Privacy Policy

Who processes your data

eNUUR is operated by Sifat Sahabat Sdn Bhd (1504066-V), referred to as "we" in this policy. We are the data user for your personal data under the PDPA. For any question, request or complaint about your data, contact us at sifatsahabatsdnbhd@gmail.com.

The data we collect

We collect the data that the features you use need:

• Account: your name, e-mail address, password (stored as a hash, not as the text itself), the date your e-mail address was verified, your phone number if you give it, and whether you wish to receive news and offers.
• Sign-in sessions: for each device that signs in, the IP address and the browser type at sign-in, and when the session began and ends.
• Prayer place: your JAKIM prayer zone, or the city you chose outside Malaysia. Your location is not kept (see "Location for prayer times").
• Worship records: the daily practices you choose and tick in Mutaba'ah, the Al-Mathurat sessions you mark as finished, where you last read the Quran, your ayah bookmarks, and Rekod Bacaan: the number of ayat read each day, the pages read each day with the time each was read, and the start and target dates of your khatam plan.
• Favourites: the doa you save.
• Azan notifications: for each device on which you turn notifications on (at most five devices), the notification subscription address and keys your browser gives; the prayers you chose to be notified of and your in-app azan choice. Notifications show the prayer's name and time and your zone or city on the device's screen, including the lock screen.
• eNUUR Pro purchases: the amount and period paid, the Billplz bill reference, the payment's status and time, and your Pro period. We do not receive or keep your card or banking details.
• Affiliate and referrals: if you join the affiliate program, your affiliate code, the members who signed up through your link, the number of clicks on your link each day (without the visitors' IP address or browser details), your commissions, and the payout details you give (bank name, account holder's name and account number). If you sign up through an affiliate link, we record the affiliate who referred you.
• VIP list: if the operator lists your e-mail address or phone number for VIP access, the match of that list with your account and, for a phone number match, the claim staff review.
• Tanya AI: the number of questions you ask each day. The questions and the answers are not kept.
• E-mail: a log of the e-mails we send you (the recipient's address, the subject and the delivery status), not their content.
• Security and administration records: rate-limit records (to stop excessive sign-in and sign-up attempts), an audit log of staff actions on accounts (for example a VIP or Pro grant, or an account turned off), and the server's technical logs, which record errors.

Why we use the data

• To create and manage your account, verify your e-mail address, let you sign in safely and reset your password.
• To show prayer times, the qibla direction and azan notifications for your place.
• To keep your worship, reading, bookmark and favourite records so that you can see them again. These records are for you alone: no eNUUR admin screen shows them.
• To decide your access to Basic, Pro or VIP features, process Pro payments, and send reminders before and after your Pro ends.
• To run the affiliate program: record referrals, and work out, review and pay commissions.
• To answer Tanya AI questions and limit the number of questions a day.
• To send eNUUR news and offers, only if you agreed to receive them.
• To protect eNUUR and its members from misuse, investigate technical problems, and comply with the law.

Consent and sensitive data

We process your data with your consent, given when you sign up and when you use particular features, and as far as needed to provide the services you ask for, including a Pro purchase.

Mutaba'ah records, the Al-Mathurat log and Rekod Bacaan show your religious practice. They are sensitive personal data under the PDPA, and we process them only to show them back to you. Mutaba'ah asks for your consent before it keeps your choice of practices. The Al-Mathurat log is kept when you mark a session as finished. Rekod Bacaan is counted automatically when you read the Quran in eNUUR while signed in; for now there is no setting to turn it off, but you can ask us by e-mail to delete it.

You may withdraw your consent at any time (see "Your rights").

Obligatory and optional data

• Your name, e-mail address and password are obligatory to sign up. Without them, an account cannot be created.
• To buy eNUUR Pro, your name and e-mail address are sent to Billplz. Without them, the payment cannot be made.
• Everything else is optional: your phone number (used to match the VIP list), your location (you can choose your zone or city yourself), azan notifications, consent to news and offers, and affiliate payout details (without them, commissions cannot be paid to you).

Where the data comes from

Most data comes directly from you and from your use of eNUUR. Besides that:

• Billplz tells us the payment status of your bill.
• The VIP list is prepared by the operator from its own records.
• An affiliate referral code comes from the affiliate link you opened before signing up.

Location for prayer times

When you ask eNUUR to find your prayer zone or city from your location, the location is rounded and used once only. In Malaysia, it is sent to waktusolat.app to find the zone; outside Malaysia, eNUUR finds the nearest city itself. The location is not kept by eNUUR; only your zone or city is kept.

Tanya AI

Tanya AI questions are sent to Cloudflare Workers AI to be answered and are not kept by eNUUR; only the number of questions a day is kept.

Third parties who receive data

We do not sell your personal data. We disclose data only to the following parties, as far as each one's task needs:

• Cloudflare: hosts eNUUR's application, database and files, runs Cloudflare Workers AI for Tanya AI, and keeps technical logs. All of eNUUR's data is stored at Cloudflare.
• Resend: sends eNUUR's e-mails (e-mail verification, password reset, Pro reminders). It receives your e-mail address and the content of that e-mail.
• Billplz: processes eNUUR Pro payments. It receives your name and e-mail address, and you pay on Billplz's page.
• waktusolat.app: finds the prayer zone from your rounded location, only when you ask for it (see "Location for prayer times").
• Your browser's notification service (Google, Apple, Mozilla or Microsoft, depending on the browser): delivers azan notifications to your device. A notification is sent without content; your device then asks eNUUR itself for the azan's details.
• Quran Foundation: when you play a recitation or word audio, your browser downloads that audio directly from Quran Foundation's servers, which receive your IP address as any website does.
• eNUUR staff: admins can see members' accounts (name, e-mail address, phone number, news and offers choice, plan and purchases) to manage accounts, VIP and Pro. Staff can see the list of affiliates and commissions; affiliates' bank details are seen only by admins, in the commission payout file.
• Authorities: if required by law or by a court order.

JAKIM's prayer times (e-Solat) are fetched by eNUUR's server, while the Quran data and GeoNames' city data come bundled with the application; none of your data is sent to these sources.

Transfers outside Malaysia

Some of the parties above process data outside Malaysia: Cloudflare's network runs worldwide, while Resend and the browsers' notification services operate from abroad. eNUUR's database and files were created at Cloudflare with an Asia-Pacific location hint. Data is transferred only to the parties needed to provide eNUUR, and by using eNUUR you agree to these transfers.

Retention

Your daily amal records, Al-Mathurat log and Rekod Bacaan are kept for 400 days; the pages counted by your khatam plan are kept until the plan is restarted. The daily count of Tanya AI questions and the log of e-mails sent to you are kept for 30 days. Rate-limit records, which hold an e-mail address or an IP address, are kept for 2 days. Sign-in sessions are deleted when they expire, and e-mail links 7 days after they are used or expire.

Data kept while your account exists

Other data is kept while your account exists, because the features you use need it: your account and profile, your prayer zone or city, your last reading place and bookmarks, favourites, your Mutaba'ah choice of practices, azan settings, Pro and VIP access, and affiliate records. Affiliate payout details are kept until you clear them on the Affiliate page.

When you turn azan notifications off on a device, or sign out of it, that device's notification subscription ends and its record is deleted (after a sign-out, at the next azan send).

Pro purchase and affiliate commission records are financial records, and the audit log of staff actions is an accountability record. Neither is deleted automatically, and both remain even if the account is deleted. The daily click counts of affiliate links are also kept, with no information about the visitors.

Deleted data may remain in the database's recovery backups for up to 30 days before it is gone for good.

Security

• Every connection to eNUUR is encrypted (HTTPS).
• Passwords, session tokens and e-mail links are stored as hashes, so a copy of the database does not reveal them.
• Links in e-mails can be used only once and expire: e-mail verification after 48 hours, password reset after 1 hour.
• Staff access is limited by role, and every staff change to an account is recorded in the audit log.
• Excessive sign-in and sign-up attempts are blocked.

No system is completely secure. If a data breach occurs that may harm you, we will notify the Personal Data Protection Commissioner and you, as the law requires.

Your rights

Under the PDPA, you have the right to:

• request access to your personal data and a copy of it;
• request correction of data that is inaccurate, incomplete or misleading. You can change your name, phone number and password yourself under "Profil", "Akaun saya"; to change your e-mail address, contact us;
• withdraw your consent or ask us to stop processing. You can untick the news and offers consent under "Profil", "Akaun saya", turn azan notifications off on the Azan page, remove bookmarks and favourites, and clear your affiliate payout details. Withdrawing consent for obligatory data means your account has to be closed;
• ask for your account to be deleted. Account deletion is not yet available in the app. Send your request from your account's e-mail address to sifatsahabatsdnbhd@gmail.com; we will delete your account and the data related to it, except the records we must keep as described above.

Send requests for access or correction to sifatsahabatsdnbhd@gmail.com. We may ask you to confirm your identity, and will reply within 21 days of receiving the request, as the PDPA sets.

If you are not satisfied with our reply, you may complain to the Personal Data Protection Commissioner of Malaysia.

Cookies and storage on your device

eNUUR uses only its own cookies. There are no third-party analytics, advertising or tracking cookies or scripts.

• __Host-enuur: keeps you signed in. It is valid for 30 days, extended while you keep using eNUUR, and deleted when you sign out.
• enuur_ref: the affiliate code from a referral link you opened, for 30 days or until you sign up.
• enuur-theme: your choice of light or dark theme, for a year.
• enuur-quran: the Quran reader's settings (text sizes, translation, reciter and tajweed colours), for a year.
• enuur-verify-later: hides the e-mail verification reminder until you close the browser.
• enuur-admin-sidebar: for staff only, the state of the admin pages' sidebar, for a year.

eNUUR also keeps a few things in the browser's storage on your device only, without sending them to us: today's Al-Mathurat zikir counts, your vibration choice, and whether you have answered the invitation to install eNUUR. Application files such as scripts, fonts and pictures are kept in the browser's cache so that eNUUR is faster; pages that show your data are not kept on the device.

Children

eNUUR does not ask your age. If you are under 18, ask your parent or guardian to read this policy and agree before you sign up. A parent or guardian who finds that their child signed up without consent may contact us to delete the account.

Changes to this policy

We will update this policy when the way eNUUR processes data changes, and change the date at the top. If a change is important, we will tell you by e-mail or in the app before it takes effect.

Contact us

Sifat Sahabat Sdn Bhd (1504066-V)
E-mail: sifatsahabatsdnbhd@gmail.com