Omajan Privacy Policy
اقرأ بالعربية- Version
2026-10-01-b- Published and in force from
This text is also issued in Arabic. If the two differ, the Arabic text prevails.
1. Who we are
Basira Technologies SPC (commercial registration 1610501, Building H, Way 3701, South Al Ghubra, Bousher, Muscat; P.O. Box 3168, Postal Code 112, Sultanate of Oman) runs Omajan: the omajan.com account and websites, the Fawtara Assistant, Pulse and Omajan Invoicing. In this policy "we" means Basira.
Our Data Protection Officer is Roshan Bastimal, reachable at privacy@omajan.com or by post at Building H, Way 3701, South Al Ghubra, Bousher, Muscat; P.O. Box 3168, Postal Code 112, Sultanate of Oman.
This policy explains what personal data we collect, why, who processes it for us, where it is kept, for how long, and your rights under the Personal Data Protection Law (Royal Decree 6/2022, "PDPL") and its Executive Regulations (Ministerial Decision 34/2024).
2. Our two roles
- For your own data (your account, sign-in, consents, billing, marketing, your use of our sites), we are the controller. This policy covers that.
- For personal data inside a business's invoicing workspace (the business's customers, suppliers and their contacts), the business is the controller and we are its processor, acting on its instructions under Schedule A of our Terms of Service. If you appear on an invoice issued through Omajan, contact the business that issued it; we will pass on any request we receive.
3. What we collect, and where it comes from
| Data | Where it comes from | Examples |
|---|---|---|
| Account | You, at sign-up; or Google, if you sign in with Google | Name, email address, password (stored only as a hash), sign-in method, authenticator setting |
| Sign-in and security | Your device, automatically | Session records with IP address and browser details; a log of sensitive actions with IP address and browser details |
| Consents | You | Which consents you gave or withdrew, the wording version, language, when and where |
| Your business | You, as owner or member | Trade name, CR and VAT numbers, address, phone, email, the signatory's name and title, seal and signature images, a fingerprint of the certificates you upload, your role in the workspace |
| Setup answers | You | Whether you are a business or accountant, your annual supplies band, invoices per month |
| Billing | You and us | Plan, our invoices to you, payments you make, bank reference |
| Fawtara Assistant and hub | You | Your questions (sent to Google Gemini to answer, not stored by us); a contact record with your name, email, IP address, browser details and referring page, and a log of your Assistant and hub activity |
| Contact and early-access forms | You | Name, email, organisation, message, IP address, browser details |
| Pulse | You | Saved items, reactions, comments (with IP address and browser details), reading activity, topic preferences, notification settings |
| Analytics (only if you accept) | Your device | Pages visited, clicks, device and browser; linked to your account (email, name, role) when you are signed in |
| Error reports | Our servers | Technical details of errors, with email addresses removed |
| Your data requests | You | Each download or account-closure request and its outcome |
We do not keep an IP address with your consent records.
We do not knowingly collect sensitive personal data (PDPL Art 5), such as health data, and our terms forbid customers to put it on invoices.
4. Why we use it, and on what basis
| Purpose | Data used | Basis |
|---|---|---|
| Create and run your account; sign you in; keep it secure | Account, sign-in and security | Your consent at sign-up, and performing our contract with you |
| Provide Omajan Invoicing: set up your business, issue and store your invoices, let you export them | Your business, setup answers | Contract; and for fiscal records, the legal duty to keep them (VAT Law Art 70) |
| Bill you and keep our own tax records | Billing | Contract; legal duty (VAT Law) |
| Answer your Fawtara Assistant questions and follow up on your interest | Assistant, contact records | Your consent |
| Run Pulse and your preferences | Pulse | Your consent |
| Understand how the sites are used and improve them | Analytics | Your consent through the analytics banner; you can decline |
| Fix errors | Error reports | Keeping the service working |
| Send news and offers | Email address | Your separate, optional marketing consent |
| Handle your rights requests and prove how we handled them | Data requests, consents | Legal duty (PDPL) |
| Detect abuse and investigate security incidents | Sign-in and security, activity log | Legal duty to protect data (PDPL Art 13, Art 19) |
We do not sell personal data, show advertising based on it, or use it to train AI models.
5. Who processes it for us
| Provider | What it does for us | Where |
|---|---|---|
| Vercel (Vercel Inc., USA) | Hosts our websites and applications; stores encrypted invoice PDFs and export files | Invoicing application and its files: Singapore. Some of our other omajan.com websites: the United States |
| Neon (Neon Inc., USA, on Amazon Web Services) | Our database | Singapore |
| Google Cloud (Google LLC, USA) | Locked long-term archive of issued invoices; encryption keys | Singapore |
| Brevo (Sendinblue SAS, France) | Sends our emails: verification, password reset, notifications, invoices, and marketing if you agreed | European Union |
| Google Gemini (Google LLC, USA) | Answers questions you type into the Fawtara Assistant. Only your question is sent; no invoice data | United States |
| PostHog (PostHog Inc., USA) | Usage analytics if you accept them; error reports | United States |
If you choose Sign in with Google, Google shares your name, email address and profile picture with us under Google's own privacy policy.
We may also disclose personal data where the law requires it, for example to the Tax Authority or a court, and only to the extent required.
6. Hosting outside Oman
Our services are hosted outside Oman, mainly in Singapore, with some processing in the European Union and the United States as shown above. We chose Singapore because our hosting providers offer it close to the Gulf, with strong security, and the Oman-based alternatives do not yet fit our software.
Before any transfer we:
- ask your explicit consent at sign-up (Executive Regulations Art 37);
- keep a written transfer risk assessment (Art 39), which the Ministry may ask to see (Art 40);
- use providers that encrypt data in transit and at rest and commit to protecting it.
7. How long we keep it
| Data | How long |
|---|---|
| Account, business and Pulse data | While your account is open, then as in §8 |
| Sessions | Until you sign out or they expire (7 days, renewed while in use) |
| Consent records | While your account exists; they are deleted with it |
| Record of your data requests | 5 years after the request, to prove how we handled it; it survives account deletion |
| Issued invoices and their evidence (fiscal records) | Locked until 1 January of the twelfth year after the year of issue (the seventeenth for real-estate businesses), to meet the 10- or 15-year duty in VAT Law Art 70. They cannot be deleted before then, even by us |
| Our invoices to you and your payments | As the VAT Law requires for our own records |
| Assistant, hub, contact and early-access records | 24 months after your last contact |
| Security and activity logs | 24 months |
| Analytics | Kept by PostHog under our project's retention setting; you can ask our DPO to delete your analytics data at any time |
| Backups | Database backups are overwritten as our database provider's recovery window moves on; deleted archive objects are recoverable for 7 days |
We have no automated deletion jobs. Deletions at the end of these periods are carried out by hand, at our monthly check.
8. Closing your account
You can close your account in Settings. Before you confirm, the screen tells you which of these applies:
- If you own a business on Omajan Invoicing: your businesses are closed and become read-only, pending invitations are cancelled, and your other sign-ins end. You keep sign-in so you can read and export your records. You can reopen a closed business. Its fiscal records are kept for the legal period in §7.
- If your name appears on a business's records (you were a member of a workspace, created one, or wrote a Pulse article): all your memberships end and you are signed out permanently. Your account record is kept because those records name you.
- Otherwise: your account and everything linked to it are deleted.
In the first two cases your marketing consent is withdrawn automatically.
9. How we protect it
Encryption in transit and at rest; issued invoices sealed with keys held in Google Cloud Key Management Service and archived in retention-locked storage; database rules that refuse changes to issued records; separation between businesses; password confirmation before issuing; optional authenticator codes; limited access, currently the founder only. See Schedule A of the Terms for more.
10. Your rights
Under PDPL Art 11 you have the right to:
- withdraw your consent at any time. Withdrawal does not affect processing already done. Withdrawing the required consents means we can no longer provide the service, and your account is closed as in §8;
- correct or update your data;
- get a copy of your data: Settings → Your data → Download my data gives you one file at once. A business's invoices are exported from Omajan Invoicing;
- receive your data in a portable format (the same download, in JSON);
- have your data deleted when it is no longer needed, except where the law requires us to keep it, such as fiscal records (§7);
- be told of a breach of your data (§12).
How: use the account screens above, or email our DPO at privacy@omajan.com. We may ask you to confirm your identity. We answer within 45 days, and free of charge (Executive Regulations Arts 16–20). Corrections that are not available in Settings are made on request by email.
11. Marketing
We send news and offers by email only if you ticked the separate, optional box. You can stop them at any time in Settings, or by writing to our DPO, and we stop at once.
12. If something goes wrong
If a breach of your personal data is likely to cause you serious harm, we will tell you within 72 hours of becoming aware of it, and we will tell the Ministry of Transport, Communications and Information Technology where the law requires (PDPL Art 19; Executive Regulations Arts 30–33). Report anything suspicious to privacy@omajan.com.
13. Cookies and analytics
- Essential cookies keep you signed in across omajan.com and remember your choices. The sites do not work without them.
- Analytics cookies (PostHog) are used only if you accept them in the banner. If you decline, analytics stay off. On some Omajan sites, accepted analytics may include recordings of how pages are used.
- The Omajan Invoicing application does not load analytics.
14. Children
Omajan is not intended for anyone under 18, and we do not knowingly collect children's data.
15. Complaints
If you are not satisfied with how we handle your data, contact our DPO first. You may also complain to the Ministry of Transport, Communications and Information Technology (PDPL Art 12), through the Ministry's official channels at mtcit.gov.om.
16. Changes
We will tell you by email and in the service before a significant change to this policy, and ask for your consent again where the law requires. Each version has a version id and date.
This policy is issued in Arabic and English. If the two differ, the Arabic text prevails.