Privacy policy

1. Who we are and who is responsible

Ente Mahal (“we”, “us”) is provided by Hexain Technologies, 43/2684/A2, Suite 005, Vaisyam Purath, Kolathara Road, Saravana Match Industries, Cheruvannur, Kozhikode – 673655, Kerala, India. We provide the software and run the servers.

Your masjid (mahal committee) decides what member information it records and why. For that information the masjid is the data fiduciary (controller) and we process it on the masjid’s behalf, under its instructions. For enquiries sent through our website, and for the operation of the platform itself, we are responsible.

2. Information your masjid keeps about members

Member accounts are created by the masjid office, not by self sign-up. Depending on what your masjid uses, it may record:

• Profile: name, member number, phone number, email, address, gender, date of birth and join date.
• Family (household) details: names, relation, gender, date of birth, phone, occupation, education and notes for family members.
• Dues, payments and receipts: fees due, payments made, donations (including Zakat), receipts with their numbers and QR codes, Qurbani shares and tokens, rent where applicable.
• Madrasa records for children and adults enrolled in the masjid’s madrasa: class, attendance, exam marks, timetable and madrasa fees.
• Blood group, and whether a person has chosen to be listed as a blood donor and how they may be contacted.
• Certificates requested and issued (for example membership, nikah or NOC certificates).
• Tickets, complaints, suggestions and maintenance issue reports you send, including any photos you attach. Tickets can be sent anonymously.
• Your participation in polls, and your likes and comments on the community feed.
• Staff records for masjid employees (attendance, salary and payslips), visible only to that employee and authorised staff.

3. Information created when you use the app or website

• Login details: your phone number and a password. Passwords are stored only as a one-way hash; nobody, including us, can read them.
• Security and audit records: sign-ins, failed sign-in attempts and an audit log of actions taken by staff (for example who issued or cancelled a receipt). When a member views a blood donor’s contact details this is logged and rate-limited to prevent misuse.
• Technical data needed to run the service, such as IP address, device and browser type and error logs, kept for security and troubleshooting.
• Website enquiries: name, role, phone, email, masjid name and location, approximate number of families, modules and plan of interest, your message, and the IP address and browser type to prevent spam.

4. Information that stays only on your phone

Some features of the app work entirely on your device and nothing is sent to us:

• My Money (see section 7): your personal income and expense records, including anything read from bank SMS.
• Prayer time and adhan reminders: scheduled as local notifications on your phone. We do not collect a push-notification token or your location for this.
• Your sign-in session is kept in the phone’s secure storage.

5. Who can see member information

• You: members can see their own profile and their own family’s records only.
• Your masjid’s staff, according to their role: the Mosque Admin (full access for that masjid), Madrasa Admin (madrasa records), Account Manager (dues, payments and accounts), Member Creator (adding and editing member records) and Branch Admin (one sub-mosque). Every staff action is recorded in the audit log.
• Other members of your masjid see only what is designed to be shared: community feed posts, poll results the committee publishes, and a masked blood-donor list where only donors who opted in appear and contact details are revealed one at a time (or routed through the masjid office if the donor prefers).
• Ente Mahal platform operator (Super Admin): our authorised staff can access masjid data only to set up the masjid, provide support, run backups, keep the service secure and approve community-feed posts. We do not browse member data for any other purpose.
• Other masjids cannot see your masjid’s data. Each masjid’s data is kept separate and this is tested automatically.
• Anyone holding a receipt or certificate can scan its QR code on our verification page, which confirms it is genuine and shows the details printed on it.

We may disclose information if required by Indian law or a valid order of a court or government authority, and we will tell the masjid where the law allows.

6. Photos, feed and live audio

• Photos posted to the community feed are published by the masjid (and approved by the platform operator) for members of that masjid. Photos you attach to tickets or issue reports are seen only by the masjid staff handling them. You can take a photo with the camera or pick one from your gallery; the app accesses them only when you choose to attach one.
• If you report a post or comment, the report — including the reported content, your reason and note, and your identity as the reporter — is visible to your masjid’s moderators (for posts from Ente Mahal itself, to our platform moderators). Hiding a person’s comments is stored only on your phone.
• Uploaded files are private: they are served only through signed links that expire after a short time, so they cannot be opened by someone who simply guesses an address.
• Live audio: when your masjid broadcasts the Jumu’ah khutbah or a class, the app plays the live stream. Listening does not use your microphone and the app does not record you. The masjid’s broadcaster account uses the microphone only while it is broadcasting.

8. Where your data is stored

Masjid and member data is stored on a dedicated virtual private server that we manage ourselves, rented from a professional hosting provider. Access to the server is restricted to our technical team, and the data is not shared with the hosting provider or any other third party.

9. Security

• All traffic between the app, the website and our servers is encrypted with HTTPS (TLS). The release app refuses unencrypted connections.
• Passwords are stored as one-way hashes; repeated wrong passwords lock the account temporarily.
• Uploaded photos and documents are private and reachable only through short-lived signed links.
• Staff access is role-based and every staff action is written to an audit log. The accounting journal is hash-chained so silent edits are detectable.
• Each masjid’s data is isolated from every other masjid.

No system is perfectly secure. If we become aware of a breach affecting personal data, we will inform the affected masjid and, where required, the Data Protection Board of India and affected users.

10. Backups and retention

• Each masjid’s data is backed up separately, automatically every week and on demand. The newest 8 scheduled backups are kept, so a deleted record disappears from backups within about two months.
• Member and masjid data is kept while the masjid uses the service. If a masjid stops using it, we keep the data for up to 90 days so it can be exported, then delete it, except where the law requires longer retention.
• Financial records (receipts, payments, donations and the accounting journal) may have to be kept by the masjid for as long as Indian tax and accounting rules require (typically up to 8 years). Where a person asks for deletion, such records are anonymised where possible instead of being removed.
• Website enquiries that do not lead to a subscription are deleted within 12 months.
• Server logs used for security are kept for a limited period (normally up to 90 days).

11. Children’s information

The app is meant for adult members of a masjid. Children do not create accounts.

A masjid may record children as family members and as madrasa students (attendance, marks and fees). This information is entered and managed by the masjid, with the knowledge of the parent or guardian, and is visible to the parent’s or guardian’s account and authorised madrasa staff. Parents or guardians can ask the masjid to correct or delete it.

We do not use children’s data for tracking, profiling or advertising.

12. What we do not do

• We do not sell personal data.
• The app contains no third-party advertising SDKs and shows no ads.
• We do not use third-party analytics or tracking tools in the app.
• We do not use member data, or My Money / SMS data, for marketing or profiling.

13. Your rights and choices

You can ask to see, correct, update or delete your personal data, and to withdraw consent where processing is based on consent. Because your masjid manages your record, the quickest route is your masjid office. You can also contact us and we will work with the masjid.

• Correct or update: ask the masjid office, or contact us.
• Delete your account and data: see our account deletion page for how to ask and what is kept.
• My Money: delete in-app at any time (section 7).
• Notifications: turn adhan reminders off in the app, or block notifications in Android settings.

We respond to requests within 30 days.

14. Changes to this policy

If we change this policy we will update the effective date above and, for significant changes, tell masjids and show a notice in the app.

15. Contact and grievances

Email info@hexain.in, call +91 73565 10755 or WhatsApp +91 73565 10755 (Mon–Sat, 9:30 am – 6:00 pm IST). Postal address: 43/2684/A2, Suite 005, Vaisyam Purath, Kolathara Road, Saravana Match Industries, Cheruvannur, Kozhikode – 673655, Kerala, India.

Grievance Officer: Grievance Officer, Hexain Technologies – info@hexain.in, +91 73565 10755. We acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.