Privacy Policy

Last updated: 20 August 2026

Islamify.ai — islamify.ai — EMAD gUG (haftungsbeschränkt)

1. Controller

Responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

---

2. Overview of data processing

We process personal data only to the extent necessary to provide our service or where you have consented to the processing. This privacy policy informs you about the type, scope and purpose of personal data processing when using our website islamify.ai and the associated mobile applications (collectively the "Service").

---

3. Legal bases for processing

We process your data on the following legal bases:

Legal basis	Application
Art. 6 (1) (a) GDPR (consent)	Cookie consent, marketing analyses, newsletter
Art. 6 (1) (b) GDPR (contract performance)	Registration, account management, subscription handling, payment processing, provision of the chat service
Art. 6 (1) (c) GDPR (legal obligation)	Retention of invoice data (German Commercial Code / Tax Code)
Art. 6 (1) (f) GDPR (legitimate interest)	IT security, fraud prevention, service optimisation

---

4. What data we collect

4.1 Registration data

Registration with Islamify.ai is exclusively via external authentication services (single sign-on, SSO). Registration with an email address and a self-chosen password is not provided. We do not store any passwords and do not operate our own password recovery process; if you have lost your access credentials, please contact the SSO provider you have chosen.

The following SSO providers are available:

• Google Sign-In — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy
• Microsoft Entra ID (formerly Azure Active Directory) — Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Privacy policy
• Sign in with Apple — Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Privacy policy
• LinkedIn Sign-In — LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Privacy policy

When you sign in via one of these services, we receive from the respective provider:

• Name (where transmitted by the provider)
• E-mail address
• Profile picture (where transmitted by the provider)
• Unique user ID of the provider

Specifics of "Sign in with Apple": When signing in, you can choose to hide your real e-mail address. In that case Apple generates an anonymous forwarding address on the domain @privaterelay.appleid.com. We then receive neither your real e-mail address nor any way to determine it. Apple forwards messages sent to this relay address to your Apple ID and processes that forwarding as an independent controller. You can disable the relay address at any time in your Apple ID settings; e-mail delivery to your user account will then no longer be possible.

Legal basis: Art. 6 (1) (b) GDPR (performance of pre-contractual measures and contract performance — authentication via an SSO provider is a mandatory part of service provision).

4.2 Usage data

When using the Service we automatically collect:

• IP address
• Device type, operating system, browser version
• Date and time of access
• Pages and functions accessed
• Referrer URL

How we handle the IP address: For security-relevant events on your account — in particular sign-ins and failed sign-in attempts — we store the full IP address so that we can detect and trace unauthorised access; details and retention periods are set out in section 4.7. For reach measurement, by contrast, the IP address is not stored but converted into a non-reversible daily hash before storage (section 6.6).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in IT security and service optimisation)

4.3 Chat data

When using the AI chat we process:

• The messages you enter (questions/prompts)
• The AI-generated answers
• Timestamps of the interaction
• Uploaded documents and images — they remain stored for as long as the chat they belong to exists (see below)

Legal basis: Art. 6 (1) (b) GDPR (contract performance)

Retention: You can set the retention period of your chat history yourself in the account settings. After the period you have chosen has expired, the chat history is automatically and irreversibly deleted.

Uploaded files: A file remains stored for as long as the chat you uploaded it in exists. When that chat is deleted — by you or when its retention period ends — the file and the searchable text copy derived from it are deleted as well. For as long as the chat exists, the file remains.

4.3a Possible processing of special categories of personal data

Due to the Islamic subject focus of our Service, it is possible that you voluntarily enter sensitive information falling under Art. 9 GDPR (e.g. religious beliefs, health information).

We expressly recommend that you do not enter any sensitive personal data in chat messages.

Insofar as such data are entered voluntarily, processing is based on Art. 9 (2) (a) GDPR (explicit consent through voluntary entry).

The following do not occur:

• no profiling
• no classification by religious affiliation
• no automated decision-making with legal effect

4.4 Payment data

When concluding a paid subscription and when purchasing Extra-Dirhem on a one-off basis, the following are collected via the payment service provider selected in each case (Stripe or PayPal):

• Payment method (e.g. credit card, SEPA direct debit or PayPal; for SEPA direct debit, IBAN and SEPA mandate data; for PayPal, the transaction and subscription identifiers transmitted by PayPal)
• Billing address
• Transaction data

Note: Full credit card and account numbers are not stored by us, but exclusively processed by the respective payment service provider. We do not receive your PayPal login credentials.

Note on PayPal: In the period from 22 July 2026 to 29 July 2026, PayPal was not available as a payment method; since 30 July 2026 we use PayPal as a payment service provider again. Irrespective of this, data from PayPal transactions completed before 22 July 2026 continues to be processed by us exclusively to fulfil statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with Sec. 147 of the German Fiscal Code (AO) and Sec. 257 of the German Commercial Code (HGB); retention periods: accounting records 8 years, commercial books and annual financial statements 10 years).

Legal basis: Art. 6 (1) (b) GDPR (contract performance); additionally Art. 6 (1) (c) GDPR (legal obligation) for the retention of completed payment transactions
Retention: invoices and accounting records 8 years; commercial books, inventories and annual financial statements 10 years (Sec. 147(1),(3) AO; Sec. 257(1),(4) HGB; Sec. 14b UStG). Each period starts at the end of the calendar year in which the document was created.

4.5 Communication data

When you contact us (e-mail, support form) we process:

• Name
• E-mail address
• Content of your message

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in handling enquiries)

4.6 Applications for sponsored access

If you apply for sponsored access via the e-mail template provided by us (Muḥsin sponsorship programme), we process the information voluntarily provided by you for the purpose of reviewing your application:

• First and last name
• Phone number and reply e-mail address
• Description of your current life situation
• Optional supporting documents (e.g. student certificate, unemployment / social-benefit / retirement notice)

Such supporting documents may contain special categories of personal data under Art. 9 GDPR (e.g. references to health or social situation). Processing is based exclusively on your explicit consent under Art. 6 (1) (a) and Art. 9 (2) (a) GDPR, which you grant by leaving the data-protection consent contained in the e-mail template intact. Without this consent, we may not review your enquiry and will delete the e-mail without delay.

Retention period: The e-mail and all attachments are deleted from active systems no later than 30 days after the application is concluded. Provider-side backups (Microsoft 365 / mail host) are overwritten in the regular rotation cycle; we do not deliberately access them.

Recipients: Data are not shared with third parties.

Withdrawal: You can withdraw your consent at any time informally — a short e-mail to datenschutz@islamify.ai is enough. Your data will then be deleted immediately. The lawfulness of processing carried out before the withdrawal remains unaffected.

Note: There is no legal entitlement to sponsored access.

4.7 Audit log of security-relevant events

We keep an audit log of security-relevant events on your account. Recorded are sign-ins and failed sign-in attempts, password and role changes, and account deletions. For each entry we store:

• your email address in plain text and your account identifier
• the type of event and, where needed, a short description
• IP address and browser or device identifier
• timestamp

Important in case of account deletion: These entries are not deleted along with the account. Your email address remains readable there until the retention period expires.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in IT security, abuse detection and traceability of account changes)

Retention period: 90 days; entries are then deleted automatically, once a day. The sign-in events logged separately by our authentication service (auth.islamify.ai) are deleted automatically after 30 days.

4.8 Protection against repeated trial periods (email fingerprint)

When a user account is deleted, we do not store the email address in plain text; to prevent abuse we store a technically protected fingerprint (hash value) instead. It serves exclusively to prevent repeated free trial periods with the same email address.

The address cannot be recovered from the fingerprint alone.

So that no false impression arises: This does not mean your address is unknown to us after the deletion. It remains readable in plain text in the audit log (section 4.7) for another 90 days and — if a paid subscription existed — in the invoicing records for the statutory retention periods. Within those periods we can still reach you through it. Only afterwards does the fingerprint remain as the sole record, and nothing can be recovered from it.

For as long as the fingerprint is stored, no new registration with the same email address is possible — on none of the registration paths offered, and regardless of which sign-in provider is used. Users are informed about the block and its duration before deleting their account.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in preventing repeated use of free trial periods)

Retention period: 180 days from the account deletion; after that the fingerprint is deleted automatically and registering again with the same address is possible.

4.9 Device identifier for push notifications (mobile apps only)

If you allow notifications in our mobile apps, your operating system generates a device identifier: on iOS a token of the Apple Push Notification service, on Android a registration identifier from Firebase Cloud Messaging. The app transmits this identifier to our server so that we can tell you when an answer you requested is ready while the app was closed.

We store the following for this purpose:

• the device identifier
• the platform (iOS or Android) and the delivery environment
• the time of storage and of the last update
• the link to your user account

The device identifier says nothing about you or your content. It is issued by Apple or Google, rotated by them at any time, and cannot be used without the corresponding app.

Purpose: to inform you that a requested answer is available.

Legal basis: Art. 6(1)(a) GDPR (consent). You give it via your operating system's prompt; without that permission no identifier is collected.

Withdrawal: at any time in your device's system settings. Withdrawal takes effect for the future; processing carried out until then remains lawful.

Deletion: We delete the device identifier as soon as you sign out in the app, delete your account, or Apple or Google informs us that the device no longer accepts notifications. The last case is detected and carried out automatically. Independently of this, an identifier is removed once it has not been refreshed for 180 days — the app does so on every launch.

What such a notification contains: only a fixed, general note that an answer is ready, plus an internal identifier so the app can open the right chat. The content of your question or of the answer is not transmitted — neither text nor title nor excerpts. The app fetches it from our server only after it has been opened.

On Android the notification may, at your request, show the beginning of the answer. That version is created on your device itself; the text does not leave our systems and in particular is not transmitted to Google. On the lock screen only the general note ever appears.

The web application at chat.islamify.ai is not affected. No push notifications are sent there and no device identifiers are collected.

---

5. Anonymised quality assurance of the AI

5.1 Purpose

To ensure and improve the quality of our AI-generated answers, we store chat interactions in a separate, anonymised quality-assurance database.

5.2 Anonymisation

The data stored in the quality-assurance database contain the question asked and the AI-generated answer. The data contain no link to the user account, no user ID, no IP address and no other identifying features.

5.3 Residual risk for self-entered data

It is possible that users voluntarily enter personal data in their questions. We therefore recommend not entering any personal data in chat messages.

5.4 Market research

The anonymised data are additionally used for market research regarding Islamic topical interests in order to better tailor our offering to user needs.

5.5 No model training

The anonymised data are not used for training or fine-tuning AI models.

5.6 Legal basis

Since the data are anonymised and no longer contain any personal reference, this processing falls outside the scope of the GDPR (cf. Recital 26 GDPR).

---

6. Third parties and data processors

6.1 Hosting

The application is operated on infrastructure controlled by us in Germany. The current hosting location is netcup; Cloudflare may be placed in front for DNS, TLS, CDN and security functions.

6.2 AI processing (chat answers, speech recognition, speech output)

For processing your input, generating AI answers, speech recognition (speech-to-text) and speech output (text-to-speech) we use two data processors:

• Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland — platform Vertex AI. Processed there: generation of the chat answers, speech output (text-to-speech) and the preparation of uploaded documents for the knowledge search.
• OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland — service OpenAI API. Processed there exclusively: speech recognition (speech-to-text), i.e. input you dictate as well as uploaded audio and video files.
• Storage location of your content (data at rest): European Union. Your chat histories, uploaded files and the answers generated from them are stored on our own infrastructure in the EU (section 6.1).
• Processing location: The models we use are provided through a global infrastructure; processing may therefore also take place outside the EU, in particular in the USA. The protective measures applicable to this are described in section 7.

The AI models used via Vertex AI run entirely within that platform; your inputs are not passed on to the respective model developers. Which specific model handles a request is decided by our routing based on technical criteria (input type, language, load) and remains internal.

No use for model training: Under the contractual terms of both providers, your inputs and outputs are not used to train or improve AI models.

Legal basis: Art. 6 (1) (b) GDPR (contract performance). For inputs falling under Art. 9 GDPR (see section 4.3a), additionally Art. 9 (2) (a) GDPR (explicit consent through voluntary entry).

6.3 Vector database (knowledge search / RAG)

The vector database used for searching text runs on our own infrastructure in Germany (pgvector inside our Postgres database). No external provider is involved for this.

With every chat request, the question is converted into a numerical vector and matched against stored texts. If you upload a file, its text is also split into such vectors and stored there so that the AI can search it — see section 4.3.

6.4 Authentication

Sign-in takes place via direct integration of the SSO providers listed in section 4.1 using the standardised OpenID Connect procedure. No intermediate identity service is used. All sign-in sessions are managed exclusively on our own infrastructure in Germany.

6.5 Payment processing

• Provider: Stripe Payments Europe, Ltd., Dublin 2, Ireland
• Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg — selectable as a payment method; not available in the period from 22 July 2026 to 29 July 2026; for the processing of data from PayPal transactions completed before 22 July 2026, see section 4.4

6.6 Reach measurement (Plausible Analytics)

For reach measurement and to improve our offering we use Plausible Analytics — self-hosted on our own infrastructure in the EU. The measurement data is not transmitted to any third-party provider.

• Cookieless: Plausible sets no cookies and does not create cross-device profiles.
• No IP storage: The IP address is not stored; it is only processed briefly for anonymous counting.
• Covered domains: islamify.ai and chat.islamify.ai.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in reach measurement and improving the offering).

Objection: You can deactivate reach measurement at any time via the opt-out switch at islamify.ai/cookies. The setting is stored as plausible_ignore in your browser's local storage (localStorage) and applies per browser and device.

Google Analytics or Meta Analytics will only be activated after implementation and exclusively after your explicit consent via a cookie consent banner.

6.7 Delivery of push notifications (mobile apps only)

To deliver notifications to mobile devices we use the delivery services of the respective platform operators. Without them a notification to a closed device is technically impossible; neither platform offers a way around this.

iOS — Apple Push Notification service

• Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland; for the global infrastructure Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
• Purpose: delivery of the notification to your device
• Legal basis: Art. 6(1)(a) GDPR (consent)

Android — Firebase Cloud Messaging

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for the global infrastructure Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Purpose: delivery of the notification to your device
• Legal basis: Art. 6(1)(a) GDPR (consent)
• Scope: We use the messaging service only. Firebase analytics functions are explicitly switched off; no Firebase analytics service is included in our apps.

What is transmitted: only a fixed, general note that an answer is ready, plus an internal identifier for the chat concerned. The content of your question or of the answer is not transmitted. For details see section 4.9.

A transfer to the USA cannot be ruled out with these services; the protective measures in section 7.2 apply accordingly.

---

7. Data transfers to third countries

7.1 Principle

Your content (chat inputs, uploaded documents, voice recordings and the AI answers generated from them) is stored within the European Union. Hosting and knowledge search take place entirely in the EU. To generate the AI answers, processing may – depending on the model used – also take place on our processor's global infrastructure outside the EU, in particular in the USA. The protective measures applicable to this are described in section 7.2.

7.2 Remaining transfers and protective measures

A data transfer to the USA may occur in the following cases:

• AI processing of chat content (section 6.2): Generation of the AI answers may, depending on the model used, take place on Vertex AI's global infrastructure outside the EU – in particular in the USA. The operator of Vertex AI (Google LLC) is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the EU standard contractual clauses of the data processing agreement apply (Art. 46 (2) (c) GDPR). Any use of your inputs and outputs to train AI models is contractually excluded.
• Speech recognition (section 6.2): Dictated input and uploaded audio and video files are processed by OpenAI; processing may take place in the USA. The contracting party in the EEA is OpenAI Ireland Limited; the transfer is safeguarded by the EU standard contractual clauses of the data processing agreement (Art. 46 (2) (c) GDPR). Any use of your content to develop or improve the services is contractually excluded.
• Authentication via SSO (section 4.1): Google, Microsoft and LinkedIn are certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Apple relies on EU standard contractual clauses (Art. 46 (2) (c) GDPR).
• Payment processing (section 6.5): Depending on the payment method and support/operations case, Stripe and PayPal may involve third-country transfers; the respective payment provider's data-protection terms apply. The same applies to data from PayPal payments completed before 22 July 2026 that continues to be retained to fulfil statutory retention obligations.
• Operational metadata for cloud providers: When using Google Cloud, administrative metadata (e.g. billing data, support requests) may be processed at affiliated companies in the USA. These transfers are safeguarded by EU standard contractual clauses under Art. 46 (2) (c) GDPR.

In addition, we apply technical and organisational protective measures such as transport encryption (TLS), encryption at rest and data minimisation.

You may request a copy of the safeguards in place (in particular the Standard Contractual Clauses) from us at datenschutz@islamify.ai (Art. 13(1)(f) GDPR).

---

8. Retention periods

Data type	Retention period
Registration data	Until deletion of the user account
Chat history (personal)	Configurable by the user in settings
Anonymised chat data (QA)	Unlimited (no personal reference)
Invoices and accounting records (incl. payment data)	8 years (Sec. 147(1) no. 4, (3) AO; Sec. 257(1) no. 4, (4) HGB; Sec. 14b UStG)
Commercial books, inventories, annual financial statements	10 years (Sec. 147(1) no. 1, (3) AO; Sec. 257(1) no. 1, (4) HGB)
Usage data (server logs)	90 days
Audit log (sign-ins, account changes, deletions)	90 days
Sign-in events of the authentication service (auth.islamify.ai)	30 days
Email fingerprint after account deletion	180 days from the account deletion, then deleted automatically
Communication data	3 years after the enquiry has been concluded
Device identifier for push notifications	Until withdrawal, sign-out in the app, account deletion, until the platform operator reports the device as invalid — at the latest after 180 days without refresh

After deletion of the user account, all personal data are deleted within 30 days, unless statutory retention obligations conflict. Two records are additionally exempt and are based on our legitimate interest: the audit log under section 4.7 (90 days) and the email fingerprint under section 4.8 (180 days). Both are deleted automatically once the stated period has expired.

---

9. Your rights as a data subject

You have the following rights under the GDPR:

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR)

Right to lodge a complaint with the supervisory authority (Art. 77 GDPR):
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany

To exercise your rights: datenschutz@islamify.ai

---

10. Cookies

10.1 Strictly necessary cookies

We use technically necessary cookies for the operation of the Service (session cookies, authentication cookies). These are set without your consent.

10.2 Analytics and marketing cookies (planned)

Will only be set after implementation and after your explicit consent via our cookie consent banner. Our reach measurement with Plausible Analytics (section 6.6) works without cookies and does not set any analytics cookies.

---

11. Newsletter

When subscribing to the newsletter we process the e-mail address and the time of subscription (double opt-in). You can withdraw your consent at any time.

---

12. Protection of minors

Our Service is aimed at persons who have completed their 16th year of age. We do not knowingly collect data from persons under the age of 16.

---

13. Changes to this privacy policy

We reserve the right to adapt this privacy policy as required. The current version is always available at islamify.ai. In the case of material changes we will inform you.

---

Last updated: 20 August 2026
EMAD gUG (haftungsbeschränkt), Munich