Last updated: 8 October 2026

This policy explains how RWAD (Muscat, Sultanate of Oman), the operator of the Miftahly platform, processes personal data. It follows Oman's Personal Data Protection Law (Royal Decree No. 6/2022) and its Executive Regulation (Ministerial Decision No. 34/2024), in line with recognised international data protection principles.

Who we are and each party's role

RWAD operates the Miftahly platform and provides it to car rental offices.
The rental office is the controller of the customer and staff data it enters, and decides why it is processed.
RWAD processes that data on the office's behalf and under its written instructions in the terms of use, and does not use it for its own purposes.
RWAD is directly responsible for data about visitors to this site, demo requests, and office accounts and billing.

Data we process

Office account and staff data: name, email, phone, permissions, and sign-in and activity history.
The office's customer data: name, nationality, date of birth, phone, email, ID, passport and driving licence numbers and images, contracts, payments and traffic fines.
Vehicle inspection photos and contract signatures.
Demo requests from this site: name, office, phone, email, city, fleet size and message.
Limited technical data about site visitors that does not identify them (see "Cookies and analytics").
We do not process sensitive personal data such as health, genetic or biometric data (fingerprints or face prints), and we do not ask about beliefs, political opinions or criminal records.

We process data on the basis of the data subject's explicit consent, as Omani law requires.
In the system: the office records each customer's consent to the consent text before storing their data, with the text version, time and method (signature, electronic, or documented verbal consent).
On this site: we only accept a demo request after your explicit consent, and we keep the time you gave it.
You may withdraw consent at any time. Withdrawal does not affect processing before it, or data the law requires us to keep.
We do not send marketing messages without separate prior consent and an easy way to stop them.

Purpose

Running the office's rental business: bookings, contracts, inspections, invoices, fines, and its legal and tax obligations.
Checking and reading documents automatically and analysing inspection photos to suggest damage, when the office enables it. Suggestions only take effect after staff review; no automated decision is made about a customer.
Managing the office's account, subscription, invoices and support.
Replying to demo requests and contacting you about them only.
Protecting the platform against intrusion and misuse.

Where data is stored and transfers outside Oman

Data is stored with cloud service providers outside the Sultanate of Oman. This only happens with the data subject's explicit consent, and after confirming that the provider's protection is no lower than Omani law requires:

Database, files and backups: Supabase, on servers in India (Mumbai).
Website, content delivery and protection: Cloudflare, on its global network.
AI document reading and inspection photo analysis (when enabled): Anthropic, in the United States, without using the data to train models.
System email delivery: Resend.

Data is encrypted in transit and at rest, and document images sit in private storage opened only through temporary links for authorised users.

Retention

Contract and invoice text data: 10 years, per VAT law and commercial record requirements.
ID and licence images: 5 years after the last transaction, extendable by the office up to 10 years, then deleted automatically.
Demo requests: deleted automatically 2 years after the last update, unless the requester becomes a subscriber.
After an office's subscription ends: its data stays available for export or reactivation, and the office may ask for permanent deletion at any time, except data the law requires us to keep.

We do not sell, rent or share data for marketing.
We share it only with the service providers listed above, under written contracts that require them to protect it and use it only to provide the service.
We may disclose it to competent authorities in Oman when the law or a court order requires.

Your rights

Under Omani law, a data subject may:

Access their data and obtain a copy.
Correct or update it.
Ask for deletion when the purpose ends or consent is withdrawn, unless the law requires keeping it.
Ask for their data to be transferred to another party.
Withdraw consent at any time.
Complain to the Ministry of Transport, Communications and Information Technology.

Send requests in writing to the rental office you dealt with, or to us at the email below. We reply within 45 days at most, free of charge, and may ask for proof of identity first.

Security

Full separation between offices: no office can see another office's data.
Role-based permissions, and a log of every action with the name of who did it.
Two-step sign-in is mandatory for owners, managers and platform admins, with alerts on sign-in from a new device.
Daily backups.

Security incidents

If an incident affects personal data, we notify the affected office and the competent authority within 72 hours of becoming aware of it, and notify the data subjects within the same period if it exposes them to serious harm.

Cookies and analytics

This site does not use cookies for tracking or advertising.
We store only your theme preference (light or dark) in your browser.
We count visits with Cloudflare Web Analytics, which uses no cookies, does not identify visitors, and does not track them across sites.
Inside the system, the browser stores only what is needed to keep you signed in.

Children

The platform is meant for rental offices and their adult customers, and we do not knowingly process data of anyone under 18. If a minor's data must be entered, this only happens with explicit consent from their guardian.

Data protection officer and contact

RWAD has appointed a data protection officer who oversees compliance with this policy. To reach them, or for any privacy request or question: sales@miftahly.com (subject: Data protection).

Changes

We may update this policy. We publish the date above with every update and notify offices of any material change before it takes effect.

Privacy policy