Privacy Policy

1. Who we are

Omar Coder — Omar Al-Ghafri, a software developer licensed in the Sultanate of Oman (business license No. L3949690). This policy explains how we handle personal data collected through this website (projects.omaralghafri.com) and its services, in line with the Omani Personal Data Protection Law (Royal Decree 6/2022, "PDPL") and other applicable Omani law.

2. Information we collect

• Request and account details you submit in the project wizard: name, entity type (individual or company), email address, phone number, and — for companies — the commercial registration (CR) number and representative details.
• Project content you provide: your idea and requirements, descriptions, timelines, budget indications, references, and documents or files you upload (such as specifications, brand assets or existing code).
• Contract and billing records: the service contract, its annexes and signatures, invoices, receipts, payment references, amounts and payment status.
• Payment metadata: gateway references, amounts, currency and payment status returned by the payment gateway. We never receive or store your full card number — card data is entered directly into the payment gateway's page.
• Technical and security data: IP address (for rate limiting and security), reCAPTCHA signals, browser/device type, language preference, and service-diagnostic logs.
• Support communications: messages and attachments you send through the support-ticket portal.

3. How we use your information

• To assess your request, prepare quotations, and issue the service contract (performance of a contract).
• To deliver the software development services, communicate project updates, and provide support (performance of a contract).
• To process payments and refunds and keep financial records (performance of a contract and legal obligation).
• To protect the service against fraud, abuse and attacks (legitimate interests), including rate limiting and bot protection.
• To comply with Omani legal, tax and accounting obligations (legal obligation).
• We do not sell your personal data, and we do not use it for third-party advertising.

4. Payment processing

Online payments are processed by licensed payment gateways: Thawani (checkout.thawani.om), OMPAY/TruePay, and PayPal for non-Omani customers. When you pay, the necessary transaction data (order reference, amount, currency, and your name, phone number and email) is sent to the gateway to create and verify the payment. The gateway processes your card or wallet details on its own infrastructure under its own privacy policy. We receive from the gateway the payment status, amounts and references needed to confirm your order, issue receipts, and handle refunds.

5. Cookies and similar technologies

• A language-preference cookie stores whether you browse the site in Arabic or English.
• Security cookies and tokens keep your payment and support sessions safe (a signed capability token, kept in memory rather than the URL, authorizes access to your payment page).
• Google reCAPTCHA protects form submissions from bots; Google's Privacy Policy and Terms of Service apply to that processing.
• We do not run advertising or social-media tracking cookies.

6. Third-party services

• Payment gateways: Thawani, OMPAY/TruePay, PayPal — payment authorization, settlement and refunds.
• Cloudflare — infrastructure protection and routing for our API domain (api.omaralghafri.com).
• Google reCAPTCHA — form abuse protection.
• Firebase Cloud Messaging — push notifications about project and payment updates, where you have enabled them.
• These providers process data on our instructions or under their own terms as independent controllers for their services; each processes only what is needed for its function.

7. Storage and protection

Data is transmitted over encrypted connections (HTTPS/TLS) and stored on access-controlled servers. Administrative access is restricted and authenticated; payment credentials are held only by the payment gateways in their own vaults. We apply technical and organizational measures appropriate to the sensitivity of the data, and review them as the service evolves.

8. Data retention

Contract, payment and accounting records are retained for the periods required by Omani law (including statutory limitation and tax-record periods). Project files and communications are kept for as long as needed to provide the services, honour warranties, and resolve disputes, after which they are deleted or anonymized. Backups rotate within a limited window and are covered by the same rules.

9. Your rights

Subject to the PDPL and other applicable Omani law, you may:

• Request access to the personal data we hold about you, and correct it if inaccurate.
• Request deletion of data that is no longer needed, unless retention is required by law or to establish/defend legal claims.
• Object to or request restriction of certain processing, and withdraw consent where processing is based on consent.
• Raise a concern with us first through the support portal; applicable Omani mechanisms remain available to you.

10. International transfers

Some providers (payment gateways, Cloudflare, Google) may process data outside the Sultanate of Oman. Where that happens, we rely on the provider's safeguards and process only the minimum data required for the service.

11. Children

Our services are directed to adults and businesses. We do not knowingly collect data from children; if you believe a child submitted data, tell us through the support portal and we will remove it.

12. Changes and contact

We may update this policy as the service evolves; the version date below changes accordingly. For any question or request related to this policy, contact us through the support portal on this website (the "Support" page). We reply through the same channel.