Privacy Policy

Last updated: 2026-10-19 · The Arabic text prevails if the two versions differ.

1. Who we are

Ma'ay ("we", "us") is an app that connects mothers and families with approved, independent women drivers for school, nursery, college and work runs.

The data controller is Muscat Investment Center LLC, commercial registration (CR) 1299785, Sultanate of Oman.

Contact for anything in this policy: info@maay.om.

2. What this policy covers

It covers the Ma'ay rider and driver app, the driver registration pages, the sign-up waitlists (on our website and for zones not yet open: name, phone, area and the consent version you accepted), our WhatsApp and email messages, and our support and operations staff. It explains what personal data we collect, why, on what basis, who receives it, how long we keep it, and your rights under the Oman Personal Data Protection Law (PDPL).

3. The data we collect

We collect only what the service needs (data minimisation).

3.1 Account holder (a mother or guardian who books)

• Name, phone number, gender, home area, email, preferred language.
• Your records of consent (which kind and version of text you accepted, whether granted, the language shown, and when).
• Booking data: pickup and drop-off points, days and times, chosen plan, and the map point you give if you join a waitlist for a zone that is not open yet.
• Contracts, invoices, payments and credits.
• Up to two trusted contacts (name and phone) that you choose for safety alerts.
• Chat messages with your driver (only while the contract is active; visible to our operations team).
• Ratings and comments you give a driver.

3.2 Riders, including children

• Name, gender, date of birth/age, school or nursery, grade, and notes you add (for example "needs help with the bag").
• Whether the rider is the account holder herself.
• Trip events about the rider: boarded, no-show, dropped off, with time and place. At a handover to a guardian, the driver records the name of the person who received the child (data about a third party).
• Behaviour notes a driver may record about a rider (see section 5).

Child data is limited to what transport needs. We process it only with the express consent of the parent or guardian (section 6).

3.3 Drivers

• Name, phone, gender, date of birth, nationality, email, and a profile photo (shown to the account holders of the riders you drive).
• Civil ID number and expiry; driving licence number, issue and expiry dates; copies of these documents.
• Police clearance certificate. Stored internally only, for checking driver status. It sits in private encrypted storage, is viewable only by operations agents and the super administrator, is never shown to riders or other drivers, and every view is logged.
• Vehicle details (make, model, year, colour, plate, seats), photos of the vehicle (front, back, side and interior), registration and insurance documents and their expiry dates.
• Routes, days and time windows you offer, and your availability.
• Bank IBAN for payouts.
• Ratings, trip history, complaints and the count of behaviour notes.
• Location during runs (section 3.4).

3.4 Location

• Drivers: the app streams location only during an active run, once per few seconds, with its accuracy and speed, and shares it only with the parties of that run (the riders' account holders and operations). It stops when the run ends.
• Riders/account holders: the app may ask for your location once, when you set a pickup point or a waitlist point. It does not track you. If you press SOS, the app also sends your phone's location at that moment.
• On an SOS, we send the location (the driver's and, if you press it, yours), trip and people on board to operations and your trusted contacts, and we keep the SOS record with its GPS point (section 9).
• Background location is used by the driver app only while she has an active run.

3.5 Payments

• We never see or store your full card number or security code. Card details are entered on the payment gateway's own hosted page. If you save a card, we hold only the gateway's token reference, the brand, the last 4 digits and expiry, and use it only to charge your own invoices (and only for auto-pay if you opt in).
• We keep invoices, payment status, refunds and credits.

3.6 Technical data

• Device type and label, app version, IP address and security logs (kept 30 days).
• To limit abuse of one-time codes, we keep a hashed (scrambled, not readable) form of the IP address and phone number for a short time, and a log of blocked attempts.

3.7 Driving licence reading (only if switched on)

When a driver uploads her driving licence, we may send only the licence image to Google's Gemini service to pre-fill the number and dates. The driver and a supervisor check the result. If this feature is not used, this section is removed.

4. Why we use your data, and our legal basis

We do not sell your personal data. We do not use it for advertising by third parties.

5. Behaviour notes about riders

A driver may record a behaviour note about a rider. The account holder is warned in the app that after more than 3 notes she cannot place new requests. This block is applied automatically by the system, with no human decision, unless a supervisor lifts it; it rests on a driver's free-text notes about a child. You can ask us to see and correct notes about your rider (section 10), and to have a person review the block.

6. Your consent

We ask for your express, recorded consent before we process personal data. The consents are:

1. Terms and this privacy policy (each version is recorded).
2. Parental/guardian consent before we process a child's data. By adding a child, the account holder confirms she is the child's parent or legal guardian and consents on the child's behalf.
3. Cross-border transfer (section 8).
4. Marketing (optional, off by default).
5. Location through the phone's permission prompt.

Drivers give terms, privacy (processing of application data), cross-border storage and licence-reading consents as separate choices. Riders do not yet: today the rider's first-run screen has one checkbox covering the terms, the privacy policy and storage on a server outside Oman, and the app records the three together.

You may withdraw any consent at any time by writing to info@maay.om. Withdrawal does not affect processing already done. If you withdraw something the service needs, we may be unable to continue the service.

When this policy or the terms change materially, we ask you to accept the new version before you continue.

7. Who receives your data

Drivers never see another driver's data, and riders never see police certificates or driver documents.

8. Transfers outside Oman

Our server is hosted by Hostinger, outside Oman. Some providers above (for example Meta for WhatsApp, Google Maps Directions and the payment gateway) also process data outside Oman. Before we store or send your data outside Oman, we aim to ask for your explicit consent. We use encryption in transit (TLS 1.2 or higher), we encrypt the most sensitive fields before they are stored, and we limit what is sent. If you do not consent, we may not be able to provide the service because the app depends on this hosting.

What the consent covers today: the consent screen asks only about storing your data on a server outside Oman (hosting). It does not name Meta (WhatsApp), Google Maps Directions (which the live service uses for routes, so pickup and drop-off coordinates go to Google) or the payment gateway.

9. How long we keep data

These are default periods and are subject to confirmation by the accountant and legal adviser.

Implementation status: today the only automatic deletion is the 90-day purge of trip paths. The other periods below are targets: nothing yet deletes or replaces police certificates, purges rejected applicants' documents, the notification inbox, trip events, contracts or the audit log.

10. Your rights

You have the right to:

• Access the data we hold about you and your children.
• Correct inaccurate data.
• Erase your data (except records we must keep by law, see section 9).
• Transfer a copy of your data to you or another provider.
• Withdraw consent.
• Object to or restrict processing where the law allows.
• Complain to the Ministry of Transport, Communications and Information Technology (MTCIT).

How to ask: write to info@maay.om. We may ask you to confirm your identity (a one-time code to your phone). We reply within 45 days. A parent/guardian exercises a child's rights.

11. Security

TLS 1.2+ for all traffic; sensitive fields (document keys, saved-card tokens, draft contract details) encrypted before storage; documents in private storage opened only with short-lived signed links; role-based access checked on every request; two-factor authentication for all staff; an append-only audit log of admin actions and money events; every view of a police certificate is logged; encrypted backups; and a tested restore process. No system is perfectly secure, so we also train staff and review access.

12. If something goes wrong

If a data breach is likely to endanger your rights, we report it to the MTCIT within 72 hours of discovering it. If it causes severe harm, we tell the affected users within 72 hours as well. We keep an incident runbook and access logs for this.

13. Children

The app is not for children to use. Accounts are for adults (mothers and guardians) and drivers aged 21 and over. We hold a child's data only as entered by the parent or guardian, only what transport needs, and only with the parent's consent.

14. Records we keep about our own processing

We maintain a Record of Processing Activities (data, purpose, recipients, retention, staff with access) as the Executive Regulations require. It is not public.

15. Changes and versions

Every version of this policy has a number and date. When we make a material change we tell you in the app and ask you to accept it again. Older versions are kept so we can show what you accepted.

16. Contact

Ma'ay, operated by Muscat Investment Center LLC (CR 1299785) Email: info@maay.om