Privacy Policy

Published: 2026-03-15

Last updated: 2026-03-30

1. Data Controller

The controller responsible for processing your personal data is:

We operate the Zawji service (zawji.se) and comply with the EU General Data Protection Regulation (GDPR) and Swedish data protection law (Dataskyddslagen 2018:218).

2. What data do we collect?

We collect the following data at registration:

• Contact details: email address, WhatsApp number
• Personal information: city, country, year of birth, gender, ethnicity, height, marital status
• Religious information: sect, prayer frequency, Islamic practice, scholars you follow
• Descriptions: about you, work/education, life goals, dress style, partner preferences
• Wali information (optional for sisters): name, phone, relation — provided voluntarily, not required at registration

We also collect automatically:

• Technical data: IP address, browser type, device (via Vercel Analytics — anonymised, no cookie tracking)
• Usage data: page views and navigation (anonymised statistics)

3. Legal basis for processing

We process your personal data on the following legal grounds:

• Consent (GDPR art. 6(1)(a)): You give your consent by actively ticking the consent box at registration.
• Contract (GDPR art. 6(1)(b)): Processing necessary to provide the service.
• Legitimate interest (GDPR art. 6(1)(f)): Anonymised analytics to improve the service.

You can withdraw your consent at any time by contacting us at hej@zawji.se or by deleting your account under Profile → Settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. Special categories of data

Religious affiliation and sect are classified as special categories of personal data under GDPR article 9. We process these data on the basis of your explicit consent (article 9(2)(a)). You explicitly consent to this processing by ticking the box at registration. Without this consent we cannot provide the matchmaking service.

5. How do we use your data?

• Create and display your profile to approved members
• Show your profile so other members can send interest requests
• Facilitate contact on mutual interest via moderated messages
• Send notifications and updates by email
• Operate, maintain and improve the service
• Anonymised statistics and analysis (no personal data is shared)

6. Automated decision-making

Zawji uses no automated decision-making and no profiling under GDPR article 22. All choices are made by the members themselves — you browse profiles and choose whom to send an interest request to. No algorithm decides or limits which profiles you can see.

7. Data sharing and international transfers

We never share your data with third parties for marketing. We use the following sub-processors:

• Supabase: Database storage (servers in EU/EEA — Frankfurt, Germany)
• Vercel: Web hosting and anonymised analytics (servers in EU and US — US transfer under the EU-US Data Privacy Framework)
• Resend: Email delivery (US — EU-US Data Privacy Framework)

Profiles are visible only to approved members inside the system. No personal data is sold or shared with advertisers.

8. Cookies and tracking

Zawji uses no tracking cookies and no third-party cookies. We only use strictly necessary session cookies for login (Supabase Auth). Vercel Analytics collects anonymised visitor statistics without cookies. No cookie banner is required because we do not use tracking cookies.

9. Your rights

Under GDPR you have the right to:

• Access (art. 15): Request a copy of all personal data we hold about you
• Rectification (art. 16): Correct inaccurate data
• Erasure (art. 17): Request that all your data be deleted ("right to be forgotten")
• Restriction (art. 18): Restrict the processing of your data
• Portability (art. 20): Receive your data in a machine-readable format (JSON/CSV)
• Object (art. 21): Object to processing, including profiling
• Withdraw consent: At any time via email or account settings

We respond to all requests within 30 days. Contact hej@zawji.se to exercise your rights.

10. Retention and deletion

We retain your data as follows:

• Profile data: As long as you have an active account. Deleted within 30 days of request.
• Match history: Deleted together with the profile.
• Email logs: Kept for a maximum of 12 months for troubleshooting.
• Anonymised statistics: May be kept indefinitely (contain no personal data).

Inactive accounts (no login for 24 months) receive a reminder before the data is automatically deleted.

11. Security

We protect your data with encrypted connections (TLS/SSL), encrypted database storage, Row Level Security (RLS) in the database, and restricted access to personal data (authorised administrator only). We carry out regular security reviews.

12. Changes to this policy

We may update this privacy policy. For material changes we notify you by email. The latest version is always available on this page.

13. Supervisory authority

If you believe we process your data in breach of GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):

14. Contact

For questions about privacy, GDPR, or to exercise your rights:

Note: The Swedish version of this policy at zawji.se/privacy is the authoritative legal text. This English version is provided for clarity.