Privacy Policy

Infrastructure

• Railway - Application and database hosting in the US East (Virginia, USA) region, on SOC 2 Type II / ISO 27001 certified infrastructure with point-in-time recovery backups.
• PostgreSQL - Database, with sensitive fields additionally encrypted at the application layer using AES-256-GCM.

Email Services

Transactional emails (account, security, and notification messages) are delivered through:

• SendGrid (Twilio) - Transactional email delivery, under the Twilio Data Processing Addendum.

Where a customer provides their own mail server, transactional emails may instead be routed through that customer-configured SMTP service.

Connected Calendar Integrations (Optional)

FiqhEngine offers optional calendar integrations with Google Calendar and Microsoft Outlook. These integrations are off by default; you enable them per user account from the Calendar widget by clicking "Connect Google" or "Connect Microsoft" and granting consent on the respective provider's OAuth screen.

• Google Calendar API (scope calendar.events) — read your upcoming events to render the in-app schedule view, and write engagement and task due dates as all-day calendar events so deadlines surface in your existing workflow.
• Google People API (scope contacts.readonly) — autocomplete attendee email addresses when you schedule a meeting from within FiqhEngine. Contacts are fetched on demand and not copied to FiqhEngine's database.
• Google OpenID (scope userinfo.email) — display the connected Google account address in the calendar widget so you can see which account is connected.
• Microsoft Graph API (scopes Calendars.ReadWrite, Contacts.Read, offline_access, openid, profile, email) — equivalent functionality against Microsoft 365 / Outlook calendars and contacts.

What we store. Only the OAuth access and refresh tokens (encrypted at rest with AES-256-GCM), the connected account's email address, and a per-event identifier so we can later update or remove events we previously created on your behalf. Event bodies, attendee lists, and contact lists are fetched on demand and not persisted.

Disconnect at any time. Use the Calendar widget's Settings → Disconnect option to revoke FiqhEngine's access and delete the stored tokens immediately. You may also revoke the grant directly with the provider at myaccount.google.com/permissions or account.microsoft.com/privacy/app-access.

Google API Limited Use compliance. FiqhEngine's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we (a) only use Google user data to provide and improve the calendar and contact features described above; (b) do not transfer Google user data to third parties except as necessary to provide those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with your prior notice; (c) do not use Google user data for serving advertisements; (d) do not allow humans to read Google user data unless we have your explicit affirmative consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the data has been aggregated and anonymised; and (e) do not use Google user data to develop, improve, or train generalised or non-personalised AI or machine-learning models.

AI-Assisted Document Processing

FiqhEngine uses Google Gemini (via the Google AI API) to generate Shariah advisory suggestions and to analyse uploaded documents. Where features send content to Gemini, that content is processed to return results to you; FiqhEngine does not use it to train its own models.

• Google Gemini API — advisory suggestion generation and document analysis. Google does not use data submitted through the paid Gemini API to train its models.

Meeting & E-Signature Integrations (Optional)

Depending on the features your organisation enables, we may share the minimum necessary data with the following providers:

• Zoom, Microsoft Teams, and Google Meet — to schedule and host meeting links when you create a meeting from within FiqhEngine.
• Slack — to deliver notifications to your workspace where a customer enables the Slack integration.
• SignWell — to send documents for electronic signature where e-signature is enabled.

What We DON'T Use

• ❌ Advertising networks or data brokers
• ❌ Social media tracking pixels
• ❌ Profiling or automated decision-making services

We do use Google Analytics 4 (with IP anonymisation) on our marketing website only, and solely where you have granted Analytics-cookie consent. It is not used inside the authenticated application. See the Cookie Policy above.

International Data Transfers

Some services are located in the USA. We protect your data through:

• Standard Contractual Clauses (SCCs) approved by EU Commission
• Encryption in transit (TLS 1.2 minimum, TLS 1.3 supported) and at rest (AES-256-GCM)
• Access controls and authentication
• Regular security audits