Privacy Policy
This page describes what our site actually does with your data — not general promises. It is written under Oman's Personal Data Protection Law (Royal Decree 6/2022).
What we collect, and why
| When you place an order | Your name and phone number, plus the address and notes if you write them. We use them to fulfil the order and contact you about it — nothing else. |
| When you pay online | We never see your card details. Payment happens on Thawani's own page and never passes through our server. We store only the payment session id and its status (paid / cancelled). |
| Visit measurement | How many people visit and which sections they read. No cookies, no stored IP address, no browser fingerprint. The identifier is a random number that lives in your browser tab and dies when you close it. |
| Browser notifications | Only if you enable them: the subscription address your browser issues. It belongs to the device, not the person, and is never linked to an order or a name. Revoke it any time from your browser settings. |
Cookies
We set no cookies on your browser as a visitor. The only cookie on this site belongs to Al Saher staff signing in to the admin panel, and it is created only after a successful login. That is why you will find no cookie consent banner here: there is nothing to consent to.
What stays on your device and never reaches us
Your shopping cart, your preference about installing the site as an app, and a flag marking that you have visited before — all stored in your browser alone and never sent to our server. Clearing site data from your browser erases all of it.
Who we share it with
We do not sell your data, do not use it for advertising, and share it only where the service requires:
- Thawani — to process online payments, under their own privacy policy.
- WhatsApp — when you choose to message us there. The message goes through WhatsApp's servers, not ours.
- Our hosting provider — which runs the site server and its database.
How long we keep it
| Orders and invoices | Kept for as long as Oman's accounting and tax rules require. These are financial records we may not delete on request — an exception the law itself provides for. |
| Enquiries that never became orders | Deleted automatically 24 months after the last contact — name, phone, notes and appointments together. No manual step, no request needed. |
| Visit measurement | Deleted automatically after 365 days. It does not identify you in the first place. |
| Change log | An internal record of what our staff edited in the admin panel, deleted automatically after 18 months — deliberately shorter than the enquiry window, so no name outlives the record it came from. |
Your rights
Omani law entitles you to ask us to:
- See what we hold about you.
- Correct data that is wrong or out of date.
- Delete your data — except what financial rules require us to keep.
- Object to a particular use, or withdraw consent for notifications.
Message us on WhatsApp via this link stating your request and the phone number registered with us. We respond within 30 days at the latest, and usually the same day.
How we protect it
- All traffic to the site is encrypted (HTTPS).
- Staff passwords are stored hashed — nobody reads them, including us.
- Fine-grained permissions: whoever does not need data does not see it.
- An audit log recording who changed what and when inside the admin panel, itself pruned on a schedule.
- Regular backups whose integrity is verified.
Children
Our services are aimed at adults and business owners. We do not knowingly collect data from anyone under eighteen, and we delete such data as soon as we become aware of it.
Changes to this policy
We may update it if our services change. Changes are published on this page, and the last-updated date below is revised in the same release that changes the behaviour.