Privacy Policy

1. Data we collect

• Account data: email address, name, and sign-in method (Google sign-in or an email verification code). Authentication is handled by Supabase Auth.
• Case-file and profile data: what you enter to get accurate guidance: age, education, work experience, language test scores, destination and pathway, family members included in your application, goals, and deadlines. When you add details about family members, make sure you have their permission (or are their parent or guardian).
• Assessments and tool inputs: the answers you enter into calculators (e.g. CRS / points scores), quizzes, and the pathway recommender, and the results they produce.
• Uploaded documents: files you choose to upload (which may include passports, certificates, or refusal letters). We extract text from them to run checks you request.
• AI chat: your conversations with the assistant, stored so you can return to them and so answers can use your case context.
• Purchase records: which product you bought, for which application, the amount and currency charged, and a payment reference from Whop. We never receive or store your card number; payment details go directly to Whop and its payment processors.
• Usage and device data: pages visited, feature usage, approximate location (country level), browser and device type, and web performance metrics, collected through the analytics tools below. We also record how you first found us (e.g. a referral or campaign link).
• Email events: whether emails we send are delivered, and your email preferences and unsubscribes.

Most features work only if you give them the data they need: an eligibility estimate needs your answers; a document check needs the document. If you prefer not to provide something, that feature simply won't be available, and the free tools that don't need it still are.

2. How we use data

• To run the product: eligibility estimates, checklists, document checks, deadlines, reports, and filled forms are all computed from what you give us.
• To ground AI answers in your case context and in official government sources, with citations and a confidence level.
• To deliver what you bought and keep records of the purchase.
• To send transactional email (e.g. expiry reminders, deadline alerts, purchase confirmations) and, separately and only subject to your email preferences, occasional product email, every message of which carries an unsubscribe link.
• To understand aggregate usage and improve the product. For this we work with aggregated or de-identified statistics (e.g. "how many users completed a checklist"), and we do not attempt to re-identify de-identified data.
• To detect abuse and keep the service secure.

We do not sell your personal data, we do not share it with advertisers or data brokers, and we do not use it for targeted advertising.

3. AI processing

Some features send data to AI model providers to do their job: chat messages (with relevant case context) are sent to our language-model provider to generate the answer; uploaded documents are sent to an OCR provider to extract their text; short text passages are sent to an embedding provider so search can find relevant official guidance. We send what the feature needs and no more. These providers process the data to provide the service to us; they are listed in the table below.

4. Service providers (sub-processors)

5. Other sharing

Beyond the service providers above, we share personal data only:

• At your direction: for example, if you ask us to share your case file with a consultant or adviser you have chosen.
• When the law requires it: with law enforcement or government authorities where we believe in good faith that disclosure is required by law, or necessary to protect someone's safety or to defend our legal rights.
• With professional advisers: such as lawyers or accountants, under confidentiality, in the course of advising us.
• In a business transfer: if Hijraah is acquired, merged, or its assets are sold, your data may transfer to the successor, who must continue to honor this policy or notify you of changes.

6. International transfers

Our infrastructure is hosted primarily in the United States. Wherever you use Hijraah from, your data will be transferred to and stored in the countries where the providers above operate, whose privacy laws may differ from your country's. We choose established providers with published security and data-protection commitments.

7. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Database access is restricted with row-level security so accounts can only read their own records, and administrative access is limited to the operator. No system is perfectly secure; if a breach affects your data, we will notify you.

8. Retention and deletion

• Account and case-file data is kept while your account exists.
• If you ask us to delete your account, we delete your personal data, except records we are required to keep (e.g. purchase and tax records) and minimal logs kept for security.
• You can delete individual uploaded documents and conversations from within the product.

Where a retention decision is not obvious, we weigh the sensitivity of the data, the risk if it were disclosed, whether we still need it for the purpose we collected it, and any legal obligation to keep it. Data in encrypted backups may persist briefly after deletion until those backups rotate; it is not used in the meantime.

9. Your rights

Regardless of where you live, you can ask us to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data (subject to the legal-records exception above);
• export your data: a machine-readable copy of what you have given us;
• restrict or object to a particular processing of your data;
• withdraw consent where processing is based on consent, at any time;
• stop marketing email: via the unsubscribe link in any message or your notification settings.

Send requests to info@hijraah.com from your account email; we respond within 30 days. We may ask you to confirm your identity before acting on a request, and if we decline a request we will tell you why.

10. If you are in the EU, EEA, or UK

If you use Hijraah from the EU, EEA, or UK (for example, while already living in Portugal or Germany), the GDPR or UK GDPR applies, Hijraah is the controller of your personal data, and our legal bases are:

• Performance of a contract: running your account, your case file, and the products you buy;
• Legitimate interests: product analytics, service improvement, and security, in ways that do not override your rights;
• Consent: marketing email, which you can withdraw at any time;
• Legal obligation: purchase and tax records, and responding to lawful requests.

You have all the rights in Section 9, and additionally the right to lodge a complaint with the data protection authority in your country of residence if you are unhappy with our response. We do not make automated decisions about you that produce legal or similarly significant effects. Eligibility scores are calculations you run for your own information, not decisions we apply to you.

11. Cookies

We use cookies and similar storage in three ways:

You can block or clear cookies in your browser; signed-in features require the essential cookies to work. We do not use advertising or cross-site tracking cookies.

12. Age

Hijraah is intended for adults (18+). We do not knowingly collect data from children. Information about children may appear in your case file only as part of your own application's family details, entered by you. If you believe a child has used the service directly, contact us and we will delete the account.

13. Changes

We will update this policy as the product evolves and change the "Last updated" date; material changes will be announced on the site or by email.

14. Contact

Privacy requests and questions: info@hijraah.com

Support (Arabic and English): support@hijraah.com