Version 1 — last updated 9 October 2026

This agreement is part of the Miftahly terms of use. It governs how RWAD (Muscat, Sultanate of Oman), the operator of Miftahly, processes the personal data an office enters about its customers, staff and investors, under the Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulation.

Roles

The office is the controller of its customers' data: it decides why and how the data is processed, obtains customers' explicit consent and answers their requests.
RWAD is the processor: it processes the data on the office's behalf and only on its documented instructions, which are the office's use and settings of the platform.

RWAD's obligations

Process the data only to provide the platform; never use it for another purpose, sell it or share it for marketing.
Limit access to platform team members who need it to give support, bound by confidentiality, with their entry into the office account logged.
Apply appropriate technical and organisational security measures, including per-office data isolation, two-step sign-in, encryption in transit and at rest, an audit log and daily backups.
Tell the office without delay, and within 72 hours at the latest of becoming aware, of any security breach affecting its data, with the information available to help it meet its duties to the Ministry and to the people concerned.
Help the office answer data-subject requests (access, copy, correction, erasure) through the platform's tools.
Delete or return the office's data when the subscription ends, after the export period set in the terms, unless the law requires keeping it.
Make available the information needed to show compliance with this agreement and cooperate with any audit the Ministry requires.

Sub-processors

The office agrees that RWAD uses these providers to run the platform, under protection no lower than this agreement:

Supabase (database and storage — Mumbai, India)
Cloudflare (hosting and site protection)
Resend (email delivery)
Anthropic (inspection photo analysis, document reading and the assistant — when enabled)
Meta (WhatsApp messages — when the office connects its number)

RWAD tells the office about any change to this list before it applies.

Transfers outside Oman

The data is stored on servers outside the Sultanate. The office obtains its customers' explicit consent to this; the platform provides the consent text and records it with each customer.

Retention

Contracts, invoices and payments are kept for 10 years; document images for the period the office sets (at least 5 years after the last dealing), then deleted automatically.

Changes

This agreement may be updated in a new version, which the office is asked to accept.