Mithaq platform privacy policy
Last reviewed: 28-10-2026
Effective date: 28-10-2026.
1. Introduction and scope
This policy explains how personal data is collected, used, retained, disclosed and protected when using Mithaq and its services, the rights available to data subjects and how to exercise them.
Mithaq is a platform for organising marriage matchmaking services. It enables matchmakers to manage their stores, clients and services, and enables clients to manage their profiles and interact within the service's scope and established permissions.
The policy covers data about visitors, clients, matchmakers, their representatives and people whose data is added by a matchmaker or user, including guardian or contact-person data when supplied. It also applies to data retained after the relationship ends, to the extent necessary for legitimate retention purposes.
This policy is interpreted in accordance with the Saudi Personal Data Protection Law and its regulations, including the Regulation on Personal Data Transfer Outside the Kingdom, and other laws applicable to each processing activity.
Reading this policy or accepting the terms of use is not blanket consent to all processing and does not replace separate or explicit consent where the processing requires it.
2. Operator identity and the parties' responsibilities
Mithaq's operator: Diqqat Al-Tawsiyat Information Technology Establishment (مؤسسة دقة التوصيات لتقنية المعلومات).
Correspondence channels: email at info@mithaq-zawaj.com, WhatsApp through the contact link published on the website, or support tickets within the platform.
Email for privacy requests: info@mithaq-zawaj.com.
The operator is the controller for processing whose purposes and means it determines, including managing platform accounts, operating and protecting the platform, managing subscriptions, and handling support and rights requests.
A matchmaker may act as an independent controller when determining the purposes for collecting and using client data to provide services. Where Mithaq only processes particular data on a matchmaker's documented instructions and behalf, that processing is governed by an agreement setting out responsibilities and safeguards. The applicable role is explained when data is collected or a person joins the service.
Matchmakers must protect client data, verify that its collection, use and disclosure are lawful, and not misuse permissions to access data unrelated to the service or use it for personal or unauthorised purposes.
These arrangements do not remove Mithaq's obligations for processing it controls. Data subjects may contact us to identify the party responsible for their request; they are not referred to a matchmaker instead of fulfilling obligations concerning Mithaq's processing.
3. Data we collect
We collect data necessary for the service or request the user chooses. Listing a category below does not mean we collect every item from every user. Forms explain mandatory and optional fields and the consequences of not providing required data.
A. Account, contact and verification data
Name, mobile number, account identifier, user role, verification status, sign-in and account-recovery data and related correspondence, and an email address if supplied. Verification data is used to confirm the contact method and protect the account through the available process.
B. Client profile data
Data supplied by a client or lawfully on their behalf, such as age, gender, residence, nationality, marital status, education, employment, height, weight and personal biography, and information they choose to supply in connection with seeking marriage.
C. Partner preferences
Search criteria specified by the user, such as age, residence, nationality, education, employment, marital status and other available options. These are treated as search preferences and are not automatically attributed to the account holder as personal characteristics.
D. Data that may be sensitive
Information revealing religious beliefs or racial or ethnic origin, health data if collected, and any other information within the statutory definition of sensitive data. It may appear in specific fields, free text or correspondence.
Processing is restricted according to its purpose and legal basis. We do not request details beyond the service's needs.
E. Guardian or contact-person data
For example, name, mobile number, capacity or relationship, to the extent necessary for a particular stage of matchmaking. This data belongs to another person and is treated accordingly.
F. Matchmaker professional data
Professional name, biography, logo, cover image, professional contact details, services, prices and durations, professional account links, verification status, and information necessary to manage the store and subscription and verify eligibility to provide the service.
G. Interaction and service data
Likes, blocks, engagement requests, approvals and their statuses; message content, parties, timing and delivery or read status where available; notifications, complaints and support requests.
H. Invoice and payment data
Invoice numbers, services, amounts, discounts, payment status, method and reference, and data in proof-of-payment documents supplied where needed. Unnecessary information in those documents must be redacted.
I. Technical and operational data
Session, sign-in and visit data, device or browser type, visit source and technical interactions necessary to operate and protect the service. This may include the internet connection address and an estimate of the connection country when used for that purpose.
A country estimate derived from a connection is not a precise location and does not establish nationality.
J. Consent and request records
Privacy choices, consents and withdrawals, the time and method of the action and the associated notice version, rights requests and the steps needed to process them.
4. Data sources and clients added by matchmakers
We obtain data from the individual through registration, profile updates, service use and support contact; from technical interaction with the platform; or from a matchmaker or authorised representative within a lawful scope.
When such services are used, we may receive verification status or a payment result from the relevant provider.
If a matchmaker enters data about someone who has not created their own account, the matchmaker must have a lawful basis to collect and supply it and explain the purpose of adding it and the scope of its use.
Having someone's phone number, a previous relationship with them or a Mithaq subscription does not automatically authorise publishing their profile or sharing their data.
When we obtain data from someone other than the data subject, we provide the required information about processing, sources and data categories without undue delay and within a maximum of thirty days, unless a statutory exception applies. We do not wait for that period to expire before obtaining consent necessary for processing that relies on it.
If data about you was added without your knowledge or is inaccurate, contact us to verify it and address correction, suspension of display or destruction as appropriate, without having to purchase a service.
5. Processing purposes and legal bases
We identify a clear purpose and suitable legal basis for each activity. The following list is not a general authorisation:
A. Creating an account and operating the requested service
Data necessary to create an account, provide the service and manage requests, correspondence and invoices is processed to perform an agreement to which the data subject is a party, within that agreement's scope and the applicable legal basis. Consent is obtained where it is the necessary basis for particular processing.
B. Displaying client profiles and enabling contact
Publication of an eligible profile in the public client directory is a mandatory part of the service, disclosed before client registration and profile completion. Once the profile is complete and the account is connected to an active matchmaker, it is visible to internet visitors within the fields specified in section 7. There is no separate option to hide a profile while it remains eligible for publication. This requirement does not remove the need for a lawful processing basis or data subjects’ rights, including requirements specific to sensitive data.
Public display does not authorise disclosure of mobile numbers or guardian data, or bypass permissions governing private data.
C. Sensitive data
We rely on explicit, documented consent where consent is the processing basis. Any reliance on another legal basis is determined for the particular processing and explained to the data subject.
We do not rely on legitimate interests to process sensitive data.
D. Protecting the service and preventing misuse
We may process non-sensitive data to detect fraud or unauthorised access and protect networks and information on the basis of a legitimate interest, after assessing and documenting it and balancing it against data subjects' rights and reasonable expectations.
Sensitive content requires another appropriate basis.
E. Legal obligations
We process and retain what is necessary to fulfil an applicable legal obligation or respond to a competent authority's request within its powers, identifying the scope of the requested data.
F. Optional analytics and marketing
Where available, we request consent separate from operating the account or providing the core matchmaking service and provide a way to withdraw it.
G. Support and complaints
We use data necessary to understand, resolve and follow up a request according to the agreement or an appropriate legal basis. Opening a support ticket does not authorise unrestricted access to the rest of the account's data.
Before using data for a new purpose, we explain the processing to the data subject and meet its legal requirements, including consent where required.
6. Consent and privacy choices
When requesting consent, we explain the purpose, data and processing scope, separate purposes requiring independent consent, and retain evidence of consent, when it was given and how.
Depending on the service, choices include consent to disclose specified contact data, share a profile with a cooperating matchmaker, process sensitive data, and use optional marketing or analytics.
Consent for sensitive data is explicit where relied upon.
Consent can be withdrawn through the available account option or by a request to the privacy email. We do not make withdrawal harder than giving consent.
We stop processing based on withdrawn consent without undue delay and explain the effect on the function that requires the data.
Withdrawal does not affect the lawfulness of processing based on consent before withdrawal, or stop processing supported by an independent legal basis that remains valid.
We do not make a service conditional on consent to unrelated processing, such as optional marketing.
7. Who may access the data?
A. The data subject
Data subjects can view their data and profile choices within the service or request access to them, with other people's data protected when a copy is supplied.
B. The matchmaker connected to the service
A matchmaker connected to the client's service receives what is necessary to manage it, such as profile data, requests, correspondence they are authorised to follow and related invoices, according to the purpose, consents and established permissions.
This does not entitle the matchmaker to use data outside the agreed service scope.
C. Cooperating matchmakers
Membership in a cooperation network does not itself grant access to all client profiles. The intended sharing, data, recipient categories and purpose are explained, and necessary sharing consent is obtained before access is provided.
When the scope of sharing changes, we explain the change and meet its requirements.
D. Other clients
Display is limited to permitted fields within the search or engagement scope. Knowing a profile identifier or obtaining its link does not reveal the real name, phone number or guardian data.
Disclosure of contact data follows a specific process, appropriate basis and consent where necessary.
E. Mithaq administration
Access is restricted by duties and need, such as support, verification, investigating a report, addressing a fault or handling a lawful request.
Administrative status does not permit access for personal or unrelated purposes.
F. The public and search engines
A matchmaker's professional page intended for publication differs from a client profile. Professional data designated for publication is displayed in the public store.
Eligible profiles appear in the public client directory with the Mithaq number, age, gender, information about the client and the partner they seek. Public fields include residence country, nationality, origin, height, weight, marital status, education, occupation, religious observance, prayer commitment, financial and health status, general appearance, complexion, hijab where applicable, tribal background, openness to polygamy, partner preferences and names of linked active matchmakers. The legal name, mobile number, guardian details and date of birth itself are not displayed; only age is shown. Directory pages are accessible to internet visitors and may be accessed by search engines; we cannot guarantee the absence of copies retained by parties outside the platform.
Purpose limitations and data minimisation apply to these disclosures. Recipients must not republish, sell or circulate data outside the authorised purpose. Screenshots and exports are not a means of bypassing these limits.
8. Guardian data and data about others
Anyone adding guardian or contact-person data must have lawful authority to supply it and limit it to the service's needs. Notice requirements for that person and consent requirements, where needed, are fulfilled.
Guardian data is used to organise the relevant contact or engagement stage, not for marketing, and is not disclosed to all users. Its disclosure scope is explained when moving to a stage requiring it.
Having a guardian in marriage procedures does not establish that a client lacks legal capacity or remove a legally capable client's right to manage their data and exercise their rights.
A client's consent to processing their own data is not automatic consent on a guardian's behalf to processing that guardian's data.
9. Correspondence, matching and automated processing
We retain correspondence and request data to the extent necessary to provide the service and track its status.
An authorised matchmaker may view conversations within their declared role, and administration may access them for the reasons described in this policy. The matchmaker's role in following a conversation must be clear to participants.
Search, filtering and matching functions use profile and preference data that may lawfully be processed to display suitable results. Results do not guarantee compatibility or the accuracy of all information and do not make marriage decisions for users.
Before introducing a decision based entirely on automated processing that affects a user, we provide notice explaining its purpose, the data involved, its effects and how to contact us about it, and meet the legal-basis and explicit-consent requirements where applicable.
Review of a result or account-related action may be requested through support.
Consent to matching or messaging is not consent to use content to train AI models. Any proposed use of that kind requires a separate explanation and an appropriate legal basis before it begins.
10. Identity verification and payment
We use mobile numbers and available verification methods to protect accounts and carry out sign-in and recovery.
When an external channel is used, such as text messages or a communication channel the user selects, only the minimum necessary to fulfil the request is shared with it. The official verification process explains how the code is used and who receives it. We do not ask users to send their account password.
Sign-in or recovery codes must not be shared outside the designated official process.
We do not request a photograph or uploaded copy of an official identity document merely as a precaution. Requests are limited to cases permitted by applicable law, with the purpose explained, the document protected and its destruction arranged when the lawful need ends.
Invoices for matchmakers' Mithaq subscriptions differ from invoices for services matchmakers provide to clients. Each process identifies the service provider, the recipient of transaction data and the appropriate payment recipient.
When an electronic payment gateway is available, we explain the provider, the relevant privacy-policy link, what is sent to it and what data returns to Mithaq or the matchmaker.
A payment provider may process data for purposes it determines under its own obligations. Its role is explained according to the integration used.
This policy does not provide general permission to collect card data or credit history. Any actual collection, its purpose and safeguards are specified in the payment-process notice before collection.
11. Service providers and disclosure to other parties
Depending on the actual services, we use providers of hosting, technical infrastructure, verification, messaging, support and payment processing.
Their access is limited to data necessary for their tasks. Processor obligations are set contractually, including confidentiality, security, deletion, assistance with rights and subprocessors.
We do not sell or rent personal data. We do not share client data with advertisers merely to generate revenue from profiles or activity.
Disclosure to a regulator, judicial body or competent authority may take place where legally supported, with the request documented and data limited to what is necessary.
Additional disclosure is assessed according to its purpose and basis, not justified by a general phrase such as “business partners”.
If the service operator changes, any data transfer is assessed separately and notice, protection and appropriate legal-basis requirements are observed. A change of ownership is not unrestricted permission to change data-use purposes.
12. Processing locations and transfers outside Saudi Arabia
The following distinguishes verified configurations from providers’ general disclosures. A hosting region does not locate all support, logs or content delivery:
- Application hosting: Vercel. The deployed application’s function execution region is Frankfurt, Germany (fra1). Content delivery, support and provider operations may involve processing outside that region under Vercel’s disclosures.
- Database, authentication and storage: the Supabase project is in Frankfurt, Germany (eu-central-1). Its data residency documentation places the database, Auth, Storage objects and backups in the selected region, with additional processing elsewhere for support, operational information and content delivery depending on the service. We do not claim that all data remains in Germany.
- Verification and messaging: platform configuration includes Mora for messaging and Bird for WhatsApp verification. Bird uses an EU endpoint; that alone does not establish storage countries or every subprocessor applicable to the account. Bird’s list describes different locations by product and customer configuration, including US processing for WhatsApp. Mora’s policy permits transfers outside Saudi Arabia where needed and does not identify a Mithaq-specific country list. We have not verified a complete account-specific list for these two providers and do not claim processing is confined to Saudi Arabia or Europe.
- Email and support: public mail routing for the domain points to Hostinger. We have not verified the info mailbox’s plan or individual location. Hostinger Email documentation lists France and Germany for that email service; this is a service-level disclosure, not proof of our particular mailbox’s location. Privacy requests are also received through platform tickets and WhatsApp via the website link; the WhatsApp channel is also subject to processing by its provider.
- Payments: Moyasar is used for paid matchmaker subscriptions to Mithaq. Moyasar’s cross-border transfer notice states that personal data is stored and processed in Saudi Arabia. This disclosure applies to Moyasar, not Mithaq’s other providers. Payments for services that matchmakers provide to clients are separate from Mithaq subscription collection.
Incomplete verification of an individual provider account’s locations does not guarantee that data stays in a particular country or remove statutory transfer requirements. Available additional information may be requested through the privacy email, and these disclosures are updated when new information is documented.
Assessment of international transfers includes storage, processing, disclosure and access made available to parties outside Saudi Arabia, not only the location of the primary database.
If a service requires data to be transferred outside Saudi Arabia, this occurs only for the purpose and under the applicable legal controls, to the minimum extent necessary, after verifying the level of protection or appropriate safeguards and conducting a risk assessment where required.
Safeguards may include approved standard contractual clauses where their conditions apply.
Data subjects can request information about transfers and safeguards affecting their data through the privacy email, subject to protection of confidential information and others' rights.
Use of the service is not a waiver of statutory transfer requirements.
13. Cookies, analytics and marketing
Session technologies and necessary cookies are used to sign in, retain necessary choices and operate security protections. Disabling them in the browser may disrupt functions that rely on them.
Optional analytics or tracking technologies that depend on consent are not activated before consent is obtained. When activated, their purpose, provider, data and retention duration or determining criteria are explained.
They can be refused without disabling the core service, with the ability to change or withdraw the choice.
We distinguish necessary operational messages, such as verification codes and notifications about an existing request or invoice, from marketing messages.
For direct marketing, we obtain separate consent, provide easy, free opt-out and stop without undue delay after withdrawal.
We do not use sensitive data for marketing or target advertising based on users' religious, health or racial information.
14. Data retention and destruction
We do not retain data merely because it might be useful later. We review the continuing need and destroy it when its purpose ends and no legal retention requirement applies, or retain information anonymised so that individuals cannot be reidentified.
Retention periods are determined by category and purpose. A specific period is disclosed where it can be determined in advance. Otherwise, the following criteria apply:
A. Accounts, profiles and preferences
For the duration of the service that requires them. The operational need ends when the service is terminated, destruction is requested or the basis ceases, with records requiring retention on a separate basis kept separately.
Keeping an account's status as “deleted” is not data destruction.
B. Messages, engagement requests and support
For the duration of follow-up on a request or conversation connected to an ongoing service and the handling of associated complaints. Retention after the need ends requires a specific basis.
For a pending case, retention is limited to relevant data until the grounds for retention end.
C. Invoices and accounting records
For the period required by the law applicable to the particular financial record, starting from the date specified by that law.
Invoice retention does not automatically extend to the entire marriage profile or all correspondence.
D. Verification data and recovery codes
A code or link is valid only within its defined window. Expiry is distinguished from retention of a limited security record proving a verification attempt. Data beyond that record's needs is destroyed.
E. Security, sign-in and visit logs
The period is limited to what is necessary to detect and investigate incidents according to a documented assessment, with review and minimisation of retained fields.
Logs no longer needed are destroyed. Records linked to an ongoing incident are separated from general analytics.
F. Consent and rights-request records
Retained during the processing whose lawfulness they establish and for the period necessary to fulfil a specific legal requirement concerning proof or the relevant case, with data limited to what is necessary for evidence.
G. Verification documents
Destroyed when the purpose permitting their collection ends, unless a law requires retention for a specified period.
Destruction covers copies in our systems and backups according to legal requirements, with steps to prevent destroyed data from returning to use during restoration.
We require processors and recipients to destroy data whose processing basis has ended according to their responsibilities, subject to any independent obligation to retain specified data.
If a destruction request cannot be fulfilled wholly or partly because of a legal requirement, we explain, to the extent permitted, which data is retained, why and the criteria for ending retention, and restrict its use to that purpose.
15. Publication eligibility, account closure and data destruction
Publication eligibility and rights requests: there is no separate option to hide a profile that meets the mandatory publication conditions. Requests for correction, destruction and withdrawal of consent for processing based on it remain available under the law. We review and explain the effect on the service and publication eligibility; the publication requirement does not waive these rights. Ending display when eligibility ceases does not itself destroy service or invoice data.
Ending a relationship with a matchmaker: ends service-related permissions according to its status, identifying any limited access still necessary for an existing request or invoice and supported by a valid basis. Moving a client to another matchmaker does not automatically grant the new matchmaker access to all prior records.
Closing an account: ends the ability to use it. Associated data is reviewed for destruction or restricted retention on an independent basis.
Requesting data destruction: requests an end to retention and processing of the relevant data under the law. It may cover the account or particular categories.
We consider others' rights without using them as a general justification for retaining all data.
16. Data subjects' rights and how to exercise them
Under applicable law and rules, data subjects may:
- Know the controller's identity, processing purposes and bases, data and recipient categories, and retention periods or criteria.
- Access their data and request a clear, readable copy in a commonly used electronic format, or a printed copy where possible.
- Request correction, completion or updating of data, and restriction of processing while accuracy is checked in cases provided by law.
- Request destruction of their data in accordance with the law.
- Withdraw consent where processing relies on it and stop direct marketing through the designated option.
- Complain to the competent authority and seek compensation before the competent court for harm resulting from a violation under the law.
Requests may be made through available account options or sent to info@mithaq-zawaj.com, describing the request and providing a means of identifying the account. People without accounts may use the same method for requests about their data. Do not send a password or verification code.
We verify the requester's identity appropriately and proportionately, requesting only the minimum necessary information. We verify a representative's authority when a request is made for someone else.
We fulfil rights requests without delay and within no more than thirty days. An extension of no more than thirty additional days is possible if fulfilment requires unexpected or unusual additional effort or the data subject submits multiple requests, provided they are informed in advance of the extension and its reasons.
If a statutory restriction or exception applies, we explain its effect and reason to the extent permitted and fulfil the parts that can be fulfilled.
We protect other people's data when supplying copies and do not condition exercising rights on purchasing a subscription or paying matchmaking service fees.
A complaint may be submitted to the Saudi Data and Artificial Intelligence Authority (SDAIA) through the complaints service on the National Data Governance Platform.
Statutory periods and procedures apply, including submission within ninety days of the incident or becoming aware of it, with the competent authority empowered to accept a later complaint for factual reasons under the regulations.
Exhausting support communications is not required before complaining to the competent authority.
17. Eligibility
The legal-capacity requirement and registration age in Mithaq's approved terms apply. Having a guardian in marriage data does not permit creation of an account for someone who does not meet the terms of use.
Where processing data about a person with limited or no legal capacity is permitted by law, appropriate guardianship, verification and consent requirements are met before processing, taking account of the person's right to exercise their own rights upon attaining full legal capacity.
If unlawful collection is discovered, we restrict or destroy the data as appropriate.
18. Data security and incident handling
We take organisational, administrative and technical measures proportionate to the data and processing risks. These include access controls based on role and need, protection of communications and accounts, review of sensitive procedures, management of staff and provider permissions, and incident response.
This policy is not an absolute guarantee that no incident will occur.
When a breach is discovered, we contain it, investigate and mitigate harm, and notify the competent authority within the statutory period when reporting conditions are met.
We notify affected data subjects without undue delay where the incident requires notification, explaining risks, appropriate actions and recommendations.
Users must keep sign-in details confidential and report unauthorised access, disclosure or circulation of data outside the permitted purpose.
19. Policy updates
We review the policy when services, processing or legal requirements change and state the published version's effective date.
We notify users of material changes appropriately, provide information about new processing before it begins and obtain new consent where required.
Amendments are not used to confer retrospective consent or remove statutory rights.
If we provide a service-specific notice, it defines processing within its scope; it does not create an exception to the law or remove a consent requirement.
20. Contact
Operator: Diqqat Al-Tawsiyat Information Technology Establishment (مؤسسة دقة التوصيات لتقنية المعلومات).
Email for privacy and rights requests: info@mithaq-zawaj.com.
Correspondence is received by email at info@mithaq-zawaj.com, WhatsApp through the contact link published on the website, or support tickets within the platform.
Platform management receives privacy and data-rights requests at info@mithaq-zawaj.com.
Website: www.mithaq-zawaj.com.
