Omajan Terms of Service

1. Who we are and what these terms cover

1.1 Omajan is operated by Basira Technologies SPC, a single-person company registered in the Sultanate of Oman under commercial registration number 1610501, VAT registration number OM1100538952, with its address at Building H, Way 3701, South Al Ghubra, Bousher, Muscat; P.O. Box 3168, Postal Code 112, Sultanate of Oman ("Basira", "we", "us").

1.2 These terms govern your use of Omajan: the omajan.com account and websites, the Fawtara Assistant, Pulse, and Omajan Invoicing, our paid invoicing software (together, the "Service").

1.3 You accept these terms by ticking the box at sign-up (or on the consent page) and using the Service. We keep a record of which version you accepted and when.

1.4 If you use the Service for a business, you confirm that you are authorised to bind that business, and "you" includes the business.

1.5 Consumer law applies to you. Under the Consumer Protection Law (Royal Decree 66/2014), every person who receives a service from us is a consumer, businesses included. Nothing in these terms reduces the rights that law gives you or the duties it places on us (Law Art 2), and any wording that seems to do so has no effect.

2. Words used in these terms

• Workspace: the space in Omajan Invoicing for one business, with its members, settings and records.
• Owner: the person who created the workspace and attested their authority to issue the business's invoices.
• Live: the part of a workspace that issues real tax invoices in the business's own number series.
• Practice: a separate, clearly labelled part of a workspace for trying the product. Nothing issued in Practice is a tax invoice or has any legal effect.
• Fiscal records: the tax invoices, simplified tax invoices, credit notes, debit notes and the evidence sealed with them that a workspace issues in Live.
• Customer data: the data you put into Omajan Invoicing about your business, your customers and your suppliers, including the fiscal records.

3. What Omajan Invoicing is, and what it is not

3.1 Omajan Invoicing is software that you use to issue your own invoices. You are the supplier on every invoice you issue; we are not a party to your sales and do not issue invoices on your behalf.

3.2 Omajan is not an accredited e-invoicing service provider and is not approved by the Tax Authority. We do not describe the Service as "compliant", "accredited" or "approved".

3.3 Today, nothing is sent to the Tax Authority. The Service produces tax invoices as PDF documents, in Arabic and English, which you give to your buyer. That PDF is the invoice. Omajan does not transmit invoices to the Tax Authority or to any e-invoicing network.

3.4 E-invoicing (Fawtara). When e-invoicing applies to your business (Decision 189/2026 sets the dates by business size), electronic invoices must pass through an accredited service provider that you choose and contract with. We intend to let the Service connect to such providers; until that connection exists and you have set it up, the Service does not perform e-invoicing for you.

3.5 Readiness checks. The Service checks each invoice against the published e-invoicing rules (PINT OM) and shows the result as a readiness check. Before your e-invoicing date, a failed check warns you but does not stop you issuing; after it, a failed check stops issuing. A passed check is not a statement by the Tax Authority, or by us, that the invoice is correct.

3.6 You remain responsible for the content and tax treatment of your invoices, for your VAT registration and returns, and for your duties to the Tax Authority, including choosing and contracting with an accredited provider when e-invoicing applies to you. This is how the Tax Authority's own guidance allocates responsibility (OTA FAQ §3.3 Q3).

3.7 Practice mode is a simulation. Documents in Practice carry "simulation" markings, are never tax invoices, and must not be given to anyone as an invoice.

3.8 Information features. The Fawtara Assistant, Pulse and our guides give general information drawn from official sources. They are not tax or legal advice about your situation, and the Assistant may be wrong. Check important decisions with the Tax Authority or your own adviser.

4. Your account

4.1 You must be at least 18 years old and able to enter into contracts under Omani law.

4.2 You must give true details and keep them up to date. You must keep your password and any authenticator codes private, and tell us at once at privacy@omajan.com if you think someone else has used your account.

4.3 Setting up a business. To issue in Live, the owner declares that they are authorised to issue the business's invoices and provides its commercial registration and VAT registration details and certificates. No person at Basira reviews this declaration; you are responsible for its truth. We refuse a VAT number already claimed by another workspace; if that happens to you, contact us.

4.4 Confirming an issue. Issuing a live invoice, and other sensitive actions, need your password again. One confirmation covers 15 minutes of issuing in the same session. Authenticator codes are optional; you can turn them on in your account settings.

4.5 Members. An owner may invite others to a workspace and is responsible for whom they invite and for removing access when it is no longer needed.

5. The evaluation period, plans and payment

5.1 Evaluation period. Each new workspace starts with 90 days to evaluate Omajan Invoicing, with the features of the Business plan. No fee is charged for the evaluation period. If you do not choose a plan by its end, the workspace becomes read-only (clause 5.7); nothing is charged.

5.2 Plans and prices. After the evaluation period, the Service is sold by the month:

VAT at 5 % is added to every price. The prices and limits in force are those on the pricing page at omajan.com when each monthly period begins.

5.3 Invoice and team limits are guides. If you issue more invoices, or add more team members, than your plan's guide, we will suggest a larger plan, but we will not stop you issuing, because the law requires you to issue invoices. The Accountant plan's limit of 10 client businesses is firm.

5.4 Our invoices to you. Once you have chosen a plan, we issue you a VAT tax invoice at the start of each monthly period, for that month, in advance. The first period begins when the evaluation period ends, or when you choose a plan if that is later. Each invoice appears on the Billing page, and we also email it to you.

5.5 Paying. You pay by bank transfer to the account shown on our invoice, or in cash by arrangement with Basira, within 14 days of the invoice date. We do not take card payments. Tell us you have paid with the "I've paid" button; your payment counts once we record it.

5.6 Price changes. We will announce any price change at least 30 days before it applies to you. We never charge more than the price in force when a monthly period begins (Consumer Protection Law Art 28). If you do not accept a new price, you may cancel under clause 6.

5.7 Late payment and read-only. If an invoice is still unpaid 14 days after its payment date (28 days after the invoice date), your workspace becomes read-only: you cannot issue new documents, but you can still sign in, view, download and export all your records. We never lock you out of your fiscal records. Paying restores full use as soon as we record the payment, and we do not charge for the time the workspace was read-only. Remember that the law still requires you to invoice your sales while your workspace is read-only; use another method until you have restored access.

6. Cancellation and refunds

6.1 The owner may cancel at any time from the Billing page, and may withdraw the cancellation until it takes effect.

6.2 During the evaluation period, cancellation costs nothing. It takes effect when the evaluation period ends.

6.3 After the evaluation period, cancellation takes effect at the end of the current monthly billing period. You keep full use until then, and we issue no invoice for later periods. The fee for the current month is not refunded.

6.4 Where the law gives you a right to a refund, repair or re-performance of the Service (Consumer Protection Law Art 23), these terms do not limit it.

6.5 What happens to your data after cancellation is set out in clause 9.

7. Your responsibilities for your invoices

7.1 You are responsible for:

• the accuracy of everything on your invoices: parties, items, prices, tax rates, exemption and zero-rating reasons, dates and numbers;
• issuing the right kind of document (a tax invoice, a simplified tax invoice, a credit or debit note) in each case;
• your own seal and signature images, and your authority to use them;
• any approval you need from the Tax Authority, for example for self-billing under VAT Regulations Art 153, before you use that feature;
• giving each buyer their invoice, in Arabic, as consumer law requires;
• your own customers' personal data, as their controller (Schedule A).

7.2 Fiscal records you issue in Live cannot be changed or deleted afterwards, by you or by us (VAT Regulations Art 157). You correct them only by issuing a credit or debit note.

8. Acceptable use

You must not:

• issue false, fictitious or misleading invoices, or use the Service for tax evasion, fraud or money laundering;
• use a VAT number, commercial registration, seal or signature that you are not entitled to use;
• put health information, or any other sensitive personal data listed in PDPL Art 5, in invoice line descriptions or notes (for example, a diagnosis or treatment on a clinic's invoice). Describe the service in general terms instead;
• put personal data about children on invoices beyond what the sale strictly needs;
• try to gain access to another workspace's data, test our security without our written permission, or interfere with the Service;
• resell or sublicense the Service, except as an accountant serving client businesses on the Accountant plan;
• use the Service in a way that breaks Omani law or public order and morals.

9. Your data

9.1 You own your customer data. You give us permission to store and process it only to provide the Service to you, as set out in Schedule A.

9.2 Personal data about you and your users is handled as our Privacy Policy (version 2026-10-01-b) explains. Data about your customers and suppliers in your workspace is handled under Schedule A (Data processing), which forms part of these terms.

9.3 Export at any time. You can export your invoices and records at any time, including while your workspace is read-only or closed.

9.4 After cancellation or closure. When a paid workspace is cancelled, or when an owner closes their account:

• the workspace becomes read-only. You can still sign in, read and export its records for at least 12 months. An owner can reopen a closed workspace, or choose a plan again for a cancelled one;
• after those 12 months, we may delete the workspace's data other than the fiscal records;
• fiscal records are kept for the legal retention period and cannot be deleted before it ends: at least 10 years (15 years for real-estate businesses) from the end of the tax year concerned, under VAT Law Art 70. In practice we lock each live document until 1 January of the twelfth year after the year it was issued (the seventeenth year for real-estate businesses). During that time you can ask us for an export at support@omajan.com.

10. The Service we provide

10.1 We provide the Service with reasonable care and skill, and we keep it available as well as we reasonably can. We may need to interrupt it for maintenance or for reasons outside our control, such as a failure at one of our hosting providers.

10.2 We may improve or change features. We will not remove a core feature you pay for, or your ability to export your records, without 30 days' notice.

10.3 We do not currently monitor the Service around the clock. If something is not working, tell us at support@omajan.com.

11. Our responsibility to you

11.1 Nothing in these terms excludes or limits our responsibility where Omani law does not allow it to be excluded or limited, including under the Consumer Protection Law and for our own fraud or gross negligence.

11.2 Subject to 11.1, our total responsibility to you for any claim relating to the Service is limited to the fees you paid us for the Service in the 12 months before the event giving rise to the claim, and we are not responsible for loss of profit or indirect loss that was not reasonably foreseeable.

11.3 We are not responsible for the content of invoices you issue (clause 7), or for loss caused by a failure of your own accredited provider, your own systems, or events outside our reasonable control.

12. Suspending or ending your use

12.1 We may suspend or end your access to the Service if you seriously breach clause 8, or fail to put right another breach within 14 days of our notice. Unless the law or an authority requires otherwise, we will tell you why, and you will still be able to export your fiscal records.

12.2 If we ever stop offering Omajan Invoicing, we will give you at least 90 days' notice and a full export, and we will keep fiscal records for the rest of their retention period or hand them to you.

13. Changes to these terms

13.1 We may change these terms. We will tell you at least 30 days before a change that affects you, by email and in the Service. Each version has a version id and date.

13.2 If a change is significant, we will ask you to accept it before you continue. If you do not accept, you may cancel under clause 6 before the change applies.

14. Law, courts and language

14.1 These terms are governed by the laws of the Sultanate of Oman.

14.2 The competent courts of Muscat have jurisdiction over any dispute, without affecting your right to complain to the Consumer Protection Authority.

14.3 These terms are issued in Arabic and English. If the two differ, the Arabic text prevails.

14.4 You agree to these terms electronically, which has legal effect under the Electronic Transactions Law (Royal Decree 69/2008).

15. Contact

• General questions and billing: support@omajan.com
• Legal notices to us: by email to support@omajan.com, or by post to the address below
• Personal data, our Data Protection Officer (Roshan Bastimal) and security reports: privacy@omajan.com
• Post: Basira Technologies SPC, Building H, Way 3701, South Al Ghubra, Bousher, Muscat; P.O. Box 3168, Postal Code 112, Sultanate of Oman

Schedule A · Data processing (processor terms)

A1. Roles

A1.1 For personal data that you put into Omajan Invoicing about your customers, suppliers and their contact people (for example a sole trader, or a consumer named on a full tax invoice), you are the controller and Basira is your processor under the Personal Data Protection Law (Royal Decree 6/2022, "PDPL") and its Executive Regulations (Ministerial Decision 34/2024).

A1.2 For the personal data of you and your users (sign-up, sign-in, billing), Basira is the controller and the Privacy Policy applies.

A2. Your instructions

A2.1 We process customer data only on your instructions (Executive Regulations Art 3). Your instructions are these terms and the actions you take in the Service: creating customers and items, issuing, exporting, inviting members, and so on.

A2.2 We use customer data only to provide the Service to you: to store it, produce your documents, seal and archive them, show them to your authorised members, let you export them, and keep the Service secure. We do not sell it, use it for advertising, or use it to train artificial intelligence models.

A2.3 If the law requires us to process customer data in some other way (for example an order from a competent authority), we will tell you first unless the law forbids it.

A3. Confidentiality

A3.1 Only people who need access to run the Service can reach customer data, and they are bound to keep it confidential. Today that is the founder.

A3.2 We do not open or read your records except to provide the Service, to answer your request for help, to investigate a security incident, or where the law requires it.

A4. Security

We protect customer data with technical and organisational measures that include:

• encryption in transit (HTTPS) and at rest at our providers;
• live fiscal records sealed with envelope encryption under keys held in Google Cloud Key Management Service, and archived in storage with a retention lock that prevents deletion or overwriting, even by us, until the retention date;
• database rules that refuse changes to issued records, and hashes that detect tampering whenever a record is read;
• separation between workspaces, checked on every read;
• a password confirmation before issuing and before sensitive actions such as evidence export, and optional authenticator codes;
• rate limits on sign-up and other sensitive requests;
• no long-lived storage keys in our application settings for the locked archive.

A5. Sub-processors

A5.1 You authorise us to use these sub-processors:

Google Gemini (used only by the Fawtara Assistant) and PostHog (analytics) do not receive customer data from workspaces.

A5.2 We impose data protection obligations on each sub-processor no weaker than those in this Schedule, as far as their standard terms allow, and we remain responsible to you for them.

A5.3 We will tell you at least 30 days before adding or replacing a sub-processor, by email and on omajan.com. If you object on reasonable data protection grounds, you may cancel and receive a refund of any fee paid for the period after the change.

A6. Where customer data is hosted

A6.1 Customer data is stored and processed outside Oman, mainly in Singapore, and may be reached by the providers above from the countries named in A5.1. We do this with the consent each user gives at sign-up and on the basis of a written transfer risk assessment (Executive Regulations Arts 37–39).

A6.2 Your duty to your own customers. Because customer data leaves Oman, you are responsible for having a lawful basis, and where needed consent, to put your customers' personal data into the Service. In particular:

• simplified tax invoices carry no buyer details, and are the right document for walk-in consumers;
• a full tax invoice naming a consumer (a natural person) contains that person's personal data. Only record it where you need to, and make sure you have the basis to do so, including for its storage abroad.

A7. Helping you with requests and duties

A7.1 If one of your customers asks us directly to exercise a right over data in your workspace, we will pass the request to you and not answer it ourselves, unless the law requires us to.

A7.2 The Service lets you find, correct (by credit or debit note), and export the data in your records. We will give you reasonable further help with your duties under the PDPL, including a transfer risk assessment, at no charge where the effort is small.

A8. Breach notice to you

A8.1 If we become aware of a breach affecting customer data in your workspace, we will tell the owner by email without undue delay, and within 48 hours of becoming aware, so you can meet your own 72-hour duty to the Ministry and to affected people (Executive Regulations Arts 30–33).

A8.2 The notice will say what happened, what data and how many people are affected as far as we know, what we have done, what you should do, and whom to contact. We will send more information as we learn it.

A8.3 We do not run automated monitoring. We become aware of breaches through our providers' security notices, reports from users and others, and our own checks. Please report anything suspicious to privacy@omajan.com.

A9. At the end

A9.1 You can export all customer data at any time before and after cancellation (clause 9).

A9.2 Fiscal retention overrides deletion. Live fiscal records are kept, locked, until their retention date (clause 9.4), because the VAT Law requires them to be kept and the lock cannot be lifted early. Other customer data stays available for export during the read-only period in clause 9.4; after it ends, we may delete it. After the retention date, we delete the fiscal records in our monthly deletion check, which is carried out by hand.

A9.3 Copies in backups are removed as the backups expire.

A10. Information and audits

On reasonable request, we will give you the information you need to show that we meet this Schedule, including this Schedule's security description and our sub-processor list.