Privacy policy
This policy explains how Mithaq (ميثاق), operated by Bin Haider Darwish LLC (BHD Group, Muscat, Oman), handles personal data. We aim to be plain, brief, and conservative.
1. What we collect
- Account data: name, email, phone (for OTP), tenant role, language preference.
- Workspace content: meetings, decisions, documents, member records, audit log entries, whatever your tenant chooses to store.
- Operational logs: request IP, user-agent, timestamps, action type. Used for security and debugging only.
- OTP delivery: we hand off the code to email provider or to BHD's Dardasha (WhatsApp Business) gateway for delivery. The code expires within minutes.
We do not collect biometric data, payment-card numbers (Paymob handles those when billing lands), or location data.
2. What we do with it
We use it to run your Mithaq tenant. That is it. We do not sell data, share it with advertisers, train models on it, or aggregate it across tenants for resale.
3. Per-tenant isolation
Every tenant's data lives in its own directory and is read/written through tenant-scoped paths enforced by middleware + AsyncLocalStorage. Tenants cannot read each other's data. Operators can, for support; that access is logged in the audit trail.
4. Data residency
Cloud data is stored on a virtual private server operated by Hostinger International in region IN-Mumbai, with Cloudflare in front for DNS, TLS and edge caching of static assets. Customers who need data to stay inside Oman should choose the on-premise deployment. Custom-domain customers run on the same cloud infrastructure. On-premise customers' data lives entirely on their servers; we never see it.
5. Retention
We keep your tenant data for as long as your subscription is active. After termination you have 30 days to export. After that, we delete from primary storage; backups roll off within a further 30 days.
6. Your rights
You can request a full export, correction, or deletion of your personal data at any time via the contact form. We respond within 7 business days.
7. Sub-processors
- Cloudflare (DNS, edge, TLS termination)
- Hostinger (VPS hosting)
- Mail provider for OTP email delivery (BHD's own SMTP relay where possible)
- BHD Dardasha (WhatsApp OTP)
- Paymob (payment processing, when billing is enabled, Phase 8)
8. Cookies
We set a session cookie after login (HttpOnly, Secure, SameSite=Lax) and a language preference cookie. We do not use third-party tracking or analytics cookies.
9. Children
Mithaq is for institutional use. We do not knowingly collect data from children under 16.
10. Mobile application
The Mithaq iOS and Android apps open your tenant over HTTPS after you enter a workspace slug. They store a device identifier so a secretary can revoke a handset and wipe downloaded meeting packs. Screen capture is blocked where the operating system allows it. The apps do not sell data, run advertising SDKs, or track you across other companies' apps.
11. Changes
We post material changes here and notify tenant admins by email. Continued use after notice means acceptance.
12. Contact
Data Protection contact: use the contact form (subject "DPO") · BHD Group, Muscat, Sultanate of Oman.