Monaady

Privacy Policy

DRAFT TEMPLATE — NOT LEGAL ADVICE.
This document must be reviewed and finalized by a licensed attorney in the Sultanate of Oman, particularly with respect to Oman’s Personal Data Protection Law (PDPL).

Effective Date: [DATE]
Platform: Monaady (مُنادي)
Data Controller: [COMPANY NAME]
Contact: [EMAIL / DPO EMAIL]

1. Who We Are

Monaady is a local classifieds marketplace operating in Oman. This Privacy Policy explains how we collect, use, store, and protect your personal data.

2. Data We Collect

  • Account data: phone number, email address, name, password hash, preferred language.
  • Verification data: Oman ID or resident card image (temporarily, for verification only).
  • Listing data: titles, descriptions, prices, photos, locations, category attributes.
  • Interaction data: favorites, reports, reviews, chat/contact events.
  • Technical data: device language, IP address, browser/app version.

3. How We Use Your Data

  • To create and secure your account.
  • To verify your identity and build trust on the platform.
  • To display your listings to buyers.
  • To enable contact between buyers and sellers.
  • To moderate content and enforce policies.
  • To comply with legal obligations.

4. Identity Verification

To improve trust, we may ask you to upload an ID document. The image is:

  • Used only for verification.
  • Reviewed by authorized personnel or an automated self-hosted verifier.
  • Retained only during the review period.
  • Deleted after the final approval or rejection decision.
  • Not shared with other users.

We retain only the verification status, date, reviewer reference, and a hash of the ID number for duplicate/ban detection.

5. Two-Factor Authentication (TOTP)

Monaady uses TOTP (time-based one-time password) via authenticator apps for account verification. When you set up TOTP:

  • A unique secret is generated for your account.
  • The secret is encrypted before being stored.
  • You scan a QR code into your authenticator app; Monaady never sees the codes generated by your app.
  • Recovery codes are shown once and stored only as secure hashes.

6. Data Sharing

We do not sell your personal data. We may share data:

  • With law enforcement when required by law.
  • With service providers who help us operate the platform (hosting, analytics), under strict confidentiality.

7. Your Rights Under Oman PDPL

You have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and data, subject to legal retention obligations.
  • Withdraw consent where applicable.

To exercise these rights, contact: [DPO EMAIL]

8. Data Retention

  • Account data: retained as long as the account is active.
  • ID images: deleted after the final verification decision.
  • TOTP secrets and recovery-code hashes: retained while the user keeps TOTP enabled; deleted when the user disables TOTP or deletes the account.
  • Cookie consent preference: retained in the browser until the user clears it.
  • Listings: retained until deleted by the user or removed for policy violations.
  • Backup copies may be retained for a limited period in accordance with our retention schedule.

9. Security

We use industry-standard measures including encryption in transit (HTTPS), secure cookies, access controls, and regular backups. No system is completely secure; users should also protect their accounts.

10. Cookies and Analytics

We use cookies to keep you signed in, remember your language and preferences, and protect against fraud. We also use analytics cookies to understand how the platform is used, but only if you consent through the cookie banner.

For details, see our Cookie Policy.

11. Children’s Privacy

Monaady is not intended for users under 13. If we learn that a child under 13 has provided data, we will delete it.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified through the app or email.

13. Contact

For privacy questions or data requests, contact: [DPO EMAIL]