date of birth (as on your Aadhaar or passport)
• Your WhatsApp mobile number (used as your login ID) and, if you add one, an email address for notifications
• Profile details you provide: city, sect and religious practice, education, profession, family background, height, relocation preference
• Your written self-description and partner preferences
• Your profile photo (stored privately, shown only inside a supervised chat after mutual interest)
• If you upload a biodata document to pre-fill the form: the document itself, for the few seconds it takes to read it
• For international members: a photo of your passport, reviewed by a person on our team
• Your device's push-notification token, so the app can alert you
• A record of your registration-fee payment (amount, date, app-store or Razorpay reference — never card or UPI details)

How we use your data

• To verify your identity — Aadhaar through DigiLocker, or a passport reviewed by our team
• To match your profile against compatible profiles using the algorithm
• To send WhatsApp, push and (if you added an email) email alerts — new introductions, mutual YES, chat messages
• To display your introduction card to compatible families (without your photo)
• To share your full biodata with a matched family after mutual YES
• To exchange contact details (WhatsApp number) when both families choose PROCEED

Third-party services we use DPDPA §7

Humraah uses the following third-party processors to operate the website and the iPhone and Android apps. Each handles only the minimum data required for its specific function.

• SurePass / DigiLocker (UIDAI) — Aadhaar verification. Your Aadhaar consent and OTP go to DigiLocker; we receive back your name, gender and year of birth. The Aadhaar number is never stored by Humraah.
• Gallabox — WhatsApp OTPs and alerts. Delivers one-time passwords and introduction, mutual-interest and chat alerts to your WhatsApp. Nothing beyond delivery status is retained by Gallabox.
• 2Factor — SMS. Fallback one-time passwords by SMS when WhatsApp delivery fails.
• Resend — email. Sends notification emails to members who add an email address.
• Cloudinary — photo storage. Holds profile photos and passport images in a private, access-controlled store. Files are served only through Humraah's own signed links.
• Groq — biodata reading. If you choose to upload a biodata document, it is sent to Groq's AI service once to extract the fields and pre-fill your form. The document is processed and discarded; it is not used to train any model.
• Razorpay — website payments. Handles the ₹499 registration fee paid on humraah.in. Card, UPI and bank details are entered on Razorpay's page, never on ours.
• Apple App Store and Google Play — app payments. In the iPhone and Android apps the registration fee is an in-app purchase billed by Apple or Google. We receive a purchase receipt, not your payment details.
• Apple Push Notification service and Firebase Cloud Messaging — push notifications. Receive your device token so the app can alert you. No profile content is sent to them.
• OLA Maps — address suggestions. Only the address fragment you type is sent, for autocomplete.
• Google Maps Platform — address suggestions. Like OLA Maps, only the address fragment you type is sent, for autocomplete.
• Hostinger — website hosting. Hosts humraah.in.
• Google Analytics, Google Tag Manager, Google Ads, Meta Pixel and Microsoft Clarity — only with your consent. See Cookies & tracking.
• MongoDB Atlas and Render — hosting. Our database and application server, encrypted and access-controlled, on India-region infrastructure.

Analytics and advertising tools run only if you accept them on our cookie banner. We never sell your data, and we never give advertisers your profile, registration answers, photos or documents.

What we never do

• We never sell your data to any third party — not advertisers, not brokers, not anyone
• We never show your photo on your introduction card or to anyone who has not entered a supervised chat with you
• We never share your WhatsApp number with another family until both families mutually choose to PROCEED
• We never show your profile in any public directory or allow it to be searched by other members
• We never use your profile, registration answers or documents for any purpose outside of the Humraah matching service

Data retention

Your data is held as long as your account is active. When you deactivate your account, your profile data is scheduled for deletion within 30 days. Your introduction history (who you were matched with, responses) is anonymised and retained for platform integrity purposes for a period of 12 months.

Payment records are kept for the period required by Indian tax law after your account is deleted, with the link to your profile removed. A biodata document you upload is deleted as soon as it has been read. A passport image is kept while your account is active and deleted with it.

You can delete your account yourself from inside the app (Profile → Settings → Delete Account) or at humraah.in/humraah-delete-account.html — no need to contact us. You may also ask us via WhatsApp or email; such requests are processed within 7 business days.

Security

Your data is stored on secure, encrypted servers. All data transmission uses HTTPS. Aadhaar verification happens through DigiLocker's secure connection to UIDAI — the full number never touches our database. WhatsApp OTP authentication means there are no passwords to compromise.

Access to user data within Humraah is restricted to only the team members who require it to operate the platform. All internal access is logged. Any suspected data breach will be reported to the Data Protection Board of India and affected users within the timeframe required under DPDPA 2023.

Cookies & tracking DPDPA §4

Humraah uses a few essential items the website needs to work. Analytics and advertising tools run only if you agree to them.

Essential (always on)

• Login token — saved in your browser after you sign in so you stay logged in. Removed when you log out.
• Registration draft — if you leave the form part-way, your answers are saved in your browser for up to 7 days so you can continue later. This stays on your device.
• Your preferences — remembers your language and whether you accepted or declined the cookie banner.
• Hosting cookie (hcdn) — set by our hosting provider, Hostinger, to deliver the website securely. Deleted when you close your browser.

Optional (only if you click Accept)

• Google Analytics and Google Tag Manager — count visits and show which pages are useful.
• Google Ads — measure whether our Google ads lead to registrations.
• Meta Pixel (Facebook and Instagram) — measures our Facebook and Instagram ads, and may be used to show Humraah ads to people who have visited our website.
• Microsoft Clarity — heatmaps and session recordings that help us improve page design. Clarity never runs on the registration page, and form fields are hidden from it.

You can also clear cookies and site data in your browser settings at any time. This will log you out.

Children's data DPDPA §9

Humraah is a matrimonial platform intended solely for adults aged 18 and above. We do not knowingly collect, process, or retain personal data from anyone under the age of 18.

Every member must pass identity verification — Aadhaar through DigiLocker, or a passport reviewed by our team — before their profile can be shown to anyone, and the verified date of birth must show the member is an adult (18 for women, 21 for men, as Indian marriage law requires). Under India's DPDPA 2023, Section 9, we do not process children's personal data and do not track or profile children.

If we become aware that a minor has registered on the platform — whether through an identity-document discrepancy, family report, or any other means — we will immediately suspend the account and delete all associated data within 7 business days. To report a suspected minor account, contact us at rishta@humraah.in or WhatsApp.

Your rights under DPDPA

As a data principal under India's Digital Personal Data Protection Act 2023, you have the following rights, all exercisable via Account Settings or by WhatsApp/email:

• Right to access — request a full copy of all personal data we hold about you
• Right to correction — correct inaccurate or incomplete data (edit via My Profile)
• Right to erasure — permanently delete your data by deactivating your account
• Right to grievance redressal — raise concerns with our Grievance Officer (see below)
• Right to nominate — nominate a representative to exercise your rights on your behalf
• Right to withdraw consent — at any time, by deactivating your account or, for optional cookies, using Cookie Settings; withdrawal does not affect lawfulness of prior processing

All rights requests are acknowledged within 24 hours and fulfilled within 30 days as required under DPDPA 2023.

Grievance Officer Legally Required

In compliance with India's Information Technology Act 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, and the Digital Personal Data Protection Act 2023, Humraah has appointed a Grievance Officer to address user concerns regarding personal data.

• Name: Ayyaz (Co-Founder, Humraah)
• Email: rishta@humraah.in
• WhatsApp: +91 77091 44419
• Address: Nashik, Maharashtra, India
• Acknowledgement: Within 24 hours of receipt
• Resolution: Within 30 days of receipt, as required under DPDPA 2023

Users may also escalate unresolved grievances to the Data Protection Board of India, once operational under DPDPA 2023.

Contact

For any privacy-related concern, data access request, deletion request, or DPDPA complaint — contact us via WhatsApp (fastest) or email rishta@humraah.in. We respond within 2 business days.

For formal grievances, please write to the Grievance Officer (see above) who is obligated to respond within the timelines specified under DPDPA 2023.