Privacy Policy
Islamify – EMAD gUG (haftungsbeschränkt)
This privacy policy applies to islamify.ai, the web chat at chat.islamify.ai, our sign-in service at auth.islamify.ai, the Islamify apps for iOS and Android, your contact with us and our presence on LinkedIn and WhatsApp.
1. Controller
Nawiaskystraße 27
81735 Munich
Germany
Email: datenschutzvertrieb9679@islamify.invalid @islamify.ai
Phone: +49 89+49 89 02536312 — 20070281
For questions about data protection and your rights, please write to datenschutzmailing6223@islamify.invalid @islamify.ai.
2. Summary
- We store your data in Germany. Your account, your chats and your files are kept on our servers in a data centre in Nuremberg.
- AI processing takes place worldwide. Answers are computed by the AI infrastructure of Google Cloud, worldwide, including in the USA. To answer faster, Google may cache parts of requests for up to 24 hours; Google keeps texts that are read aloud for up to 55 days to detect misuse. Google does not use your chats for training.
- No chat without your consent. Your questions touch on your faith. That is why we ask you explicitly beforehand.
- No advertising, no selling. We do not use advertising or analytics services from other providers.
- Delete at any time. You delete chats and your account yourself; what remains afterwards and for how long is set out in section 17.
3. Where your data is kept
We store accounts, chats, projects, files, consents, subscription data and logs on servers that we rent from netcup GmbH (Karlsruhe), in a data centre in Nuremberg. Backups are kept there and also on a backup device of our own in Germany; we keep them for no more than 30 days. In the apps, your history is also kept on your device (section 10.1). Where answers are computed and what Google stores in the process is set out in sections 6 and 7.
4. Account and sign-in
You sign in with an account at Apple, Google, Microsoft or LinkedIn; there is no sign-in with a password of your own. Sign-in is handled by our own sign-in service on our servers. From the provider we receive your name, your email address (with Apple, if you wish, a relay address), an identifier and, where available, your profile picture. We also store your settings, your plan and your confirmation that you are at least 16 years old.
The providers act as independent controllers during sign-in: Apple Distribution International Ltd. (Cork, Ireland), Google Ireland Limited, Microsoft Ireland Operations Limited and LinkedIn Ireland Unlimited Company (all Dublin, Ireland).
Our sign-in service stores the time and IP address of each sign-in; it knows your browser and device only during the sign-in session, for at most 10 hours. When you register and for certain account events, such as a used-up quota, our team receives an internal message with name, email address, sign-in method, language and account identifier (section 12.2).
Legal bases: Art. 6(1)(b) GDPR (contract); for sign-in events and internal messages Art. 6(1)(f) GDPR. Our interest is secure services and quick help.
Retention: account data until your account is deleted (for your access in the sign-in service, see section 17), sign-in events 30 days. You delete your account yourself in the settings of the web chat or the app, or by request via islamify.ai/en/delete-account (section 17).
5. Your consent
Questions to Islamify often allow conclusions about your religious beliefs. Such information is specially protected (Art. 9(1) GDPR). We process it on the basis of your explicit consent (Art. 9(2)(a) GDPR).
How we ask. Before you first use it, the web chat and the apps show a dialog. With a separate tick box that is not pre-selected, you explicitly consent there to us processing and storing your questions, entries and chat histories, including where this reveals your religious beliefs, so that Islamify can answer your questions and keep your history available to you. The dialog points out that your questions are also processed outside the EU, and it refers to this privacy policy. If you have not consented yet, we ask you on your next visit; your previous chats remain.
Before every request to the AI, our server checks whether your consent is in place: for chat, read-aloud, voice input and file uploads, on the web and in the apps. Without consent, Islamify does not answer questions.
Record. We store which version you last agreed to and when, and whether your consent is currently withdrawn, for as long as your account exists.
Withdrawal. You can withdraw at any time, in the settings under "Consents" or by email to datenschutzwerbung4280@islamify.invalid @islamify.ai. After that, no new requests go to the AI. Your previous chats remain stored until you delete them or your account; on request, we delete them for you. Processing up to the withdrawal remains lawful.
For a good answer, the AI usually needs neither your name nor information about other people or about your health. Please leave such details out where you can.
6. Chatting with the AI
6.1 What we process
Your questions and the answers, titles and times of your chats, files and images you upload together with the text extracted from them, and your folders and projects with names, instructions and files.
6.2 How an answer is produced
Our server sends your question, together with the previous course of the chat, where applicable your project's instructions and the content of attached files, to the AI infrastructure of Google Cloud. The answer is computed there; we store it on our servers. So that Islamify can search your files, Google Cloud also converts texts into search data, that is numerical values used to find matching passages. We also store the search data on our servers.
6.3 Recipient and place of computation
The recipient is Google Cloud EMEA Limited, Dublin, Ireland, acting as our processor under a contract pursuant to Art. 28 GDPR. Google decides the place of computation for each request itself. It can take place in any country in which Google or its sub-processors operate data centres, including the USA. How this is safeguarded is set out in section 15.
6.4 Caching at Google
Many requests repeat parts, such as the previous course of a chat. So that these parts do not have to be processed again each time, Google may cache them in encrypted form for up to 24 hours, also on storage media. This makes answers faster and cheaper. The location is not limited to the EU. Google does not use this data for training.
6.5 What we use your chats for
We use your chats to answer your questions and to keep your history available to you. Google does not use them for training, and we do not train AI models ourselves. Our team looks at chats when you rate an answer (section 8), when it is necessary to fix a technical fault, or when you ask us to.
6.6 Legal bases and retention
Legal bases: Art. 6(1)(b) GDPR (provision of the chat) and your explicit consent under Art. 9(2)(a) GDPR (section 5).
Retention: chats and projects remain stored until you delete them or your account. Files, extracted text and search data are kept as long as the chat or project they belong to.
7. Voice input and read-aloud
Both are voluntary. Recording only happens if you have allowed the microphone and started a recording yourself.
Voice input: the recording goes to Google Cloud for conversion into text (section 6.3). We delete it after conversion, at the latest after 7 days.
Read-aloud: the text of the answer goes to an AI service from Google and comes back as an audio file. Here too, Google Cloud EMEA Limited is our processor. Google keeps the text read aloud for up to 55 days, solely to detect misuse. The location is not limited to the EU; Google does not use the text for training. We store the audio file for up to 30 days so that you can play the answer again.
We do not create voice profiles.
Legal bases: as for the chat (section 6.6).
8. Rating answers
You can rate an answer, with a short reason if you like. We store the rating with the rated question and answer. Our team can review rated answers to find errors; it can see which account the rating comes from. A note from the review may appear as feedback in your chat.
Legal bases: Art. 6(1)(f) GDPR, our interest being correct answers; where the question contains information about your faith, your consent under section 5, because the review serves to answer your questions correctly. Retention: until you delete the chat or your account.
9. Sharing chats
In the web chat, you can share a chat via a link. The link shows the chat as it was when you shared it, including images and the text of attached files; later messages only once you update the link in the share dialog. Anyone with an Islamify account who knows the link can read it. Your name and profile picture are transmitted as well. Anyone who opens the link can create their own copy in their account; it remains even if you withdraw the share or delete your chat. Please bear in mind that a shared chat may contain personal questions of faith.
Legal bases: Art. 6(1)(b) GDPR; where the chat contains information about your faith, your explicit consent, which you give by sharing (Art. 9(2)(a) GDPR). Retention: until you withdraw the share or delete the chat.
10. Specifics of the apps
10.1 History on your device
So that you can read and search your chats without an internet connection, the apps store questions, answers, titles and times, as well as the name and size of attachments, on your device, encrypted with a key that is bound to your device. The attachments themselves remain on our server.
The iPhone app also stores the titles of your recent chats, suggested follow-up questions, and the name, email address and role of your account. The app does not encrypt this information separately; it is protected like the other data on your iPhone and can end up in a device backup at Apple. It adds the titles of your chats to your iPhone's search, and the text only if you switch this on in the app. These search entries stay on the device.
The app removes all of this when you sign out and when you delete the app; chats you delete disappear at the next sync. Legal bases: as for the chat (section 6.6); storage on the device is part of the service you use (Section 25(2) no. 2 TDDDG).
10.2 Microphone
The apps only access the microphone if you have allowed it and started voice input (section 7).
10.3 Notifications
The apps can let you know when an answer is ready. For this we receive a device token. The notification contains only a general note and an internal chat identifier, no content; it is delivered via Apple or Google. On the iPhone and from Android 13, your device asks for your permission first. On Android up to version 12, the system does not ask; there, notifications are switched on until you switch them off in your device settings. The Android app registers with Google's notification service as soon as it first starts and may transmit the token to our server.
Legal basis: Art. 6(1)(f) GDPR; our interest is to reliably let you know when an answer is ready. You can switch off notifications at any time in your device settings. Retention: until you sign out or delete your account, at the latest 180 days without a refresh.
11. Subscriptions, purchases and donations
11.1 Payments on the website
You pay for subscriptions and additional Dirhem via Stripe (Stripe Payments Europe, Limited, Dublin, Ireland) or PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). Stripe acts partly on our behalf and partly as an independent controller, for example to prevent fraud; PayPal acts as an independent controller. We receive name, email address and, where applicable, billing address, identifiers for customer, subscription and payment, plan, amounts, times and payment status, where applicable the payment method and the last four digits of a card, but no full card or account numbers.
11.2 Purchases in the apps
Purchases in the apps are made via Apple's App Store or Google Play, under their own responsibility. We receive the product, purchase identifier, times and status, and verify the purchase with Apple or Google.
11.3 Quota and usage
For your quota (Dirhem) we store the time, volume and cost of each request, but no content. We delete these individual records after 90 days. We keep purchases, credits and billed usage, including the daily totals we use to calculate your quota, as accounting records (section 11.6).
11.4 Cancellation via our form
If you cancel via our form, we process your email address, your name, the subscription reference, the requested end date, your message as well as IP address and browser identifier; you receive the confirmation by email. 90 days after completion, we remove name, message, IP address and browser identifier and replace the email address with an unreadable fingerprint. The record that and when you cancelled is kept as a business record for 6 years.
11.5 Donations
We accept donations via Stripe, PayPal or bank transfer. We process name, email address or bank details, amount, date and payment reference, as well as your address if the payment service transmits it or you would like a donation receipt. For bank transfers, our bank acts as an independent controller.
11.6 Legal bases and retention
Legal bases: Art. 6(1)(b) GDPR (contract) and (c) (tax and commercial law obligations); for IP address and browser identifier in the cancellation form Art. 6(1)(f) GDPR, our interest being proof of the cancellation and protection against misuse.
Retention: we keep subscription and payment entries, Dirhem bookings, invoices and donation receipts as accounting records, also after the contract ends and after an account deletion: as a rule 8 years (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code, Section 50 of the German Income Tax Implementing Ordinance), books of account and annual financial statements 10 years.
12. Contact, support and emails
12.1 When you write to us
You can reach us by email, by phone or by a message to our LinkedIn page. We process your name, your contact details, your request and, where necessary, details of your account or subscription. Please only tell us what we need for your request. Personal questions of faith are best asked in the chat.
Legal bases: Art. 6(1)(b) GDPR if it concerns your account or a contract, otherwise (f), our interest being to answer. Retention: as long as necessary for handling and possible follow-up questions; statutory retention periods remain unaffected.
12.2 Services we use for this
Emails to us and our business records are kept at Google. Internal messages (section 4) and copies of emails to our support addresses run via Slack. We send emails to customers, such as confirmations and service notices, via Brevo. All three are our processors (section 15).
13. Applying for sponsored access
You apply for sponsored access by email, with our template if you like. We process your name, your contact details, your description and voluntary supporting documents, which may also contain specially protected information, for example about health. The application arrives at our email service, and our internal messaging service receives a copy (section 12.2). It can be read by the members of our team who handle requests.
Legal bases: Art. 6(1)(b) GDPR (reviewing your application); specially protected information only with your explicit consent under Art. 9(2)(a) GDPR from the consent text of the template. You can withdraw it at any time at datenschutzleads6297@islamify.invalid @islamify.ai; we will then delete your application.
Retention: as long as necessary for the decision and possible follow-up questions. If we grant access, we store in your account that it exists.
14. Website, security and audience measurement
14.1 Delivery via Cloudflare
Our website is delivered by Cloudflare, Inc., San Francisco, USA, as our processor. All connections to islamify.ai, the web chat and the sign-in service run through its worldwide network, including in the USA. Cloudflare briefly decrypts the connection, checks it for attacks and forwards it encrypted to our servers; Cloudflare does not store chat content. The forms for cancellations and donations also run via Cloudflare; for donations, Cloudflare stores a payment identifier. In doing so, Cloudflare processes your IP address and connection data, keeps connection logs and receives technical error reports from your browser.
Legal basis: Art. 6(1)(f) GDPR; our interest is secure and reliable delivery.
14.2 Server logs
Our servers log access with time, requested address, IP address, browser and error messages in order to keep operations secure and fix errors. We delete these logs after 90 days at the latest. Legal basis: Art. 6(1)(f) GDPR; our interest is secure and stable operation.
14.3 Audit log
We log security-relevant events: changes of role or email address, account deletions, withdrawals, plan changes by our team and the opening of rated chats by our team. We store who triggered the event (email address, identifier, IP address of the connection, browser), its type and time, and details of the affected account or chat. Our sign-in service also logs administrative events. We delete these entries after 90 days, even if the account was deleted earlier. Legal basis: Art. 6(1)(f) GDPR; our interest is traceability and detecting misuse.
14.4 Protection against repeated free trials
After an account is deleted, we store a fingerprint (hash value) instead of the email address, from which the address cannot be recovered. As long as it is stored, no new registration with this address is possible; we point this out before deletion. We delete it 180 days after the account deletion. Legal basis: Art. 6(1)(f) GDPR; our interest is protection against misuse of the free trial.
14.5 Audience measurement
On islamify.ai we measure how many people visit which pages, using a tool that we operate ourselves on our servers in Germany. We do not measure in the web chat or in the apps. The address of the page visited, the referring website, and how far and how long you view a page are transmitted. From the information your browser sends anyway, we derive browser, operating system, device type and country. We do not store your IP address; it is only briefly combined with browser information into a count value that changes daily. The measurement does not set cookies.
Legal basis: Art. 6(1)(f) GDPR; our interest is to understand and improve the website.
Objection: at any time via the switch at islamify.ai/en/cookies; the setting applies to the browser concerned.
Retention: as long as we need the figures for evaluation.
14.6 Cookies and local storage
We only set cookies and entries in your browser's storage where they are necessary for operation (Section 25(2) no. 2 TDDDG), no advertising or tracking cookies. Details, including on the apps, are in our cookie policy at islamify.ai/en/cookies.
15. Recipients and transfers to third countries
| Recipient | Task | Role | Third country and safeguard |
|---|---|---|---|
| netcup GmbH, Karlsruhe | servers in Germany | processor | no transfer |
| Google Cloud EMEA Limited, Dublin, Ireland | AI computation, voice input, read-aloud, search data, caching; email and filing | processor | worldwide, including the USA: EU-US Data Privacy Framework and standard contractual clauses |
| Cloudflare, Inc., San Francisco, USA | routing, protection, website, forms | processor | worldwide, including the USA: EU-US Data Privacy Framework and standard contractual clauses |
| Slack Technologies Limited, Dublin, Ireland | internal messaging service | processor | USA: EU-US Data Privacy Framework and standard contractual clauses |
| Brevo GmbH, Berlin | emails to customers | processor | – |
| GitHub, Inc., San Francisco, USA | software development and operations documentation | processor | USA: standard contractual clauses |
| Stripe Payments Europe, Limited, Dublin, Ireland | payments | partly processor, partly independent controller | USA: EU-US Data Privacy Framework |
| PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; our bank | payments, donations | independent controller | according to PayPal's information |
| Apple, Google, Microsoft, LinkedIn | sign-in; for Apple and Google also purchases in the apps and delivery of notifications | independent controller; for notifications processor | USA: EU-US Data Privacy Framework or standard contractual clauses (Apple) |
| LinkedIn and WhatsApp | our presence on social networks | see section 16 | see section 16 |
| other Islamify users | chats you share | – | – |
You can obtain a copy of the standard contractual clauses at datenschutzkatalog5829@islamify.invalid @islamify.ai. We also disclose data to authorities or courts where we are legally obliged to do so.
Safeguards for Google: For the USA, the European Commission's adequacy decision on the EU-US Data Privacy Framework applies, under which Google LLC is certified (Art. 45 GDPR). For other countries, Google has agreed standard contractual clauses with its sub-processors (Art. 46(2)(c) GDPR). Google lists its sub-processors at https://cloud.google.com/terms/subprocessors, https://business.safety.google/subprocessors (read-aloud) and https://workspace.google.com/terms/subprocessors (email).
16. Our presence on social networks
We provide information about Islamify on a company page on LinkedIn and in a WhatsApp channel. The references on our website and in the apps are simple links; data only goes to the provider when you tap them. On the platforms, the operator processes your data under its own terms, including in the USA.
LinkedIn (LinkedIn Ireland Unlimited Company, Dublin, Ireland): We see the profile information of people who follow our page, react or write to us, and receive aggregated page statistics. We are joint controllers with LinkedIn for these statistics (Art. 26 GDPR); LinkedIn has assumed the obligations towards you: https://www.linkedin.com/legal/l/page-joint-controller-addendum.
WhatsApp channel (WhatsApp Ireland Limited, Dublin, Ireland): We send news there. Depending on your settings, we see the profile name and profile picture of followers, reactions and aggregated figures, and your phone number only if it is already saved in our address book. Details: https://www.whatsapp.com/legal/channels-privacy-policy-eea.
Legal basis: Art. 6(1)(f) GDPR; our interest is informing the public. You can object, for example by no longer following us.
17. Retention at a glance
| Data | Retention |
|---|---|
| account, settings, consent records | until your account is deleted |
| chats, projects, files, extracted text, search data, ratings | until you delete the chat, the project or your account |
| shared chats | until you withdraw the share or delete the chat; copies created by other users remain in their accounts |
| history and search entries in the apps | until you sign out or delete the app |
| caching at Google | at most 24 hours |
| texts read aloud, at Google | up to 55 days |
| voice input recordings | until conversion, at the latest 7 days |
| audio files of answers read aloud | up to 30 days |
| sign-in events | 30 days |
| individual usage records, server logs, audit log | at most 90 days |
| device token for notifications | until sign-out, at the latest 180 days without a refresh |
| fingerprint of the email address after account deletion | 180 days |
| cancellation requests | name, message, IP address and browser identifier 90 days after completion; record of the cancellation 6 years |
| subscription and payment entries, Dirhem bookings, invoices, donation receipts | as a rule 8 years, also after an account deletion; books of account and annual financial statements 10 years |
| backups | at most 30 days |
| requests to us, applications for sponsored access, internal messages, delivery data and recipient lists for emails to customers, operations documentation, data at Cloudflare, audience measurement | as long as necessary for the purpose; statutory retention periods remain unaffected |
If you delete your account, we immediately delete your account together with chats, projects, files, ratings, shares, consent records and device tokens. The data disappears from backups after 30 days at the latest. Information with its own period in the table remains until that period ends, above all accounting records, the audit log and the fingerprint. Your access in our sign-in service and your entry in our usage records (section 11.3), each with your email address, are not deleted automatically; we remove them at your request to datenschutzleads8013@islamify.invalid @islamify.ai.
18. Obligation to provide data and automated decisions
For an account we need the information from sign-in, and for the chat also your consent (section 5). There is no legal obligation to provide us with data. We do not make automated decisions within the meaning of Art. 22 GDPR.
19. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can download your profile, settings, chats and files yourself in the web chat settings. You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Please write to datenschutzleads3722@islamify.invalid @islamify.ai. We will reply without undue delay and within one month at the latest.
Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de.
20. Minimum age
Islamify is intended for people aged 16 and over. Before first use, you confirm that you are at least 16 years old. If we learn that an account belongs to a younger person, we delete it.
21. Changes
We update this privacy policy when our services or the legal situation change. The current version is available at islamify.ai/en/privacy. If a change affects your consent, we will ask you again.
EMAD gUG (haftungsbeschränkt), Munich · Version of 28 September 2026