Privacy Policy

Published: 2026-03-15

Last updated: 2026-09-29

1. Data Controller

The controller responsible for processing your personal data is:

We operate the Zawji service (zawji.se) and comply with the EU General Data Protection Regulation (GDPR) and Swedish data protection law (Dataskyddslagen 2018:218).

2. What data do we collect?

We collect the following data at registration:

• Contact details: email address, WhatsApp number
• Personal information: city, country, year of birth, gender, ethnicity, height, marital status
• Religious information: sect, prayer frequency, Islamic practice, scholars you follow
• Descriptions: about you, work/education, life goals, dress style, partner preferences
• Wali information (optional for sisters): name, phone, relation — provided voluntarily, not required at registration

We also collect automatically:

• Technical data: IP address, browser type, device (via our web host Vercel, and PostHog after your consent — anonymised, no cookie tracking)
• Usage data: page views and navigation (anonymised statistics)

3. Legal basis for processing

We process your personal data on the following legal grounds:

• Consent (GDPR art. 6(1)(a)): You give your consent by actively ticking the consent box at registration.
• Contract (GDPR art. 6(1)(b)): Processing necessary to provide the service.
• Legitimate interest (GDPR art. 6(1)(f)): Anonymised analytics to improve the service.

You can withdraw your consent at any time by contacting us at hej@zawji.se or by deleting your account under Profile → Settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. Special categories of data

Religious affiliation and sect, and ethnic origin, are classified as special categories of personal data under GDPR article 9. We process these data on the basis of your explicit consent (article 9(2)(a)). You explicitly consent to this processing by ticking the box at registration. Without this consent we cannot provide the matchmaking service.

5. How do we use your data?

• Create and display your profile to approved members
• Show your profile so other members can send interest requests
• Facilitate contact on mutual interest via moderated messages
• Send notifications and updates by email
• Operate, maintain and improve the service
• Anonymised statistics and analysis (no personal data is shared)

6. Automated decision-making and profiling

To keep the platform safe, Zawji uses automated pre-screening: uploaded photos and messages (introductions and chat) are analysed by an AI service (Anthropic's Claude) that either approves them directly or flags them for manual review by us. Browse is not limited by country; Sweden has the highest member density today.

The order in Browse is also influenced by information you have entered in your profile, including ethnicity: profiles with the same or a related ethnicity as yours may appear slightly higher. This only affects the order – no one is hidden, and you can see and send interest to anyone regardless of ethnicity.

These processes have no legal or similarly significant effects on you within the meaning of GDPR article 22(2) — they do not decide whom you may marry and do not prevent you from contacting anyone; all actual choices are made by you and by the members themselves. If a photo or message is flagged it is reviewed by a human, and you can always request a manual re-review or an explanation by contacting us at hej@zawji.se.

7. Data sharing and international transfers

We never share your data with third parties for marketing. We use the following sub-processors:

• Supabase: Database storage (servers in EU/EEA — Frankfurt, Germany)
• Vercel: Web hosting (servers in EU and US — US transfer under the EU-US Data Privacy Framework)
• Anthropic (Claude): AI pre-screening of photos and messages for safety (US — EU-US Data Privacy Framework)
• Stripe: Payment processing. Card details are provided directly to Stripe and never handled by us (Stripe Payments Europe; US transfer under the EU-US Data Privacy Framework)
• Resend: Email delivery (US — EU-US Data Privacy Framework)
• Sentry: Error diagnostics and uptime monitoring (US — EU-US Data Privacy Framework)
• Microsoft Clarity: Anonymised web analytics (heatmaps) — loaded only after your consent
• PostHog: Anonymised funnel and usage statistics — loaded only after your consent (EU hosting, eu.posthog.com)

Profiles are visible only to approved members inside the system. No personal data is sold or shared with advertisers.

8. Cookies and tracking

Zawji uses no tracking cookies and no third-party cookies. We only use strictly necessary session cookies for login (Supabase Auth) and to remember your language choice. Any analytics (Microsoft Clarity and PostHog) load only after you click "Accept" in the cookie prompt; if you choose "Decline" they never activate.

9. Your rights

Under GDPR you have the right to:

• Access (art. 15): Request a copy of all personal data we hold about you
• Rectification (art. 16): Correct inaccurate data
• Erasure (art. 17): Request that all your data be deleted ("right to be forgotten")
• Restriction (art. 18): Restrict the processing of your data
• Portability (art. 20): Receive your data in a machine-readable format (JSON/CSV)
• Object (art. 21): Object to processing, including profiling
• Withdraw consent: At any time via email or account settings

We respond to all requests within 30 days. Contact hej@zawji.se to exercise your rights.

10. Retention and deletion

We retain your data as follows:

• Profile data: As long as you have an active account. Deleted within 30 days of request.
• Match history: Deleted together with the profile.
• Email logs: Kept for a maximum of 12 months for troubleshooting.
• Anonymised statistics: May be kept indefinitely (contain no personal data).

Inactive accounts (no login for 24 months) receive a reminder before the data is automatically deleted.

11. Security

We protect your data with encrypted connections (TLS/SSL), encrypted database storage, Row Level Security (RLS) in the database, and restricted access to personal data (authorised administrator only). We carry out regular security reviews.

12. Changes to this policy

We may update this privacy policy. For material changes we notify you by email. The latest version is always available on this page.

13. Supervisory authority

If you believe we process your data in breach of GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):

14. Contact

For questions about privacy, GDPR, or to exercise your rights:

Note: The Swedish version of this policy at zawji.se/privacy is the authoritative legal text. This English version is provided for clarity.