Privacy policy

Effective: June 2026.

Who we are

Daftar is a finance operating system for small and medium businesses in Oman and the GCC. Contact: privacy@daftar.pro.

Data you provide

When you create an account we collect your email and (optionally) display name. When you use the product, you enter business data — clients, invoices, expenses, bank transactions, attachments. You own that data; we process it on your instructions to operate the service.

Data we collect automatically

Standard server logs (IP address, user agent, timestamps, request paths) for security, abuse prevention, and debugging. We do not run third-party advertising trackers.

How we use data

To provide the service, secure your account, communicate operationally (receipts, security alerts), comply with legal obligations, and improve the product. We do not sell personal data and do not use customer financial data to train AI models.

Sharing

We share data only with subprocessors that help us operate the service: Supabase (database, auth, storage), Cloudflare (edge runtime), and Google Gemini (when you invoke an AI action). We disclose data to authorities only when legally compelled, and notify you when permitted.

Retention

Business records are retained for as long as your account is active. After account closure, records are retained for the period required by applicable tax law (commonly five to ten years across GCC jurisdictions) and then deleted or anonymised. You can export your data at any time before closure.

Your rights

You can access, correct, export, or delete your personal data, and object to processing. Email privacy@daftar.pro and we will respond within 30 days.

Security

See the Trust centre for technical controls, including row-level isolation, tamper-evident invoice chains, and encryption.

International transfers

The service runs on global infrastructure. Where required by law (KSA PDPL, UAE Personal Data Protection Law), we will work with you to keep regulated data in compatible regions.

Children

The service is for business use and not directed at children under 16.

Changes

We will post material changes here and notify account owners by email at least 14 days before they take effect.