Privacy Policy

1. Who we are

The Service is operated by Sowaan Limited, 2 Frederick St, London WC1X 0ND, United Kingdom. For any privacy question or request, contact us at [email protected].

2. Information we collect

Account information. Your phone number (required and verified by a one-time code sent by WhatsApp or SMS), and optionally your email address or an Apple or Google sign-in identifier.

Profile information. Name, date of birth and age, gender, marital status, whether you have children, country and city, education, profession, religious practice and sect, ethnicity, languages, nationality, height, marriage timeline, relocation and living preferences, interests, your "about me" text, your partner preferences and deal breakers, and your answers to the Marriage Compatibility Questionnaire. Some of this (for example religious beliefs and ethnicity) is sensitive personal data; you choose to provide it and we process it with your explicit consent for the purpose of matchmaking.

Photos. Profile photos you upload. We remove location (EXIF/GPS) metadata from every image and create blurred versions for privacy settings.

Verification data. A selfie and short liveness capture (with a head-turn challenge), and for identity verification an image of your official ID document (for example CNIC, Emirates ID, Iqama or passport). From these we derive face data used to confirm that your selfie, photos and ID show the same person and to detect duplicate accounts, and we read the name, date of birth and document number from your ID to confirm your identity and that you are 18 or over.

Messages and activity. Messages you send and receive, interests, matches, reports and blocks, and journey stages you set for a match.

Wali details. If you invite a wali, the name, relationship and phone number or email you give us for them.

Location. Your city, and if you use Nearby, an approximate location rounded to about 1 km. We never show your exact location to anyone.

Contacts (optional). If you use "Avoid contacts", phone numbers from your address book are converted to one-way hashes; we store only the hashes and use them only to hide you from those people and them from you.

Device and usage data. Device identifier, platform, app version, IP address, crash reports and product analytics. Our analytics are self-hosted, contain no names, phone numbers or message content, and are not shared with advertisers.

Payment data. For App Store and Google Play purchases we receive a transaction record from the store (via our provider RevenueCat), never your card details. For website purchases the payment provider you choose (for example JazzCash, Easypaisa, Razorpay, SSLCommerz, Tap Payments, Midtrans, Paymob or Paystack) processes your payment details; we receive the purchase reference, amount, currency and status.

3. How we use your information

• To provide the Service: create your account, show your profile to suitable members according to your settings, recommend compatible profiles and explain why, and deliver messages.
• For trust and safety: verify that members are real, 18 or over and who they say they are; detect fake, duplicate and banned accounts, scams and abuse; moderate photos and content; and review reports.
• For payments: process purchases, provide Nikkup Plus and credits, and handle refunds.
• To communicate with you: verification codes, service messages, safety alerts and notifications you can control in the app.
• To improve the Service: understand, in aggregate, which features help people move toward marriage and fix problems.
• To comply with law and respond to lawful requests.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Automated checks and human review

We use automated tools, some running on our own servers and some provided by Amazon Web Services (Rekognition and Textract), to check photos, selfies and ID documents and to flag risky messages. Clear passes are accepted automatically and clear failures are rejected with an explanation; uncertain cases are always decided by a trained human moderator. If you believe an automated decision about you is wrong, contact us at [email protected] and a person will review it.

5. What other members can see

Other members see your profile according to your privacy settings (Public, Private or Invisible, and photo visibility). They never see your phone number, email, ID document, date of birth (only your age) or exact location. Trust badges (such as "Identity verified") are shown without the underlying documents. A wali you invite can see the conversations you choose to share with them.

6. Service providers

We share data with carefully chosen providers only as needed to run the Service, under contracts that require them to protect it: Amazon Web Services (hosting, storage, encryption keys, face and document analysis); RevenueCat, Apple and Google (in-app purchases); the website payment providers listed above; Tarceel and Twilio (verification codes by WhatsApp and SMS); Mailgun (email); Expo (push notifications); and, if enabled, Sightengine (detection of AI-generated images). We may also disclose data where required by law or to protect the safety of members.

Your data may be processed in countries other than your own. Where required, we use appropriate safeguards for international transfers.

7. How long we keep data

• ID document images are deleted automatically 30 days after the verification decision.
• Selfies and face data are kept while your account is active to prevent duplicate and banned accounts, and deleted when your account is deleted.
• Your account: when you delete it, your profile is hidden immediately and your personal data is permanently deleted after 30 days, including removal of your face from our face-matching collection.
• Payment records are kept for as long as tax and accounting laws require.
• Safety records: if an account is banned for serious violations, we may keep limited information (such as hashed identifiers and face data) to prevent the person from returning, for as long as necessary for that purpose.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict certain processing, and to withdraw consent at any time. You can do most of this in the app: edit your profile, change privacy settings, download your data or delete your account (Profile → Settings). For anything else, email [email protected] from the address or phone number linked to your account. You may also complain to your local data protection authority.

9. Security

We protect data with encryption in transit (HTTPS) and at rest; identity documents are stored in a private, encrypted storage bucket and are accessible only to moderators through links that expire after minutes. We use short-lived access tokens, rate limits, role-based access for staff with an audit log of every admin action, and screenshot protection in the Android app. No system is perfectly secure, but we work hard to protect your information.

10. Age limit

Nikkup is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we delete it. If you believe a minor is using Nikkup, please report it to [email protected].

11. The website and browser storage

The website nikkup.com uses no advertising or third-party tracking cookies and loads no third-party scripts. The Nikkup Plus checkout stores a sign-in session in your browser’s session storage, a random device identifier and your language choice in local storage, only so that the checkout works. Our web server may keep standard access logs (such as IP address and pages requested) for security.

12. Changes and contact

We will update this policy as the Service changes and will tell you about significant changes in the app or by email. Questions: [email protected].