Amanina — Privacy Policy

01Who we are and what this covers

Amanina ("Amanina", "the service") is a marriage-introductions platform for the Arab diaspora and those woven into it, anywhere in the world, who are serious about marriage. Amanina is operated by Mama Hala Consulting Group ("we", "us", "our"), registered in Ontario, Canada.

This policy applies to the Amanina application and website (amanina.ca), our backend (api.amanina.ca), and all related features and communications — including profile creation, the Marriage Compass, matching and introductions, photo upload, identity verification, in-app chat, family profiles, subscriptions, and the pre-launch waitlist (collectively, the "Services").

It does not cover Mama Hala Consulting Group's separate counselling and consultation business at mamahala.ca, which has its own privacy policy.

Contact for privacy questions and requests: admin@mamahala.ca

02The laws we follow

We design Amanina to meet, at a minimum:

• PIPEDA — the Personal Information Protection and Electronic Documents Act (Canada), our baseline federal privacy law.
• Quebec Law 25 — An Act to modernize legislative provisions as regards the protection of personal information, for residents of Quebec. This includes specific obligations around automated decision-making, cross-border transfers, and confidentiality-by-default, which we describe below.
• CASL — Canada's Anti-Spam Legislation, which governs our marketing communications.

Where these frameworks differ, we aim to follow the approach that best protects your personal information.

03What we collect

We collect only what the service genuinely needs. Nothing is bought from data brokers.

Information you give us:

• Account identity. Your email address is your primary identity. We send a one-time code by email to sign you in; we derive your account identifier from your email.
• Your profile. Display name, date of birth, gender, who you're seeking, faith path (and, if you choose, Muslim sect or Christian denomination), observance level, core values, a short bio, your country/province or U.S. state and city, openness to relocation, marriage timeline, whether you have or want children, education, profession, languages, height, marital history, family origin and heritage, smoking, and the free-text profile sections you write. A personality archetype derived from your answers is stored as part of your profile.
• Marriage Compass. Your core values and your own-words explanations of them, your dealbreakers and dealmakers (free text), observance preferences, communication style, and Arabic-language comfort. Your core values, the words you write about them, and your dealmakers appear on your profile; your dealbreakers, your honest self-reflections, and your observance, communication, and language preferences are never shown to the people you're introduced to.
• Photos. Up to six photos (max 5 MB each). We also compute and store a perceptual hash of each photo (a non-reversible fingerprint) so the same image can't be re-used to create duplicate or impersonating accounts. Your photos stay blurred to others until interest is mutual.
• A live selfie for the real-person check. If you complete the Verified Circle real-person check, you take a one-time live selfie. It is processed to confirm you are a real, live person and then discarded — it is never stored on our servers (see Section 6).
• Family profiles. If you use family features, the family profile information you provide and invitations you send.
• Messages. The content of messages you send through in-app chat, stored so conversations persist.
• Consent records. A timestamped, versioned record of each consent you grant or withdraw, stored with a one-way hashed (never raw) version of your IP address and your browser's user-agent string, as evidence of valid consent.
• Waitlist. If you join the pre-launch waitlist on amanina.ca, your email address.

Information created as you use the service:

• Subscription and billing status. Your tier, platform, subscription identifier, and renewal/expiry dates. We never store your card details (see Section 8).
• Verification and real-person-check results. See Section 6 for exactly what we keep and what we don't.
• Relative-check fingerprints. If you complete government-ID verification, one-way hashes derived from the lineage part of the name on your ID, and any relative link or held pair they produce, used to keep close relatives on your father's side — a sibling, or a parent and child — from being introduced to each other. This check does not store the name from your ID. See Section 5.
• Activity signals. A limited internal log of in-app events (for example, that an introduction was surfaced and a relevance score) used to keep the service working and improving.
• Invite attribution. If you arrive through another member's invite link (`amanina.ca/?i=…`), we store a small, opaque invite code in your browser (a first-party cookie and local storage — no personal information) so that, if you sign up, we can record which member invited you. It is never used for advertising or third-party tracking, never sold or shared, and is removed when your account is deleted.

What we do NOT currently collect in production:

• Phone numbers. Phone-based sign-in is not enabled in production today; we do not collect phone numbers for sign-in unless and until we turn this on and disclose it.

04Why we use your information

We use your information to:

• Create and run your account and let you sign in.
• Build your profile and introduce you to compatible people. This includes the automated processing described in Section 5.
• Keep Amanina safe — screening photos, scanning messages for scams, harassment, and hate, confirming members are real people, preventing duplicate or impersonating accounts, and enforcing our Community Guidelines and Terms.
• Verify identity for members who choose or are asked to verify.
• Process subscriptions and manage billing through our payment processor.
• Send you service messages you need — sign-in codes, verification results, match and message notifications, deletion confirmations, and receipts. These are transactional and not marketing.
• Send you marketing only if you opt in (see Section 10).
• Meet our legal and regulatory obligations and respond to lawful requests.
• Improve the service in aggregate.

We will never sell your personal information, and we never use your private Marriage Compass reflections for marketing, advertising, or analytics.

05Automated processing and how matching works

Because Quebec's Law 25 (s. 12.1) and good practice require us to be honest about automated decisions, we describe this plainly here. (Note: this disclosure is written to be truthful and direct; it is not marketing copy.)

Matching uses automated processing, including a third-party AI provider. To introduce you to compatible people, an automated process reads your profile and Marriage Compass values and produces a compatibility assessment and ranking. This processing uses Anthropic's Claude models (Anthropic is a service provider located in the United States) together with our own scoring rules. We share the profile information needed for this — such as your display name, age (derived from your date of birth), city, bio, faith, and values.

It works for you, and here is exactly where a person is involved — and where one is not.

• You see the reasoning behind every introduction.
• Your private Marriage Compass reflections — your dealbreakers and honest self-reflections — are never shown to the people you are introduced to, and no person at Amanina browses your private answers as part of matching.
• An introduction is a suggestion, not a verdict. Moderation actions involve either you or a human reviewer.
• Some safety decisions are automatic. One of them deserves naming precisely. The relative check described below can conclude on its own that two particular members must never be introduced, and act on that before any person has looked: the pair disappears from each other's introductions and interest lists, and if they had already matched, the match is archived, it leaves both Messages lists, and the chat is closed. When that happens to a match that had already formed, our team is alerted afterwards. It affects only that one pairing — your account, your profile, and your other introductions are unchanged. A pair can also be held apart automatically while a person reviews a weaker overlap, before that person has looked.
• You may ask for a human review of, or an explanation about, any automated assessment that affects you, and you may contest it, by emailing admin@mamahala.ca.

Other automated processing for safety:

• Photo screening. Every photo is screened automatically for nudity before it is stored, using Anthropic's Claude vision models. Photos that fail are rejected.
• Real-person check. If you complete the Verified Circle, your live selfie is checked for authenticity by Anthropic's Claude vision models (see Section 6).
• Message scanning. Messages are scanned automatically for scams, harassment, and hate, using Anthropic's Claude models. A message that is flagged may be escalated to a human moderator for review and action.
• Relative check. When a government-ID verification succeeds, we check whether you and another verified member may be close relatives, and keep the pairs it identifies apart. We describe this in full immediately below.

The relative check, plainly. When a government-ID verification succeeds, our verification provider passes us the name printed on your ID (Section 6), and we use it once to work out whether you and another verified member might be close relatives. An Arab legal name is a lineage chain — your given name, then your father, your grandfather, and so on to the family name — and siblings differ only in the given name, so we drop your given name and keep only the rest. Each remaining name is turned into a one-way hash; the name from your ID is never stored by this check, and the automated comparison is made between hashes, never between names. The comparison itself runs entirely on our own systems: no outside company and no AI model takes part in it, no part of your lineage — hashed or otherwise — is sent anywhere else, and it uses the same hosting and data store described in Section 7. We compare you only against members who have also verified with a government ID and whose family-name hash matches yours.

A marriage service should not be introducing a brother and sister, so one part of this check acts on its own. If three positions in a row match — father, grandfather, and family name — the two of you are near-certainly siblings, or parent and child, and you are permanently kept from being introduced to each other, automatically and with no person involved. Some weaker overlaps are held apart and sent to a member of our team, who is shown which positions in the chain matched — not the names themselves — along with whether you list the same city, the same family country of origin, and how many years apart you were born, and who then decides by opening both members' ordinary profiles, the same profile pages our team can already see. A pair stays held apart while that review is pending.

Paternal cousins share a grandfather and a family name but not a father, and on its own we deliberately do not treat that as a reason to keep two people apart; cousin marriage is legitimate in much of this community. We treat two members who invited the same family elder, or who joined through the same family account, as relatives in the same way — for a shared elder we store a one-way hash of that person's email address, never the address itself. That signal only counts while a very small number of members have named the same person; past that we stop drawing new links from it, though links already drawn stay in place. This check is built to err toward keeping two people apart rather than risk introducing relatives, so it can be wrong in that direction, and it cannot promise to catch every relative pair. The right described above applies here: you can email admin@mamahala.ca to ask for an explanation of, or a human review of, this or any other automated assessment that affects you. It only ever removes an introduction; it never creates one.

So you understand the limit precisely: the matching process is private and is not read by a person — but a message that our safety scanning flags is reviewed by a human moderator.

06Photos, identity verification, and biometrics

Photos. Your uploaded photos are stored as image files with our hosting/storage provider, and remain blurred to others until interest is mutual.

Government-ID verification (optional). Identity verification is handled by a trusted third-party provider, Didit, through its own hosted flow. Your ID document and your verification selfie are uploaded by you directly to the verification provider — these images do not reach Amanina's servers and are not stored by us. From a completed verification, the record of the check itself holds only: the provider's session references and the link to its hosted flow, which provider handled it, the status and decision (for example approved or declined), a decision reason, whether the automated name, date-of-birth, and sex comparisons passed and the reason codes if they did not, an optional face-match confidence score (a number between 0 and 1), where our provider supplies them the document type and two-letter document country, and the times the record was created, last updated, and expires. Some further things are derived from your ID and are kept outside that record, and each is described in this policy: the reason your verification is currently held or was rejected, if it is; your verified nationality, if you turn that badge on (next paragraph); the one-way lineage hashes used by the relative check, together with any relative link or held pair it produces (Section 5); if a member of our team approved your verification by hand, a note of that approval kept on your profile — the name, date of birth, and sex you had already claimed on your own profile (not as read from your document), the date, and a one-way fingerprint of the name and date of birth printed on your ID, so that a later automated re-check cannot silently overturn that person's decision; and, if an automated check could not confirm your ID against your profile, the extracted name, date of birth, and sex held briefly for human review (described next). That fingerprint is a hash rather than readable ID text, but it is not anonymous: the same name and birth date always produce the same value. If an automated check cannot confirm that the name, date of birth, or sex shown on your ID matches your profile, we briefly retain those extracted text fields — the name, date of birth, and sex as printed on the ID (never the images) — so a member of our team can review the match; these are deleted as soon as the review is resolved, and in any case within 60 days. We do not store your ID images, your selfie, your document numbers, or any biometric template.

Verified nationality (optional, member-controlled). If your verified government ID shows your nationality, we read that single field and store it on your profile as a two-letter country code, so it can be shown as a "verified nationality" badge. This is private by default: it is visible to members you are matched with only if you choose to turn the badge on, and you can turn it off at any time. Because it is read from your ID, it is not editable by you — that is what makes it a trustworthy signal — and it is separate from, and does not replace, the heritage or "family origin" you describe about yourself. We do not store any other country, address, or place-of-birth field from your document.

Biometrics, stated plainly (Law 25). Two parts of Amanina involve biometric information, and we treat it as sensitive:

1. The Verified Circle real-person check. Before we introduce you to anyone, we ask you to take a one-time live selfie in the app to confirm you are a real, live person. That selfie is sent to our automated provider (Anthropic, in the United States) to assess authenticity, and is then discarded — it is never stored on Amanina's servers, in any database, or in any log. We keep only the result (passed, pending, or failed) and the date. Because a live selfie is biometric information, we ask for your explicit consent before you take it; if you do not consent, no selfie is submitted, and you may instead use government-ID verification or contact us.
2. Government-ID face-matching. The face-matching that confirms the person in the selfie matches the ID is performed by the verification provider (Didit) inside its hosted flow. On our side we retain only the derived confidence number described above — no facial image and no biometric template is stored by Amanina.

We do not build, store, or share any facial-recognition template, and we do not use your selfie or photos for any purpose other than the checks described here.

07Who helps us run Amanina (sub-processors)

We do not sell, rent, or trade your personal information. We share only what is needed to operate the service, with vendors bound by data-processing agreements. Our service providers are:

We disclose information to law enforcement or government only when compelled by a valid warrant, court order, subpoena, or equivalent legal process.

(If we add, remove, or change a sub-processor in a way that affects your information, we will update this list and, for material changes, notify you as described in Section 17.)

08Payments

Subscriptions are processed by Stripe on behalf of Mama Hala Consulting Group, billed directly in the app — never through the Apple App Store or Google Play. We never store your card details. Card data is entered on Stripe's hosted checkout; we receive and store only a customer reference and your subscription status. Paid plans renew automatically until you cancel. Full billing, cancellation, and refund terms are in our Cancellation & Refunds policy.

09Where your data lives, and cross-border transfers

Amanina's application and photo storage run on infrastructure operated by Vercel in the United States. Our primary structured-data store is operated by Upstash, with its primary region in Canada (ca-central-1); because this is a globally replicated database, copies may also be held in, and served from, other regions for low-latency reads. Additional processing — including the AI processing in Section 5, email delivery, and payments — takes place on United States infrastructure operated by Anthropic, Resend, and Stripe. Identity verification is handled by Didit on its own infrastructure.

This means your personal information is transferred to and processed in the United States. We rely on contractual safeguards (including standard contractual clauses and data-processing terms with our providers) and on encryption in transit. When you create an account, you consent to this transfer, and there is a specific cross-border consent on our consent screen.

Quebec residents (Law 25 s. 17): we are informing you that your personal information may be communicated outside Quebec — specifically to the United States — for the processing described above. We have assessed these transfers and apply the contractual safeguards described here.

10Marketing is your choice (CASL)

Service and safety messages — sign-in codes, verification results, match and message notifications, deletion confirmations, and receipts — are part of providing the service and are sent without a separate marketing consent.

Any marketing messages are sent only with your express opt-in consent, which you give (or decline) separately. You can change your mind at any time: every marketing message includes a clear, one-tap unsubscribe, and we honour unsubscribe requests within 10 business days (a CASL requirement). We do not purchase email lists.

11How long we keep your information

After you request deletion there is a 7-day window before it becomes irreversible (see Section 12).

12Your rights, and how to delete your account

Wherever you live, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete. You can edit most of your information directly in the app.
• Withdraw consent for processing that relies on your consent (this may limit or end your ability to use the service).
• Delete your account and personal information (subject to the limits below).
• Ask for a human review or explanation of any automated assessment that affects you (see Section 5).
• Complain to a privacy regulator (see Section 14).

To exercise a right, email admin@mamahala.ca. We respond to access and correction requests within 30 days, free of charge. We may first verify your identity.

Deleting your account. You can delete your account in the app, or email admin@mamahala.ca with the subject line "Data Deletion Request." When you delete, your account enters a 7-day grace period, then is permanently purged by an automated daily process. This permanently removes your photos (and their fingerprints), profile, draft, Marriage Compass persona, consents, subscription record, family profile, your written Sprint answers, your authored chat messages, your inbox, your sign-in/identity mappings, your relative-check lineage hashes and family-name grouping, and the relative links recorded between you and any other member. We will send you a confirmation receipt.

Honest limits on deletion. A small number of records may persist briefly after a purge for legitimate, limited reasons — for example, internal activity logs (held up to 90 days), moderation reports (held up to about 365 days for abuse-prevention and legal reasons), short-lived verification-session records, payment-provider customer mappings retained for financial and anti-abuse reasons, and any scam/safety flags. These age out on their own retention timers. We are actively narrowing what remains after deletion. If you need confirmation that a specific record has been removed, email admin@mamahala.ca.

Quebec residents (Law 25): Mama Hala Consulting Group's Privacy Officer is Hala Ali. By default, your profile is configured with the highest reasonable level of confidentiality — photos remain blurred until both people show mutual interest. You may file a complaint with us directly; if it is not resolved, you may complain to the Commission d'accès à l'information du Québec.

13Children's privacy

Amanina is strictly 18+. We enforce a minimum age of 18 on the server when you create your profile — not just in the app. We do not knowingly create accounts for, or collect information from, anyone under 18. If we learn that someone under 18 has created an account, we remove it. Child-sexual content has zero tolerance: it is removed, the account is banned, and it is reported to the authorities (NCMEC and Cybertip.ca) with evidence preserved as required by law.

14How to reach us, and how to complain

Privacy questions, requests, and complaints:

If you are not satisfied with our response, you may complain to a regulator:

• Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca | 1-800-282-1376
• Information and Privacy Commissioner of Ontario — ipc.on.ca
• Commission d'accès à l'information du Québec (CAI) — for Quebec residents

We aim to respond to complaints within 30 days.

15Security

We protect your information with: encryption in transit (HTTPS) to all our providers; encryption at rest provided by our hosting and storage platforms; access controls and signed, verified session tokens; one-way hashing of IP addresses in consent records (we never store raw IPs there); rate limiting and abuse prevention; and verification of provider webhooks. No method of transmission or storage is ever 100% secure, but we work to protect your information and to respond quickly if something goes wrong.

16Data breach

If a privacy breach creates a real risk of serious harm to you, we will notify you and the appropriate regulator(s) without unreasonable delay, as required by PIPEDA, Quebec Law 25, and other applicable law, and we will keep records of breaches as the law requires.

17Changes to this policy

We may update this policy as Amanina evolves. The version posted on this page is always the current one, and we update the "Last updated" date and version label above whenever it changes. For material changes, we will make reasonable efforts to tell you in advance — normally at least 30 days before the change takes effect — through one or more channels, such as email, an in-app notice, or a notice on this page.

Because email and notifications do not always reach everyone, notice does not depend only on an email reaching you: the updated policy posted here, with a new "Last updated" date, is itself notice to you, whether or not our message reaches your inbox. Please review this policy from time to time — the current version is always available here at amanina.ca/privacy. Your continued use of Amanina after a change takes effect means you accept the updated policy, whether or not you received or read any individual notice. We do not apply material changes retroactively, and no change reduces a right that has already accrued to you.