Effective: 19 October 2026 · Version: 1.3
This policy is published in English.
1. Who we are
BinaFlo is operated by Mivi Tech Labs L.L.C., a limited liability company formed in the State of Wyoming, United States of America, with its registered address at 30 N. Gould Street, Sheridan, Wyoming 82801, USA.
In this policy, "we", "us" and "BinaFlo" mean Mivi Tech Labs L.L.C.
We have no office, branch, establishment or commercial registration in the Sultanate of Oman. We provide BinaFlo to customers in Oman from outside Oman. Nothing in this policy, on our website or in the software should be read as a representation that we are established or registered in Oman.
We are subject to the Personal Data Protection Law promulgated by Royal Decree 6/2022, as amended by Royal Decree 68/2026, and its Executive Regulation issued by Ministerial Decision 34/2024 (together, "the PDPL"), because Article 2 of that Law applies it to the processing of personal data of natural persons in Oman whether the processing takes place inside or outside the Sultanate.
2. The two different roles we play
This is the most important section in this policy, because your rights and who you should contact depend on it.
2.1 Where we are the controller
We decide why and how personal data is processed, and we are directly answerable to you, when we handle:
- data about the person who signs up for a BinaFlo account and the individuals at a customer company who administer it
- data about visitors to binaflo.com
- data about people who contact us for sales, support or any other reason
2.2 Where we are the processor
The customer company — the contractor that subscribes to BinaFlo — is the controller of everything its staff put into the system. We are its processor. We act on that company's documented instructions and we do not decide what to do with that data ourselves.
This covers, among other things:
- employee and worker records, including names, civil ID and passport details, visa and permit data, photographs, nationality, job title, contact details and bank account details
- attendance, working hours and overtime records
- payroll, salary, deductions, social insurance and gratuity calculations
- WPS bank files
- leave, safety incident and document expiry records
- customer, supplier and subcontractor contact details entered by the customer company
If you are a worker, an employee or a site supervisor at a company that uses BinaFlo, your employer is the controller of your data, not us. Ask your employer to exercise your rights. If you contact us directly we will pass your request to your employer and tell you that we have done so — we are not permitted to act on your data without your employer's instruction.
3. What we collect when we are the controller
| Category | Examples | Where it comes from |
|---|---|---|
| Account identity | full name, job title, work email address, mobile number, preferred language | you, at signup |
| Company details | legal and trading name, commercial registration number, VAT registration number, tax card number, chamber of commerce number, municipality number, registered address, bank details for invoicing | you, in Company Profile |
| Authentication | password (stored only as a salted hash, never in readable form), one-time verification codes, session tokens (the long-lived one is kept on your device in a protected cookie that scripts on the page cannot read), and, if you choose one, your quick-unlock PIN (stored only as a slow hash on our server and never on your device) | generated when you sign in |
| Devices signed in | device name, browser type and the time the device was last used, so that we can keep you signed in and let you (or your company's Administrator) sign a device out | generated when you sign in |
| Billing | subscription plan, payment status and dates, and the transaction records Paddle provides for your subscription (Paddle takes the payment as Merchant of Record; see Section 6.2) | Paddle, and our own records |
| Usage and technical | IP address, browser and device type, operating system, pages visited, actions taken in the application, timestamps, error reports | collected automatically |
| Security and audit | sign-in attempts including failures, IP addresses used, changes made to records, the identity of the user who made each change | collected automatically |
| Support | the content of messages you send us, and our replies | you |
We do not knowingly collect any of the categories that Article 5 of the PDPL treats as sensitive personal data — genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or data relating to security measures.
BinaFlo records attendance using QR codes and manual entry. It does not use fingerprints, facial recognition or any other biometric identifier. If we ever introduce such a feature we will update this policy first, and we will not process biometric data without the permit that Article 5 of the PDPL requires, or without an applicable exemption under Article 5bis.
We treat civil ID numbers, passport numbers, salary figures and bank account details as personal data requiring strong protection. Under Article 5 of the PDPL they are not classified as sensitive personal data, and we do not claim otherwise.
4. Why we process it, and on what legal basis
The PDPL permits processing without the data subject's explicit consent only in the four cases set out in Article 10bis. There is no "legitimate interests" basis in Omani law. Where none of those four cases applies, we rely on your consent, and you may withdraw it.
| What we do | Why | Legal basis |
|---|---|---|
| Create and operate your account; deliver the subscription you bought | To perform our contract with you | Art. 10bis(d) — execution of a contract to which the data subject is a party. Our Terms of Service and Data Processing Agreement contain the evidence of PDPL-compliant processing that Art. 10bis(d) requires. |
| Authenticate you, keep the service secure, detect abuse, maintain audit logs | To protect your data and ours | Art. 10bis(d), and Art. 13, which obliges us to apply security measures |
| Keep the transaction records Paddle provides for your subscription, and our own accounting records | To keep accurate accounts and meet record-keeping obligations | Art. 10bis(a) — implementation of a legal obligation |
| Provide support when you contact us | To answer you | Art. 10bis(d) |
| Transfer data outside Oman so the service can run at all | See Section 8 | Your express consent, required by Executive Regulation Arts. 37–40 |
| Send you product announcements, offers or marketing | To tell you about BinaFlo | Your consent, which we ask for separately and which you may withdraw at any time. Art. 22 of the PDPL governs marketing. |
| Improve the product using aggregated statistics | To make BinaFlo better | Only after the data has been anonymised so that it is no longer personal data |
We do not sell personal data. We do not share it with advertisers. We do not use it to train machine learning models.
5. Automated decisions
BinaFlo does not make decisions about you by automated means alone.
The software performs automated calculations — overtime, gratuity, social insurance, VAT, Omanisation percentages. These produce figures for a human to review and act on. They do not by themselves decide anything about a person's employment, pay or status; the customer company's own staff do that.
If we ever introduce a genuinely automated decision, Article 14 of the PDPL gives you the right to object to it, and obliges us to introduce a human element when reviewing a decision you have objected to. We will tell you before any such feature goes live.
6. Who we disclose data to
We disclose personal data only to the parties listed in this section (6.1 to 6.3), and only for the purposes stated. Sub-processors and Paddle receive it under a written contract that obliges them to protect it; professional advisers under a duty of confidentiality; authorities only where the law compels it.
6.1 Sub-processors
| Sub-processor | What they do | Data they see | Location |
|---|---|---|---|
| Ezerit Solutions OPC Pvt Ltd (trading as EzerHost) | Hosts the application and the database | All data in the service, except the files stored with Cloudflare below | India (Delhi) |
| Amazon Web Services, Inc. (Amazon SES) | Sends transactional email — invitations, verification codes, password resets, notifications | Recipient name and email address, and the content of the message | United States (AWS region us-east-2) |
| Resend (Resend Inc.) | Sends the same transactional email when Amazon SES does not (fallback) | Recipient name and email address, and the content of the message | United States |
| Cloudflare (Cloudflare, Inc.) | R2: stores customer files (photos, documents, delivery notes) and offsite backups. Both are encrypted on our server before they are uploaded; Cloudflare does not hold the key. Turnstile: the bot check on sign-up, sign-in, password reset and the contact form | R2: encrypted files and encrypted backups only. Turnstile: the visitor's IP address and browser signals, on those forms | United States / global |
We will update this table before adding any new sub-processor, and we will notify subscribing customers in advance as set out in the Data Processing Agreement.
6.2 Paddle, a separate controller
Subscription payments are taken by Paddle as Merchant of Record. Paddle is not our sub-processor: it receives the data below as a controller in its own right, under a controller-to-controller data sharing agreement with us, and uses it under its own privacy notice.
| Recipient | Role | Data it receives | Why | Location |
|---|---|---|---|---|
| Paddle.com Market Limited (company no. 8172165), 30 Old Bailey, London EC4M 7AU, United Kingdom; for buyers in the United States, Paddle.com Inc. | Separate controller (Merchant of Record) | Buyer name, email address, billing address, payment and transaction data | To take payment as Merchant of Record and meet its own tax and fraud-prevention obligations | United Kingdom (United States for US buyers) |
6.3 Others
- Professional advisers — lawyers, accountants and auditors, under a duty of confidentiality. This includes the independent compliance auditor that Article 16 of the PDPL requires us to appoint.
- Authorities — where we are compelled by a valid legal obligation, court judgment, order or decision. We will tell you unless we are legally prohibited from doing so.
- A buyer, if the business is sold or merged. You will be told before your data moves, and the buyer will be bound by terms no less protective than these.
We never disclose one customer's data to another customer. Every record in BinaFlo carries a company identifier and is isolated at the database query level.
7. Where data is stored and how it moves
Your data is stored on servers located in India, and is accessed for administration from India.
This means personal data of individuals in Oman is transferred outside the Sultanate.
8. Transfers outside Oman — and your consent to them
Article 23 of the PDPL permits transferring personal data outside Oman in accordance with the controls set by the Executive Regulation. It prohibits a transfer where the data has been processed in violation of the Law, or where the transfer would cause harm to the data subject.
We cannot provide BinaFlo without transferring your data outside Oman. We are not established in Oman and we do not operate servers there.
What the law requires, and what we have done
| Requirement | Source | What we do |
|---|---|---|
| The data subject's express consent to the transfer | Executive Regulation Arts. 37–40 | We ask for it separately, in a step of its own, not bundled into acceptance of these terms: at signup, when you accept an invitation to use BinaFlo, and at sign-in if we do not yet hold it. You can withdraw it — see below. |
| The recipient must guarantee protection not less than the PDPL standard | Executive Regulation Arts. 37–40 | Every sub-processor is under a written contract imposing PDPL-equivalent obligations, breach notification, confidentiality and audit rights. |
| A documented transfer impact assessment | Executive Regulation Art. 39 | We have carried one out for each destination and each sub-processor, and for the transfer of payment data to Paddle in United Kingdom (United States for US buyers) (Section 6.2), documented in Schedule 1 of this policy for account-holder data, and in Schedule 5 of the DPA for customer data. It records the destination country's legal framework, the risk of government access, the technical and contractual safeguards, and our conclusion. The assessment for account-holder data is published as Schedule 1 below. We will provide a copy to the Ministry of Transport, Communications and Information Technology (MTCIT) on request. |
Prior approval from MTCIT is not required for a transfer of this kind, and we have not obtained one. There is no list of approved or adequate countries under Omani law; the assessment is ours to make and to document.
If you withdraw consent to the transfer
You may withdraw it at any time by writing to the address in Section 13.
We want to be straightforward about the consequence: because the service cannot operate without the transfer, withdrawing consent means we can no longer provide BinaFlo to you. We will treat it as a request to close the account, stop processing, and delete or return the data under Section 10. In that situation we will refund any prepaid fees for the period after the account is closed.
If a company invited you to use BinaFlo, withdrawing your consent closes your own login, not the company's account.
9. How we protect it
- In transit — TLS on every connection, with certificates from a recognised authority. Plain HTTP is redirected, never served.
- At rest — full database backups taken daily, encrypted with
agebefore leaving the server, and held in offsite object storage by a provider that does not hold the decryption keys. - Passwords — stored only as salted hashes. We cannot read your password and will never ask you for it.
- Access control — role-based permissions with per-user overrides. Every operational record carries a company identifier and queries are scoped to it.
- Audit — sign-ins, failures, and changes to records are logged with the acting user, the time and the source IP.
- Segregation — production and staging are separate environments with separate databases and separate credentials.
- Administrative access — restricted to named personnel, over key-based SSH only, with no password authentication.
Article 13 of the PDPL requires a controller to apply measures appropriate to the risk. We review these annually and after any incident.
No system is perfectly secure, and we will not tell you otherwise. What we commit to is the standard above, and to telling you promptly when something goes wrong — see Section 11.
10. How long we keep it
| Data | Retention | Why |
|---|---|---|
| Account and profile data | For the life of the subscription, then until the date below | To allow reactivation and export after cancellation |
| Customer content — employee, attendance, payroll, invoice and project records, and the files attached to them | For the life of the subscription. After a trial that is not converted: read-only from the trial's end and deleted 30 days after the trial ends. After a paid subscription ends or lapses: read-only, and deleted 90 days after the paid period ends. Renewing before that date keeps the data | The customer company is the controller and sets its own retention; we hold it only while instructed |
| The transaction records Paddle provides for your subscription, and our own accounting records | 10 years | Our customers are required to retain their own tax invoices and accounting records for that period under Omani tax law, and we need the records for our own accounting and audit |
| Security and audit logs | 12 months | Security investigation and dispute resolution |
| Device sign-in records (device name, browser type, last-used time) | Until the device session ends (a device not used for 30 days, 90 days at most, or when you sign out), then 12 months in the security logs | To keep you signed in, to let you sign devices out, and for security investigation |
| Backups | 7 days locally, 30 days offsite, then overwritten | Disaster recovery |
| Support correspondence | 24 months | Service history |
| Marketing consent records | Until withdrawn, plus 24 months | To prove consent was given, as Art. 22 requires |
A customer company's own obligations may be longer than ours — for example Article 52 of the Labour Law RD 53/2023 requires an employee's personnel file to be kept for at least one year after employment ends, and tax records must be kept for ten years. Those obligations sit with the employer. Export your data before you cancel. We provide export in the application, and the 30-day (trial) and 90-day (paid) windows are a courtesy, not a guarantee. During them your account is read-only and you can sign in and export everything. We warn the Owner and Administrators by email 14, 7 and 1 days before the deletion date.
When a retention period ends we delete the data or irreversibly anonymise it. Data already written to a backup is removed when that backup rotates out, within the periods above.
11. If there is a breach
Article 19 of the PDPL and Articles 30 and 32 of the Executive Regulation set two separate obligations, both within 72 hours.
- If a breach threatens your rights, we notify the Ministry of Transport, Communications and Information Technology within 72 hours of becoming aware of it, using the Ministry's Personal Data Breach Report Form.
- If a breach is likely to cause you serious harm or a high risk, we notify you within 72 hours as well.
We will tell you what happened, what data was affected, what we have done, and what you should do. Article 11(f) gives you the right to be notified, and we will not use uncertainty about scope as a reason to delay telling you that something happened.
Where we are the processor, we notify the customer company without undue delay and support its own notifications. We do not notify that company's workers directly unless the company instructs us to.
12. Your rights
Article 11 of the PDPL gives you the following rights over personal data we hold about you as controller:
| Right | Article | What it means |
|---|---|---|
| Withdraw consent | Art. 11(a) | Where we rely on your consent, you can take it back. This does not undo processing already carried out lawfully. |
| Rectification | Art. 11(b) | Have inaccurate data amended or updated, or have processing blocked |
| Access | Art. 11(c) | Obtain a copy of your personal data that we process |
| Portability | Art. 11(d) | Have your personal data transferred to another controller |
| Erasure | Art. 11(e) | Have your data deleted, subject to the archival exception in that article and to the retention obligations in Section 10 |
| Breach notification | Art. 11(f) | Be told when your data is compromised |
| Object to automated decisions | Art. 14 | Object to a decision produced by automated processing, and require a human element in the review |
How to exercise them
Write to the Data Protection Officer at the address in Section 13, saying which right you want to exercise. We may ask for proof of identity, and only for that purpose.
We respond within 45 days, free of charge. We may refuse a request that is manifestly repetitive, and if we refuse we will tell you why and tell you that you may complain to the Ministry.
(The 45-day deadline is set by the Executive Regulation. We do not cite an article number for it here because published sources disagree on which one it is.)
If your employer uses BinaFlo, we are the processor of your employment data and not the controller. Send your request to your employer. If you send it to us, we will forward it and confirm to you that we have.
13. Data Protection Officer, and how to contact us
Article 20 of the PDPL requires every controller to appoint a Data Protection Officer, with no exemption for small organisations. Articles 34 and 35 of the Executive Regulation require the contact details to be published.
Data Protection Officer: Sanjay Kashyap Madhu Email: privacy@binaflo.com Postal: Mivi Tech Labs L.L.C., 30 N. Gould Street, Sheridan, Wyoming 82801, USA
For anything else: support@binaflo.com
We aim to acknowledge within 5 working days and to answer substantively within the 45-day limit.
We are not required by Omani law to appoint a representative in Oman, and we have not appointed one. Neither the Law nor the Executive Regulation imposes that obligation on a foreign controller. If that changes, we will appoint one and update this policy.
14. Complaining to the regulator
Article 12 of the PDPL gives you the right to complain to the Ministry. You do not have to come to us first, although we would prefer the chance to put things right.
Ministry of Transport, Communications and Information Technology (MTCIT) Personal Data Protection Department Email: PDPC@mtcit.gov.om Portal: https://mtcit.gov.om/sectors/governance/personal Complaints form: "Reporting/Complaint for Violations of the Personal Data Protection Law"
The Ministry decides complaints within 60 days. Silence after that period is treated as rejection.
15. Children
BinaFlo is a business application for construction companies and is not intended for anyone under 18. We do not knowingly collect data from children. Article 6 of the PDPL contains specific protections for children's data; if you believe a child's data has reached us, write to privacy@binaflo.com and we will delete it.
Where a customer company enters data about a worker who is a minor, that company is the controller and is responsible for the lawfulness of doing so, including under the Labour Law.
16. Cookies and similar technologies
We use the minimum necessary:
| Purpose | What it is | Can you refuse? |
|---|---|---|
| Keeping you signed in | A session cookie or token in local storage | No — the application cannot work without it |
| Remembering your language choice | A preference cookie | Yes, at the cost of re-selecting each visit |
| Security, rate limiting and abuse prevention | Short-lived technical cookies | No |
We do not use advertising cookies, third-party trackers, cross-site tracking pixels or analytics that profile you as an individual. If we ever add analytics, it will be a form that does not identify individuals, we will say so here first, and we will ask for consent where required.
17. Changes to this policy
When we change this policy we update the version number and the effective date at the top, and we keep previous versions available.
For a change that materially affects your rights or how we use your data, we notify account holders at least 30 days before it takes effect, by email and in the application. Where the change requires your consent under the PDPL, we ask for it — we do not treat silence or continued use as consent to a new purpose.
18. Governing law
This policy is governed by the laws of the Sultanate of Oman, and in particular the Personal Data Protection Law promulgated by Royal Decree 6/2022 as amended by Royal Decree 68/2026, and its Executive Regulation issued by Ministerial Decision 34/2024.
Nothing in this policy limits any right you have under Omani law.
Schedule 1 — Transfer impact assessment
Prepared under Article 39 of the Executive Regulation to the Personal Data Protection Law. This Schedule is the assessment. It covers personal data for which we are the controller — the personal data of account holders. Transfers of a subscribing customer's own data, for which we are a processor, are assessed in Schedule 5 of the Data Processing Agreement. Last reviewed: 19 October 2026.
1. The transfer
| Exporter | Mivi Tech Labs L.L.C., for account-holder data collected in Oman |
| Data | The categories in Section 3 of this policy. Section 2 of this Schedule states which of them reach each destination. |
| Data subjects | Account holders — the person who creates a company account, and each person invited to use BinaFlo |
| Destinations | India (hosting, and access by our personnel); United States (Amazon SES, Resend, Cloudflare); Paddle: United Kingdom (United States for US buyers) |
| Purpose | Operating BinaFlo, sending transactional email, storing customer files and offsite backups, the bot check on public forms, and taking subscription payment |
| Necessity | The service cannot be provided without it. We are not established in Oman and operate no servers there. |
2. Legal framework in each destination
India — hosting and personnel access. India has an omnibus data protection statute, the Digital Personal Data Protection Act 2023, imposing purpose limitation, security safeguards, breach notification and data principal rights, and establishing a Data Protection Board. In our assessment this provides protection not less than the standard the PDPL requires for the categories of data concerned.
Government access: the Information Technology Act 2000, notably sections 69 and 69A, and the Telegraph Act 1885 permit interception and monitoring on specified grounds, subject to a written authorisation procedure. Access is not unrestricted and is subject to procedural requirements and judicial review.
Mitigations: the data sits on infrastructure operated by a commercial datacentre provider under contract, not by a state entity; no Omani data localisation obligation attaches; and hosting and personnel access are in the same jurisdiction, so there is one destination to assess rather than two.
United States — Amazon SES, Resend and Cloudflare. Sectoral rather than omnibus data protection law. Government access powers include FISA Section 702 and the CLOUD Act. Mitigations: Amazon SES (region us-east-2) and Resend receive only a recipient name, email address and the content of the message. Cloudflare R2 receives only customer files and backups encrypted on our server before transmission, with the key held by us and never by Cloudflare, so it cannot read the contents and a compelled disclosure would yield ciphertext. Cloudflare Turnstile sees the visitor's IP address and browser signals on the sign-up, sign-in, password-reset and contact forms, and nothing else.
United Kingdom (United States for US buyers) — Paddle. Paddle takes subscription payments as Merchant of Record and receives the data described in Section 6.2 as a controller in its own right, not as our sub-processor, under a controller-to-controller data sharing agreement that applies Standard Contractual Clauses Module One. Mitigations: Paddle receives billing data only — no payroll, employee, identity document or project data — and it is itself subject to the data protection law of its own jurisdiction, which it applies under its own privacy notice.
3. Safeguards
- Written contracts with every recipient named in Sections 6.1 and 6.2 imposing obligations equivalent to the PDPL standard, breach notification, confidentiality, audit rights and restrictions on onward transfer
- TLS in transit;
ageencryption at rest for backups, with separated key custody - Least-privilege access, and logging of administrative access
- The express consent of each account holder to the transfer, obtained before their first use of BinaFlo and recorded against the version and hash of the Privacy Policy then in force
- Notification to the account holder of any government demand, where not prohibited; a challenge to any unlawful or overbroad demand; and disclosure of the minimum compelled
4. Conclusion
Having assessed the legal framework in each destination and the safeguards in place, we conclude that these transfers provide a level of protection not less than that required by the Personal Data Protection Law. The principal residual risk is lawful access by public authorities in each destination. That risk is mitigated by the procedural safeguards in those jurisdictions, by the narrow categories of data reaching the United States and Paddle, and by the government-demand procedure above. This assessment will next be reviewed on or before 19 October 2027.
5. Review
Reviewed annually, and additionally on: any change of recipient or destination; any material change in a destination's law affecting government access or data protection; any government demand received; and any personal data breach.
BinaFlo is a product of Mivi Tech Labs L.L.C., Wyoming, USA. Version 1.3, effective 19 October 2026.