Privacy Policy.

Last updated: 18 September 2026

Effective as of 18 September 2026.

Hysn Pte Ltd ("Murattil," "we", "us" or "our") provides a Quran recitation and memorisation practice application that listens to your recitation and returns word-level accuracy feedback. This Privacy Policy describes how Murattil processes personal information that we collect through our digital or online properties or services that link to this Privacy Policy — including our mobile application ("Murattil") and our website at https://murattil.com (collectively, the "Service").

1. Personal information we collect

Information you provide to us

Personal information you may provide to us through the Service or otherwise includes:

1. Contact data, such as your email address and, optionally, a full name of your choosing. We do not collect postal addresses, phone numbers, professional titles or company names.
2. Profile data, such as the username and password you set to establish an account on the Service, and your in-app preferences (theme, notification preference, reference-audio autoplay, language, prayer calculation method and manual prayer-time corrections).
3. Communications data based on our exchanges with you, including when you contact us through the in-app feedback and bug report forms or by email.
4. User-generated content and input data, specifically:
   • Recitation audio that you record in the app. This is transmitted to our servers for speech recognition and scoring and is deleted immediately after processing — see How audio is processed below.
   • Recitation transcriptions: the Arabic text that our recognition model heard, which we retain so the app can show you your mistakes later.
   • Practice results: per-ayah accuracy scores, status (done / review / needs practice), attempt number, practice source (hifz or single-ayah), recitation duration, session start and end times, progress percentage, streaks, achievements and completed-surah marks.
   • Word-level mistake records: the position of each word you got wrong, the expected word, the word we transcribed, and the mistake type (wrong, missing, mispronounced, harakat, extra, or out of order).
   • Microphone calibration data: statistical summaries of a short calibration sample (mel-spectrogram mean and per-channel standard deviation) plus the sample duration. The calibration audio itself is not retained.
   • Support attachments: screenshots or screen recordings that you choose to attach to a bug report.
5. Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

We do not collect demographic data, date of birth, transactional or order data, marketing preference data, relationship data, financial data, government-issued identification numbers, payment data, or promotion and contest data.

We may introduce paid or subscription features in future. Purchases made through the app will be processed by the Apple App Store or Google Play, which handle billing and hold your payment details under their own privacy policies — we will not receive or store your full payment card number. We would then receive only a transaction or subscription identifier and entitlement status, so we know what you have access to.

Third-party sources

We do not purchase, licence or otherwise obtain personal information about you from data providers, marketing partners, public sources, or social media platforms. The Service offers no social or third-party login. The only personal information we hold about you is what you give us directly or what is generated automatically as described below.

We may receive personal information in connection with an actual or prospective business transaction — for example, from or to an entity we acquire or are acquired by, a successor or assignee, or any party involved in a merger, acquisition, sale of assets or similar transaction, and/or in the context of an insolvency, bankruptcy, or receivership.

Automatic data collection

We and our service providers may automatically log information about you, your mobile device, and your interaction over time with the Service, such as:

1. Device data, such as your mobile device's operating system type and version, manufacturer and model, device type (phone or tablet), app version, language settings, and IP address. Where you run the microphone calibration, we also store a device identifier and device name so that your calibration profile can be matched to the correct device.
2. Diagnostics and performance data, collected only where you have turned on Share Diagnostics, such as crash reports and stack traces, app launch time, hangs and errors, and network request metadata (endpoint, HTTP status code and timing). Network request bodies are not captured, and the app's own console logs are not forwarded to our diagnostics provider, so your recitation audio and transcriptions are not included in this data.
3. Service activity data, such as which screens you used and when, and access times — to the extent generated in ordinary server logs.

We do not collect advertising identifiers (IDFA / AAID), and we do not use pixel tags, clear GIFs or tracking beacons in emails.

Location and device sensors — processed on your device only

The app uses your device's location (where you grant permission) and its compass and motion sensors to calculate prayer times and the Qibla direction. Both calculations happen locally on your device. Your coordinates and sensor readings are not transmitted to our servers, are not logged by us, and are not shared with any third party. If you decline location permission, you can set your location method manually and the rest of the Service is unaffected.

How audio is processed

Recitation scoring uses large speech models that require server-side GPU hardware, so your audio is processed on our servers rather than on your phone. Specifically:

• Audio is transmitted from your device to our servers over HTTPS (TLS 1.2 or higher).
• On the server it is written to a temporary working file, converted to the format the model requires, processed, and then deleted within the same request cycle — including when processing fails.
• In live and streaming practice modes, audio arrives as short chunks which are processed and discarded continuously as you recite.
• We do not retain a copy of your recitation audio.
• Your audio is never used to train, fine-tune or evaluate our models, and never shared with third parties for that purpose, unless you give separate, explicit, per-recording consent.

The microphone is accessed only while a recording session is active and visible in the app. There is no background or passive listening.

Data about others

The Service has no referral or contact-invitation feature. Please do not send us other people's personal information.

2. Cookies, tracking & similar technologies

What these technologies are. Cookies are small text files placed on your device by a website. "Similar technologies" include web beacons, pixels, software development kits (SDKs), and on-device storage such as local storage, secure storage and file caches. We describe below which of these the Service uses, what they do, and how you can control them.

In the Murattil mobile app

The app is a native application and does not use cookies in the ordinary web sense. It does store data locally on your device, which serves a similar function:

All of the above stays on your device, except the diagnostics SDK, which — only where you have agreed to it — transmits technical crash and performance data to our diagnostics provider as described in How we share your personal information.

No advertising or cross-app tracking. The app contains no advertising SDKs, no ad networks, no advertising identifiers (IDFA / AAID), and no cross-app or cross-site tracking technologies. It does not request App Tracking Transparency permission because it performs no tracking as defined by that framework.

In-app web content. Where the app opens web content — for example a link to our website or a third-party page — that content may set its own cookies in the in-app browser, governed by the privacy policy of the site you are visiting rather than by this policy.

On our website

https://murattil.com currently uses only cookies and local storage that are strictly necessary to serve the site and remember your display preferences.

We do not currently run any analytics on our website, and we set no advertising or targeting cookies anywhere.

Planned: website analytics. We intend to add privacy-respecting analytics to https://murattil.com so we can understand which pages are useful. This is not active yet. Before any analytics cookie or similar technology is set we will: name the provider and the specific cookies in this section; and, for visitors in the EEA and the UK, ask for your consent through a cookie banner before setting it, with a way to withdraw consent later. We will not apply it retroactively to visits that took place before you consented, and we will not add advertising or targeting cookies.

AI and automated technologies

The Service uses automated speech recognition and text-alignment models, operated by us on our own infrastructure, to transcribe and score your recitation. These models are not operated by a third-party chatbot or generative AI provider, and your recitation data is not sent to any such provider.

Your choices

• Website cookies. Most browsers let you block or delete cookies through their settings, and to refuse cookies from particular sites. Blocking strictly necessary cookies may stop parts of the site working.
• Global Privacy Control. We honour GPC signals received on our website as a valid opt-out request where applicable law requires it.
• Blocking images and clear GIFs. Most browsers and devices can be configured to prevent images loading. Follow the instructions in your browser or device settings. We do not use tracking pixels in email.
• App storage. You can clear the app's local storage and cached audio from your device's app settings, or by uninstalling the app. Clearing it signs you out and removes your cached reciter audio and saved preferences; it does not delete your account or your progress on our servers.
• Diagnostics. Crash and performance reporting is off until you agree to it. The first time you open the app we ask; if you decline, or simply dismiss the question, nothing is collected and our diagnostics provider is never started. You can change your answer at any time under Profile → Share Diagnostics, with or without an account. Turning it off stops collection immediately so far as the provider's software allows, and takes full effect the next time you open the app. Diagnostics contain no recitation audio and no transcription text.
• Do Not Track. Some browsers can be configured to send "Do Not Track" signals. We do not respond to them, because we perform no cross-site tracking that such a signal would change.

3. How we use your personal information

We may use your personal information for the following purposes or as otherwise described at the time of collection:

Service delivery and operations

We may use your personal information to:

• provide the Service, including transcribing and scoring your recitation and returning word-level feedback;
• enable security features of the Service;
• establish and maintain your user profile, progress history, streaks and weak-word review list;
• tune recitation scoring to your device's microphone, where you have run calibration;
• communicate with you about the Service, including service-related announcements, updates, security alerts, password resets, account-deletion verification, and support and administrative messages; and
• provide support for the Service, and respond to your requests, questions and feedback.

Service personalization

To remember your selections and preferences, and to present your progress and weak points in a way that reflects your own practice history.

Service improvement and analytics

Where you have turned on Share Diagnostics, we may use diagnostics and performance data to analyse how the Service is performing, find and fix crashes and errors, and improve reliability. We do not use your recitation content for this purpose, and we do not join diagnostics data to your recitation content.

Compliance and protection

We may use your personal information to:

• comply with applicable laws, lawful requests, and legal process;
• protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);
• audit our internal processes for compliance with legal and contractual requirements or our internal policies;
• enforce the terms and conditions that govern the Service; and
• prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks, abuse of our recitation scoring capacity, and identity theft. This includes applying rate limits (currently 20 recitation requests per hour for anonymous use and 100 per hour for signed-in accounts).

Marketing and advertising

We do not use your personal information for marketing or advertising. We serve no advertisements, we run no interest-based advertising, and we do not share information about our users with advertising partners. We may send you service-related emails as described above; these are not marketing emails.

Events, promotions and contests

Not applicable — we run none.

To create aggregated, de-identified and/or anonymized data

We may create aggregated, de-identified and/or anonymized data from personal information we collect — for example, overall accuracy distributions across all users, used to measure whether a model change improved scoring. We make personal information into de-identified and/or anonymized data by removing information that makes the data identifiable to you, and we will not attempt to re-identify any such data.

Limitation on AI training. Notwithstanding the above, we do not use your recitation audio to train our models, in identifiable or de-identified form, without your separate explicit opt-in consent. Where we use aggregated statistics derived from scoring outcomes to evaluate model quality, those statistics contain no audio and no transcription text.

Further uses

In some cases we may use your personal information for further uses, in which case we will ask for your consent if those purposes are not compatible with the initial purpose for which the information was collected.

4. Retention

We generally retain personal information to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, establishing or defending legal claims, or for fraud prevention purposes. To determine the appropriate retention period we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve those purposes by other means, and the applicable legal requirements.

Account deletion. When you delete your account it is deactivated immediately — you can no longer sign in, and your data is no longer served through the Service. The underlying records are then purged from our production systems within 7 days, and rotated out of encrypted backups within 30 days.

When we no longer require the personal information we have collected about you, we will either delete it, anonymize it, or — if that is not possible, for example because it is held in backup archives — securely store it and isolate it from any further processing until deletion is possible.

5. How we share your personal information

We may share your personal information with the following parties (or as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection).

Affiliates. Our corporate parent, subsidiaries, and affiliates, if any.

Service providers. Third parties that provide services on our behalf or help us operate the Service or our business:

Payment processors. None today — the Service collects no payments. If we introduce paid features, billing will be handled by the Apple App Store or Google Play (or another processor named here before launch), and we will not receive or store your full payment card details.

Advertising partners. None — we run no advertising.

Third parties designated by you. We may share your personal information with third parties where you have instructed us or provided your consent to do so.

Partners. None — we run no co-sponsored events, promotions or joint offerings.

Linked third-party services. None — the Service offers no social or third-party login.

Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the Compliance and protection purposes described above.

Business transferees. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in Murattil, financing, or the sale, transfer or merger of all or part of our business, assets or shares), and to an acquirer, successor or assignee as part of any such transaction, and/or in the event of an insolvency, bankruptcy or receivership.

Other users and the public. None. Murattil has no public profiles, no social feed, no comments, no leaderboards and no sharing of recitation between users. Your practice history, recitations, transcriptions and mistakes are private to your account and are never visible to other users or to the public.

6. Your choices

In this section we describe the rights and choices available to all users. Users located in certain U.S. states and in Europe can find additional information about their rights below.

Access or update your information. If you have registered for an account, you may review and update your account information and preferences by signing in to the app.

Delete your account. You can delete your account from within the app. For your protection we email a one-time verification code to your registered address before the deletion proceeds. Deleting your account removes your practice data, attempts, transcriptions, word mistakes, streaks, achievements, settings and microphone calibration, subject to the retention periods described above.

Delete your microphone calibration. You can delete your calibration profile on its own, at any time, without deleting your account.

Use the Service without an account. You can read the Quran, listen to reciters, use prayer times and the Qibla compass without registering. Anonymous practice is available in a limited, rate-limited form in which no user profile is created and no progress is retained.

Opt out of communications. We send no marketing email. You can control prayer-time and other notifications in the app settings or in your device's system settings.

Training data. We do not use your recitation audio to train our models. If we ever offer such a programme it will be strictly opt-in, per recording, and you will be asked at the point of recording.

Mobile location data. You can disable our access to your device's location in your device settings at any time. As described above, your location is used only on your device and never reaches our servers.

Privacy settings. The app allows you to control notification preferences, whether reference audio autoplays, and whether microphone calibration is active.

Cookies and similar technologies. For information about the technologies the Service uses and how to control them, see Cookies, tracking & similar technologies above.

Declining to provide information. We need to collect certain personal information to provide the Service. If you do not provide information we identify as required, we may not be able to provide the related features — for example, recitation scoring requires microphone access and progress tracking requires an account.

7. Other sites and services

The Service may contain links to websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party services and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.

Quran text and reciter audio. Quranic text and reference recitations are obtained from third-party sources and remain the intellectual property of their respective publishers. Reciter audio may be cached locally on your device for offline listening; that caching happens on your device.

8. Security

We employ technical, organizational and physical safeguards designed to protect the personal information we collect, including:

• HTTPS/TLS 1.2 or higher for all traffic between the app and our servers;
• passwords stored only as salted one-way hashes, never in plaintext or reversible form;
• short-lived access tokens with separately revocable refresh tokens, held in the platform secure store on your device;
• time-limited, single-use codes sent to your registered email for password reset and account deletion; and
• restriction of server access to personnel who require it.

However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information. If we become aware of a breach affecting your personal information we will notify you and the relevant authorities as required by law.

9. International data transfer

We are headquartered in Singapore. Our application, database and inference servers are located in Germany, within the European Economic Area. Some of our service providers operate outside Germany — in particular our diagnostics provider (New Relic, Inc.) and our transactional email provider (Resend), which are based in the United States. Your personal information may therefore be transferred to, and processed in, countries where privacy laws may not be as protective as those in your state, province or country.

Users in Europe should read the important information provided in the Notice to European users section about transfers of personal information outside of Europe.

10. Children

The Service is suitable for family use and is listed as a general-audience education app. However, an account may not be created by anyone under 13 years of age (or under 16, where that is the minimum age of digital consent in your country) without the consent of a parent or guardian.

A parent or guardian may use the Service together with a child under the guardian's own account and supervision. We do not knowingly collect personal information directly from a child below the applicable age without the required consent. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us at privacy@murattil.com and we will comply with applicable legal requirements to delete the information.

11. Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes we will notify you by updating the date of this Privacy Policy, posting it on the Service, and surfacing an in-app notice before your next recording session. Any modifications will be effective upon posting (or as otherwise indicated at the time of posting). Your use of the Service after the effective date of a modified Privacy Policy indicates your acknowledgment that it applies to your interactions with the Service and our business.

12. How to contact us

If you have questions about our practices, or if you would like to exercise any privacy-related right that may be available to you, please contact us:

• Email: privacy@murattil.com (general enquiries: hello@murattil.com)
• Phone: +65 8504 2132

We aim to respond within seven (7) days, and in any event within the period required by applicable law.

13. State privacy rights notice

Except as otherwise provided, this section applies to residents of U.S. states to the extent they have privacy laws applicable to us that grant their residents the rights described below (collectively the "State Privacy Laws").

For purposes of this section, "Personal Information" has the meaning given to "personal data", "personal information" or similar terms, and "Sensitive Personal Information" the meaning given to "sensitive personal information", "sensitive data" or similar terms, in the State Privacy Laws, except that neither term includes information exempted from the scope of those laws.

Please note that not all rights listed below are afforded to all users, and if you are not a resident of a state with an applicable law you may not be able to exercise them. We may not be able to process your request if you do not provide sufficient detail for us to confirm your identity or understand your request. Our authentication process: we verify requests against control of the email address registered to the account, by sending a one-time verification code to that address. For anonymous users we hold no identifiers capable of linking a request to a person, and we may be unable to action a request.

Your privacy rights. The State Privacy Laws may provide residents with some or all of the following rights. These rights are not absolute and we may decline a request in certain cases as permitted by law.

• Information. You can request the following about how we have collected and used your Personal Information: the categories collected; the categories of sources; the business or commercial purpose for collecting or selling it; the categories of third parties with which we share it; the categories sold or disclosed for a business purpose; and the categories of third parties to whom it was sold or disclosed for a business purpose.
• Access. You can request a copy of the Personal Information we have collected about you.
• Appeal. You can appeal our denial of any validly submitted request.
• Correction. You can ask us to correct inaccurate Personal Information we have collected about you.
• Deletion. You can ask us to delete the Personal Information we have collected from you. You can also do this yourself in the app at any time.

Opt-out.

• Opt-out of certain processing for targeted advertising purposes. We do not process your Personal Information for targeted advertising purposes.
• Opt-out of or appeal profiling / automated decision-making. We use automated processing to transcribe and score your recitation and to generate your feedback, progress and weak-word list. We do not use your Personal Information to engage in profiling or automated decision-making that results in significant financial impacts, or significant impacts on housing, education, employment, health care, or criminal justice, or similarly significant impacts.
• Opt-out of other sales of personal data. We do not sell your Personal Information within the meaning of State Privacy Laws.

Consumers under 16. We do not have actual knowledge that we collect, sell or share the Personal Information of consumers under 16 years of age, and we do not sell or share Personal Information at all.

Sensitive Personal Information. We process information that may reveal religious belief, because Quran recitation practice inherently does so, and we process audio data. We process this information solely to deliver the features you have asked for. We do not process Sensitive Personal Information for the purpose of inferring characteristics about consumers, and we do not sell or share it.

Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws.

Exercising your right to opt out of the "sale" or "sharing" of your Personal Information. We do not sell or share Personal Information for monetary or other valuable consideration, and we use no advertising or analytics services that would cause our activities to be classified as a "sale" or "share" under the State Privacy Laws. Accordingly there is nothing for you to opt out of. We nonetheless honour Global Privacy Control ("GPC") signals where received on our website.

Exercising other state privacy rights. You may submit requests to exercise any of the other rights listed above by email to privacy@murattil.com, or by mail to the address in the How to contact us section. Account deletion is also available directly in the app.

Verification of identity; authorized agents. We may need to verify your identity in order to process your request, and reserve the right to confirm your residency. We verify by sending a one-time code to the email address registered to your account. Under some State Privacy Laws you may enable an authorized agent to make a request on your behalf; we may need to verify your agent's identity and authority, and may require a copy of a valid power of attorney or your written and signed permission.

Information practices. The following describes our practices currently and during the past 12 months.

• Sources and purposes. We collect the categories of Personal Information described above, from you directly and automatically from your device, and use them for the business and commercial purposes described in this Privacy Policy.
• Retention. The criteria for deciding how long to retain Personal Information are described in the Retention section above.
• Deidentification. We do not attempt to re-identify deidentified information derived from Personal Information, except for the purpose of testing whether our deidentification processes comply with applicable law.

Personal information that we collect, use and disclose. The table below maps the Personal Information we collect to the categories specified in the CCPA (Cal. Civ. Code §1798.140). This chart describes our practices currently and during the 12 months preceding the effective date of this Privacy Policy.

Additional information for California residents — Shine the Light law. Under California Civil Code Section 1798.83, California residents may ask companies with whom they have formed a business relationship primarily for personal, family or household purposes to provide the names of third parties to which they have disclosed certain personal information during the preceding calendar year for those third parties' own direct marketing purposes. We disclose no personal information for third-party direct marketing purposes. You may nonetheless send requests to privacy@murattil.com with the statement "Shine the Light Request", your first and last name and mailing address, and certification that you are a California resident.

Additional information for Nevada residents. Nevada residents have the right to opt out of the sale of certain personal information for monetary consideration. We do not engage in such sales. If you are a Nevada resident and wish to make a request regarding any potential future sales, email privacy@murattil.com.

Additional information for Texas residents. We do not sell sensitive personal data as defined by the Texas Data Privacy and Security Act.

Contact us. If you have questions or concerns about our privacy policies or information practices, contact us using the details in the How to contact us section above.

14. Notice to European users

General

Where this Notice to European users applies. The information in this section applies only to individuals in the United Kingdom and the European Economic Area (i.e., "Europe" as defined at the top of this Privacy Policy).

Personal information. References to "personal information" in this Privacy Policy should be understood to include a reference to "personal data" (as defined in the GDPR) — i.e., information about individuals from whom they are either directly identified or can be identified.

Controller. Hysn Pte Ltd is the controller in respect of the processing of your personal information covered by this Privacy Policy for the purposes of European data protection legislation (the EU General Data Protection Regulation and the UK GDPR, as and where applicable, the "GDPR"). See the How to contact us section above for our contact details.

Our legal bases for processing

In respect of each purpose for which we use your personal information, the GDPR requires us to ensure that we have a "legal basis" for that use. Our legal bases are:

• Contractual Necessity — where we need to perform a contract we have entered into with you.
• Legitimate Interests — where processing is necessary for our legitimate interests and your interests and fundamental rights do not override those interests.
• Compliance with Law — where we need to comply with a legal or regulatory obligation.
• Consent — where we have your specific consent (and, for special category data, your explicit consent under Article 9(2)(a)).

Marketing and advertising. We carry out none, so no legal basis is required.

Special category data

Using Murattil reveals that you practise Quran recitation, which may indicate religious belief — a special category of personal data under Article 9 GDPR. Your recitation audio and transcriptions fall into this category.

We process this data on the basis of your explicit consent (Article 9(2)(a)), given when you create an account and use the practice features. You may withdraw that consent at any time by deleting your account in the app or by contacting us; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Beyond this inherent characteristic of the Service, please do not send us other sensitive personal information (for example national identification numbers, health data, biometric or genetic data, political opinions, or trade union membership) through the Service, including in free-text support requests.

Automated processing

The Service uses automated processing to transcribe your recitation, align it with the Quranic text, and produce an accuracy score and word-level feedback. This processing does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR: the output is study feedback, it carries no consequence outside the app, and you are free to disregard it. You can contact us at privacy@murattil.com if you believe a score is wrong and wish to discuss it.

Retention

We retain personal information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying legal, accounting or reporting requirements, establishing or defending legal claims, or for compliance and protection purposes. To determine the appropriate retention period we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal requirements. See the retention table in the Retention section above.

When we no longer require your personal information we will either delete or anonymize it or, if this is not possible (for example because it is stored in backup archives), securely store it and isolate it from any further processing until deletion is possible. If we anonymize your personal information so that it can no longer be associated with you, we may use that information indefinitely without further notice to you.

Your rights

General. European data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions in relation to the personal information we hold about you:

1. Access. Provide you with information about our processing of your personal information and give you access to it.
2. Correct. Update or correct inaccuracies in your personal information.
3. Delete. Delete your personal information where there is no good reason for us to continue processing it — including where you have exercised your right to object.
4. Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
5. Restrict. Restrict the processing of your personal information, for example if you want us to establish its accuracy or the reason for processing it.
6. Object. Object to our processing where we are relying on Legitimate Interests.
7. Withdraw Consent. Where we use your personal information based on your consent — including the explicit consent on which recitation processing relies — you have the right to withdraw that consent at any time.

Exercising these rights. You may submit these requests by email to privacy@murattil.com or to our postal address above. Deletion is additionally available directly in the app. We may request specific information from you to help us confirm your identity and process your request. Whether we are required to fulfil a request depends on a number of factors; if we reject a request in whole or in part we will tell you our grounds at the time, subject to any legal restrictions.

Your right to lodge a complaint with your supervisory authority. If you are not satisfied with our response to a request, or with how we process your personal information, you can complain to the data protection regulator in your habitual place of residence.

• European Economic Area — contact details for each national regulator are published by the European Data Protection Board at edpb.europa.eu.
• United Kingdom — The Information Commissioner's Office, Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF. Tel. +44 303 123 1113. ico.org.uk

Data processing outside Europe

Our servers are located in Germany, inside the European Economic Area. Hosting, the database and recitation inference therefore take place within the EEA, and your recitation audio and practice data are not transferred outside Europe for those purposes.

However, some of our service providers operate outside Europe. In particular:

• New Relic, Inc. (United States) — crash reporting and performance diagnostics.
• Resend (United States) — transactional email (password reset and account-deletion verification).
• Singapore — where our own personnel access data in the course of operating and supporting the Service.

Neither the United States nor Singapore is the subject of a general "adequacy decision" under the GDPR — meaning their legal regimes are not considered by the relevant European bodies to provide a level of protection equivalent to that provided by European law, other than, in the case of the United States, for organisations certified under the EU-US Data Privacy Framework.

Where we share your personal information with third parties based outside Europe, or access it ourselves from outside Europe, we seek to ensure a similar degree of protection by implementing one of the following:

1. Transfers to territories with an adequacy decision. We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection by the European Commission or the UK Government (as and where applicable).
2. Transfers to territories without an adequacy decision. In these cases we use specific appropriate safeguards designed to give your personal information effectively the same protection it has in Europe — in particular the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum — together with the supplementary technical measures described in the Security section. In limited circumstances we may rely on a derogation, such as your explicit consent to a particular transfer.

You may contact us at privacy@murattil.com for further information on the specific mechanism used when transferring your personal information out of Europe, and you may have the right to receive a copy of the appropriate safeguards.

Questions about this document? Write to privacy@murattil.com. See also our Terms of Use.