Privacy Policy

This Privacy Policy explains how Mashwara ("Mashwara", "we", "us") handles personal data when you use our mobile app, our website at mashwaraapp.com, and the services we provide through them (together, the "Service"). It applies to everyone who uses Mashwara — both people who book consultations ("Clients") and the professionals who deliver them ("Experts").

Please read it alongside our Terms & Conditions.

1. Who we are

Mashwara is a consultation platform that connects people with verified experts — including Raqis, dream interpreters, general consultants and medical practitioners — for one-to-one audio and video sessions, guided by Islamic values.

Mashwara is the data controller for the personal data described in this policy. Experts on the platform act as independent controllers for the professional records they keep about their own clients outside the Service.

2. Data we collect

We collect only what the Service needs to work, keep people safe, and meet our legal obligations.

2.1 Data you give us

• Account details — name, email address, phone number, password (stored only as a salted hash), profile photo, preferred language, country.
• Expert profile and verification — if you apply as an Expert: qualifications, certificates, professional registration or licence numbers, a government-issued ID document, a selfie for liveness matching, biography, specialities, availability and rates.
• Booking details — the service you choose, the Expert, the scheduled time, and the reason or notes you add when booking.
• Content you submit — in-app chat messages, dream descriptions, questions and any documents or images you attach for a session.
• Payment details — the amounts you pay, wallet top-ups and balance, refunds, and (for Experts) payout details. Card and bank credentials are collected and stored by our payment processors, never by Mashwara.
• Support and feedback — messages you send to support, ratings, reviews and reports about other users.

2.2 Data we collect automatically

• Device and technical data — device model, operating system version, app version, language, time zone, crash logs and diagnostics, and a device identifier.
• Usage data — screens viewed, features used, searches, session duration and timestamps.
• Call metadata — who joined, when a call started and ended, its duration, and connection quality. We do not record the audio or video of a call unless you and the Expert both consent (see §6).
• Network data — IP address, from which we infer approximate location (country/city level) for fraud prevention and regional pricing. We do not collect precise GPS location.
• Push tokens — so we can send you booking reminders and session notifications.

2.3 Data from third parties

• Sign-in providers — if you sign in with Apple or Google, we receive your name and email (or Apple's private relay address). We never receive your password.
• Payment processors — the outcome of a payment, the last four digits and brand of the card, and fraud signals.
• Verification partners — the result of identity and credential checks we run on Experts.

3. How we use your data

We do not sell your personal data, and we do not use the content of your consultations, dreams or messages to train machine-learning models.

Marketing emails and push notifications about new features or offers are only sent if you opt in, and every one of them carries a one-tap unsubscribe.

4. Legal basis for processing

Where the GDPR, UK GDPR or a comparable law applies to you, we rely on:

• Contract — to create your account, take bookings, run sessions and process payments.
• Consent — for marketing messages, optional analytics, session recording, and any health or religious information you choose to share.
• Legitimate interests — to keep the platform secure, prevent fraud and abuse, and improve the Service, balanced against your rights.
• Legal obligation — to keep tax and transaction records and respond to lawful requests.

Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.

5. Sensitive data

Some consultations naturally touch on health, religious belief or family circumstances. That is special-category data, and we treat it with extra care:

• We process it only on the basis of your explicit consent, given when you book a session and submit your details.
• Access inside Mashwara is restricted to the small number of staff who need it to run support or investigate abuse, and every access is logged.
• Please share only what the Expert needs. Do not send national ID numbers, full payment card numbers or unrelated medical records through in-app chat.

6. Calls, messages and recording

• Audio and video calls are transmitted over encrypted connections and are not recorded by default.
• A session is recorded only when both you and the Expert give explicit in-app consent. When recording is on, it is clearly shown on screen for the whole call.
• If a recording is made, it is stored encrypted, is accessible to you and the Expert, and is deleted 90 days after the session unless it is needed for an open dispute or a legal requirement.
• In-app chat messages tied to a booking are retained so both sides have a record of what was agreed. You can delete individual messages; message metadata may remain in backups until they rotate.
• Recording a session outside the app — for example with a screen recorder — without the other person's consent is prohibited by our Terms & Conditions and may be unlawful where you live.

7. Who we share data with

• The Expert you book — your first name, profile photo, the service you booked, the time, and the notes or questions you submit. Experts are bound by confidentiality obligations under our Terms.
• Clients (if you are an Expert) — your public profile: name, photo, biography, specialities, languages, verification status, rates, ratings and reviews.
• Payment processors — to take payments, hold wallet balances, issue refunds and send payouts.
• Real-time communication providers — to route audio and video calls.
• Cloud hosting, storage and email providers — to run and support the Service.
• Analytics and crash-reporting tools — in a pseudonymised form, to understand usage and fix errors.
• Push notification services — Apple Push Notification service and Firebase Cloud Messaging.
• Identity verification partners — to check Expert documents and credentials.
• Professional advisers, regulators and law enforcement — where we are legally required to disclose, or to establish, exercise or defend legal claims.
• A buyer or successor — if Mashwara is involved in a merger, acquisition or asset sale, with notice to you and this policy continuing to apply.

Every service provider we use is bound by a written contract to process data only on our instructions, keep it secure, and not use it for their own purposes.

8. International transfers

Mashwara operates globally, so your data may be processed in countries other than your own, including where our hosting and communication providers run infrastructure. Where data leaves the EEA, the UK or another region with transfer restrictions, we rely on adequacy decisions or on Standard Contractual Clauses together with appropriate technical safeguards such as encryption in transit and at rest.

9. How long we keep data

Where we no longer need data to identify you but still need the underlying numbers, we aggregate or anonymise it instead of deleting it — anonymised data is no longer personal data.

10. How we protect your data

• TLS encryption for all data in transit; encryption at rest for stored data and backups.
• Passwords stored only as salted hashes — we can never read your password.
• Role-based access control, least-privilege staff access, and audit logging of access to personal data.
• Regular dependency patching, code review and security testing of the app and backend.
• An incident response process: if a breach is likely to put your rights at risk, we notify the relevant supervisory authority within 72 hours and tell you without undue delay.

No system is perfectly secure. Please use a strong, unique password, keep your device locked, and tell us at support@mashwaraapp.com if you suspect your account has been compromised.

11. Your rights

Depending on where you live, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete (most of it is editable in the app).
• Erasure — ask us to delete your account and data (see §12).
• Portability — receive your data in a structured, machine-readable format.
• Restriction and objection — ask us to pause processing, or object to processing based on legitimate interests.
• Withdraw consent — at any time, for anything we do on the basis of consent.
• Opt out of marketing — via the unsubscribe link, or your notification settings in the app.
• Complain — to your local data protection authority. We would appreciate the chance to resolve it first.

To exercise any of these, email support@mashwaraapp.com from the address on your account. We respond within 30 days and will not charge you or treat you differently for asking. We may need to verify your identity before acting on a request.

California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against you for exercising your rights.

12. Deleting your account and data

You can delete your Mashwara account in either of two ways:

1. In the app — Profile → Settings → Delete account.
2. On the web — submit the form at mashwaraapp.com/account-delete-request.

When you delete your account we remove your profile, photo, chat content, saved preferences and push tokens within 30 days, and purge them from backups within a further 90 days. We keep the minimum required by law — principally payment and invoice records for tax purposes, and a record of any unresolved dispute or safety report — which is retained separately and not used to re-identify you.

If you have an upcoming session or an unresolved payment, settle or cancel it before deleting; a deleted account cannot be restored.

13. Children

Mashwara is intended for people aged 18 and over. We do not knowingly collect data from children. A parent or legal guardian may book a session on behalf of a minor using their own account and remains responsible for that booking. If you believe a child has given us personal data, contact support@mashwaraapp.com and we will delete it.

14. Cookies and similar technologies

This website is a static marketing site. It sets no advertising or tracking cookies and does not profile visitors. The mobile app does not use cookies; it uses local device storage to keep you signed in and to cache content, and pseudonymised identifiers for crash reporting and analytics, which you can disable in your device settings.

15. Changes to this policy

We update this policy when the Service or the law changes. The "last updated" date at the top always reflects the current version. If a change materially affects your rights, we will notify you in the app or by email before it takes effect, and where required we will ask for your consent again.

16. Contact us

For anything in this policy — privacy enquiries, data requests, security reports or general support — email support@mashwaraapp.com.

Mashwara, Dhaka, Bangladesh.

We aim to acknowledge every message within 2 business days and to resolve privacy requests within 30 days.