Privacy Policy

Effective: 1 November 2026 · Version: 1.5

This policy is published in English.

1. Who we are

BinaFlo is operated by Mivi Tech Labs L.L.C., a limited liability company formed in the State of Wyoming, United States of America, with its registered address at 30 N. Gould Street, Sheridan, Wyoming 82801, USA.

In this policy, "we", "us" and "BinaFlo" mean Mivi Tech Labs L.L.C.

We have no office, branch, establishment or commercial registration in the Sultanate of Oman. We provide BinaFlo to customers in Oman from outside Oman. Nothing in this policy, on our website or in the software should be read as a representation that we are established or registered in Oman.

We are subject to the Personal Data Protection Law promulgated by Royal Decree 6/2022, as amended by Royal Decree 68/2026, and its Executive Regulation issued by Ministerial Decision 34/2024 (together, "the PDPL"), because Article 2 of that Law applies it to the processing of personal data of natural persons in Oman whether the processing takes place inside or outside the Sultanate.

2. The two different roles we play

This is the most important section in this policy, because your rights and who you should contact depend on it.

2.1 Where we are the controller

We decide why and how personal data is processed, and we are directly answerable to you, when we handle:

• data about the person who signs up for a BinaFlo account and the individuals at a customer company who administer it
• data about visitors to binaflo.com
• data about people who contact us for sales, support or any other reason

2.2 Where we are the processor

The customer company — the contractor that subscribes to BinaFlo — is the controller of everything its staff put into the system. We are its processor. We act on that company's documented instructions and we do not decide what to do with that data ourselves.

This covers, among other things:

• employee and worker records, including names, civil ID and passport details, visa and permit data, photographs, nationality, job title, contact details and bank account details
• attendance, working hours and overtime records
• payroll, salary, deductions, social insurance and gratuity calculations
• WPS bank files
• leave, safety incident and document expiry records
• customer, supplier and subcontractor contact details entered by the customer company

If you are a worker, an employee or a site supervisor at a company that uses BinaFlo, your employer is the controller of your data, not us. Ask your employer to exercise your rights. If you contact us directly we will pass your request to your employer and tell you that we have done so — we are not permitted to act on your data without your employer's instruction.

3. What we collect when we are the controller

We do not knowingly collect any of the categories that Article 5 of the PDPL treats as sensitive personal data — genetic data, biometric data, health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or data relating to security measures.

BinaFlo records attendance using QR codes and manual entry. It does not use fingerprints, facial recognition or any other biometric identifier. If we ever introduce such a feature we will update this policy first, and we will not process biometric data without the permit that Article 5 of the PDPL requires, or without an applicable exemption under Article 5bis.

We treat civil ID numbers, passport numbers, salary figures and bank account details as personal data requiring strong protection. Under Article 5 of the PDPL they are not classified as sensitive personal data, and we do not claim otherwise.

4. Why we process it, and on what legal basis

The PDPL permits processing without the data subject's explicit consent only in the four cases set out in Article 10bis. There is no "legitimate interests" basis in Omani law. Where none of those four cases applies, we rely on your consent, and you may withdraw it.

We do not sell personal data. We do not sell it, and we do not share it with other advertisers. If you accept optional cookies on binaflo.com, the website statistics in section 16 may be linked to our own Google Ads account, only to count how many visits from our ads lead to a free trial. We do not use personal data to train machine learning models.

5. Automated decisions

BinaFlo does not make decisions about you by automated means alone.

The software performs automated calculations — overtime, gratuity, social insurance, VAT, Omanisation percentages. These produce figures for a human to review and act on. They do not by themselves decide anything about a person's employment, pay or status; the customer company's own staff do that.

If we ever introduce a genuinely automated decision, Article 14 of the PDPL gives you the right to object to it, and obliges us to introduce a human element when reviewing a decision you have objected to. We will tell you before any such feature goes live.

6. Who we disclose data to

We disclose personal data only to the parties listed in this section (6.1 to 6.4), and only for the purposes stated. Sub-processors and Paddle receive it under a written contract that obliges them to protect it; professional advisers under a duty of confidentiality; authorities only where the law compels it.

6.1 Sub-processors

We will update this table before adding any new sub-processor, and we will notify subscribing customers in advance as set out in the Data Processing Agreement.

6.2 Paddle, a separate controller

Subscription payments are taken by Paddle as Merchant of Record. Paddle is not our sub-processor: it receives the data below as a controller in its own right, under a controller-to-controller data sharing agreement with us, and uses it under its own privacy notice.

6.3 Others

• Professional advisers — lawyers, accountants and auditors, under a duty of confidentiality. This includes the independent compliance auditor that Article 16 of the PDPL requires us to appoint.
• Authorities — where we are compelled by a valid legal obligation, court judgment, order or decision. We will tell you unless we are legally prohibited from doing so.
• A buyer, if the business is sold or merged. You will be told before your data moves, and the buyer will be bound by terms no less protective than these.

6.4 A service your company chooses: place search on the site map (optional)

The site-location map has an optional place search. It is off for every company. It is on only if the company's Owner or an Administrator switches it on in Settings → Features, after reading a notice and confirming it. The company chooses this service; it is not our sub-processor and it is not in the table in 6.1.

When it is on and a person presses Search, we send the words typed in the search box, the language and a restriction to Oman from our server to the OpenStreetMap Foundation's Nominatim service (nominatim.openstreetmap.org), which is operated outside Oman, to find the place. We send no name, email address, company, user ID, access token or stored location. The OpenStreetMap Foundation sees our server's address, not the address of the person's device. Please type place names only, not personal data.

We keep each answer in a cache for 30 days, under a hash of the words and tied to no person. A result only moves the map: the point we store for a site is the pin the person places. The company can switch the search off at any time; the map and the pin work without it, and while it is off nothing is sent.

(ترجمة عربية — مسودة بانتظار المراجعة اللغوية والقانونية؛ يسود النص الإنجليزي) 6.4 خدمة تختارها شركتك: البحث عن الأماكن في خريطة الموقع (اختياري). تتضمن خريطة موقع المشروع بحثاً اختيارياً عن الأماكن، وهو معطّل لكل الشركات. ولا يعمل إلا إذا قام مالك الشركة أو أحد مديري النظام بتفعيله من الإعدادات ← الميزات بعد قراءة إشعار وتأكيده. الشركة هي التي تختار هذه الخدمة؛ وهي ليست من المعالجين الفرعيين لدينا وليست في الجدول الوارد في 6.1. عند تفعيله وضغط شخص على «بحث»، نرسل الكلمات المكتوبة في خانة البحث واللغة وقيد البحث بعُمان من خادمنا إلى خدمة Nominatim التابعة لمؤسسة OpenStreetMap (nominatim.openstreetmap.org)، التي تُشغَّل خارج عُمان، للعثور على المكان. لا نرسل أي اسم أو بريد إلكتروني أو شركة أو معرّف مستخدم أو رمز دخول أو موقع محفوظ. وترى مؤسسة OpenStreetMap عنوان خادمنا لا عنوان جهاز الشخص. يُرجى كتابة أسماء الأماكن فقط وليس بيانات شخصية. نحتفظ بكل إجابة في ذاكرة مؤقتة لمدة 30 يوماً تحت بصمة الكلمات ومن دون ربطها بأي شخص. والنتيجة لا تحرّك إلا الخريطة: النقطة التي نحفظها للموقع هي الدبوس الذي يضعه الشخص. يمكن للشركة إيقاف البحث في أي وقت؛ وتعمل الخريطة والدبوس بدونه، ولا يُرسَل شيء ما دام معطّلاً.

We never disclose one customer's data to another customer. Every record in BinaFlo carries a company identifier and is isolated at the database query level.

7. Where data is stored and how it moves

Your data is stored on servers located in India, and is accessed for administration from India.

This means personal data of individuals in Oman is transferred outside the Sultanate.

8. Transfers outside Oman — and your consent to them

Article 23 of the PDPL permits transferring personal data outside Oman in accordance with the controls set by the Executive Regulation. It prohibits a transfer where the data has been processed in violation of the Law, or where the transfer would cause harm to the data subject.

We cannot provide BinaFlo without transferring your data outside Oman. We are not established in Oman and we do not operate servers there.

What the law requires, and what we have done

Prior approval from MTCIT is not required for a transfer of this kind, and we have not obtained one. There is no list of approved or adequate countries under Omani law; the assessment is ours to make and to document.

Optional services your company chooses

Place search on the site map. If your company's Owner or an Administrator switches on the place search (Section 6.4), the words typed in its search box are sent to the OpenStreetMap Foundation's Nominatim service, which is outside Oman. That happens only for a company that chose it, after the notice in Settings → Features; it is off by default, we send only the typed words, the language and a restriction to Oman, never the user's identity, and nothing is sent while it is off. The OpenStreetMap Foundation is not our sub-processor.

(ترجمة عربية — مسودة بانتظار المراجعة اللغوية والقانونية؛ يسود النص الإنجليزي) البحث عن الأماكن في خريطة الموقع. إذا فعّل مالك شركتك أو أحد مديري النظام البحث عن الأماكن (القسم 6.4)، فإن الكلمات المكتوبة في خانة البحث تُرسَل إلى خدمة Nominatim التابعة لمؤسسة OpenStreetMap، وهي خارج عُمان. ولا يحدث ذلك إلا لشركة اختارته بعد الإشعار في الإعدادات ← الميزات؛ وهو معطّل افتراضياً، ولا نرسل إلا الكلمات المكتوبة واللغة وقيد البحث بعُمان، ولا نرسل هوية المستخدم أبداً، ولا يُرسَل شيء ما دام معطّلاً. ومؤسسة OpenStreetMap ليست من معالجينا الفرعيين.

Website statistics (United States). If you accept optional cookies on binaflo.com, Google LLC receives the data in section 6.1 in the United States. We rely on your consent and on the Personal Data Protection Law, Royal Decree 6/2022, Article 23. The data is pseudonymous: it contains no account data, no customer data from the BinaFlo application, and no name, email or phone number. Safeguards: Google Analytics loads only after you accept; advertising cookies, Google signals and ad personalisation are off; Google keeps the data for 14 months; Google's processing is governed by Google's data processing terms for Google Analytics. You can withdraw consent at any time with "Cookie settings", and the cookies are then deleted.

If you withdraw consent to the transfer

You may withdraw it at any time by writing to the address in Section 13.

We want to be straightforward about the consequence: because the service cannot operate without the transfer, withdrawing consent means we can no longer provide BinaFlo to you. We will treat it as a request to close the account, stop processing, and delete or return the data under Section 10. In that situation we will refund any prepaid fees for the period after the account is closed.

If a company invited you to use BinaFlo, withdrawing your consent closes your own login, not the company's account.

9. How we protect it

• In transit — TLS on every connection, with certificates from a recognised authority. Plain HTTP is redirected, never served.
• At rest — full database backups taken daily, encrypted with age before leaving the server, and held in offsite object storage by a provider that does not hold the decryption keys.
• Passwords — stored only as salted hashes. We cannot read your password and will never ask you for it.
• Access control — role-based permissions with per-user overrides. Every operational record carries a company identifier and queries are scoped to it.
• Audit — sign-ins, failures, and changes to records are logged with the acting user, the time and the source IP.
• Segregation — production and staging are separate environments with separate databases and separate credentials.
• Administrative access — restricted to named personnel, over key-based SSH only, with no password authentication.

Article 13 of the PDPL requires a controller to apply measures appropriate to the risk. We review these annually and after any incident.

No system is perfectly secure, and we will not tell you otherwise. What we commit to is the standard above, and to telling you promptly when something goes wrong — see Section 11.

10. How long we keep it

A customer company's own obligations may be longer than ours — for example Article 52 of the Labour Law RD 53/2023 requires an employee's personnel file to be kept for at least one year after employment ends, and tax records must be kept for ten years. Those obligations sit with the employer. Export your data before you cancel. We provide export in the application, and the 30-day (trial) and 90-day (paid) windows are a courtesy, not a guarantee. During them your account is read-only and you can sign in and export everything. We warn the Owner and Administrators by email 14, 7 and 1 days before the deletion date.

When a retention period ends we delete the data or irreversibly anonymise it. Data already written to a backup is removed when that backup rotates out, within the periods above.

11. If there is a breach

Article 19 of the PDPL and Articles 30 and 32 of the Executive Regulation set two separate obligations, both within 72 hours.

• If a breach threatens your rights, we notify the Ministry of Transport, Communications and Information Technology within 72 hours of becoming aware of it, using the Ministry's Personal Data Breach Report Form.
• If a breach is likely to cause you serious harm or a high risk, we notify you within 72 hours as well.

We will tell you what happened, what data was affected, what we have done, and what you should do. Article 11(f) gives you the right to be notified, and we will not use uncertainty about scope as a reason to delay telling you that something happened.

Where we are the processor, we notify the customer company without undue delay and support its own notifications. We do not notify that company's workers directly unless the company instructs us to.

12. Your rights

Article 11 of the PDPL gives you the following rights over personal data we hold about you as controller:

How to exercise them

Write to the Data Protection Officer at the address in Section 13, saying which right you want to exercise. We may ask for proof of identity, and only for that purpose.

We respond within 45 days, free of charge. We may refuse a request that is manifestly repetitive, and if we refuse we will tell you why and tell you that you may complain to the Ministry.

(The 45-day deadline is set by the Executive Regulation. We do not cite an article number for it here because published sources disagree on which one it is.)

If your employer uses BinaFlo, we are the processor of your employment data and not the controller. Send your request to your employer. If you send it to us, we will forward it and confirm to you that we have.

13. Data Protection Officer, and how to contact us

Article 20 of the PDPL requires every controller to appoint a Data Protection Officer, with no exemption for small organisations. Articles 34 and 35 of the Executive Regulation require the contact details to be published.

Data Protection Officer: Sanjay Kashyap Madhu Email: privacy@binaflo.com Postal: Mivi Tech Labs L.L.C., 30 N. Gould Street, Sheridan, Wyoming 82801, USA

For anything else: support@binaflo.com

We aim to acknowledge within 5 working days and to answer substantively within the 45-day limit.

We are not required by Omani law to appoint a representative in Oman, and we have not appointed one. Neither the Law nor the Executive Regulation imposes that obligation on a foreign controller. If that changes, we will appoint one and update this policy.

14. Complaining to the regulator

Article 12 of the PDPL gives you the right to complain to the Ministry. You do not have to come to us first, although we would prefer the chance to put things right.

Ministry of Transport, Communications and Information Technology (MTCIT) Personal Data Protection Department Email: PDPC@mtcit.gov.om Portal: https://mtcit.gov.om/sectors/governance/personal Complaints form: "Reporting/Complaint for Violations of the Personal Data Protection Law"

The Ministry decides complaints within 60 days. Silence after that period is treated as rejection.

15. Children

BinaFlo is a business application for construction companies and is not intended for anyone under 18. We do not knowingly collect data from children. Article 6 of the PDPL contains specific protections for children's data; if you believe a child's data has reached us, write to privacy@binaflo.com and we will delete it.

Where a customer company enters data about a worker who is a minor, that company is the controller and is responsible for the lawfulness of doing so, including under the Labour Law.

16. Cookies and similar technologies

We use the minimum necessary:

Website statistics. On binaflo.com (not in the BinaFlo application), and only if you accept optional cookies, we use Google Analytics 4 to count visits, see which pages are useful, and count how many visitors from our Google ads start a free trial; for that count the statistics may be linked to our own Google Ads account, and only then. It sets the cookies _ga and _ga_VHYNQ3HJZE (2 years) and sends Google, in the United States, a pseudonymous browser ID, the pages you visit and how you reached the site. Google uses your IP address to work out an approximate location and to filter spam; it does not link the IP address to the browser ID. Google signals and ad personalisation are off, we do not use advertising cookies, and Google keeps the data for 14 months. Your consent is the legal basis (Personal Data Protection Law, Article 10); you can withdraw it at any time with "Cookie settings" at the bottom of any page, and the cookies are then deleted. The BinaFlo application uses no analytics.

17. Changes to this policy

When we change this policy we update the version number and the effective date at the top, and we keep previous versions available.

For a change that materially affects your rights or how we use your data, we notify account holders at least 30 days before it takes effect, by email and in the application. Where the change requires your consent under the PDPL, we ask for it — we do not treat silence or continued use as consent to a new purpose.

18. Governing law

This policy is governed by the laws of the Sultanate of Oman, and in particular the Personal Data Protection Law promulgated by Royal Decree 6/2022 as amended by Royal Decree 68/2026, and its Executive Regulation issued by Ministerial Decision 34/2024.

Nothing in this policy limits any right you have under Omani law.

Schedule 1 — Transfer impact assessment

Prepared under Article 39 of the Executive Regulation to the Personal Data Protection Law. This Schedule is the assessment. It covers personal data for which we are the controller — the personal data of account holders. Transfers of a subscribing customer's own data, for which we are a processor, are assessed in Schedule 5 of the Data Processing Agreement. Last reviewed: 1 November 2026.

1. The transfer

2. Legal framework in each destination

India — hosting and personnel access. India has an omnibus data protection statute, the Digital Personal Data Protection Act 2023, imposing purpose limitation, security safeguards, breach notification and data principal rights, and establishing a Data Protection Board. In our assessment this provides protection not less than the standard the PDPL requires for the categories of data concerned.

Government access: the Information Technology Act 2000, notably sections 69 and 69A, and the Telegraph Act 1885 permit interception and monitoring on specified grounds, subject to a written authorisation procedure. Access is not unrestricted and is subject to procedural requirements and judicial review.

Mitigations: the data sits on infrastructure operated by a commercial datacentre provider under contract, not by a state entity; no Omani data localisation obligation attaches; and hosting and personnel access are in the same jurisdiction, so there is one destination to assess rather than two.

United States — Amazon SES, Resend and Cloudflare. Sectoral rather than omnibus data protection law. Government access powers include FISA Section 702 and the CLOUD Act. Mitigations: Amazon SES (region us-east-2) and Resend receive only a recipient name, email address and the content of the message. Cloudflare R2 receives only customer files and backups encrypted on our server before transmission, with the key held by us and never by Cloudflare, so it cannot read the contents and a compelled disclosure would yield ciphertext. Cloudflare Turnstile sees the visitor's IP address and browser signals on the sign-up, sign-in, password-reset and contact forms, and nothing else.

United States — Google LLC, website statistics (Google Analytics 4). This destination concerns visitors to binaflo.com who accept optional cookies, not account data. Data: as Section 6.1 of this policy: a pseudonymous browser ID, pages visited, how the visitor reached the site (including whether from one of our Google ads), device and browser type and an approximate location derived from the IP address. It contains no account data, no customer data from the BinaFlo application and no name, email address or phone number. Basis: the visitor's consent in the cookie notice (Article 10 of the PDPL), and Article 23 for the transfer. Risk: low. There are no direct identifiers, and according to Google's documentation Google does not associate raw IP addresses with user identifiers and discards them after use; if the property is linked to our Google Ads account, the IP address may reach that account, where Google says it is encrypted and stored so that it cannot be re-identified. Safeguards: Google Analytics loads only after the visitor accepts; advertising cookies, Google signals and ad personalisation are off; Google keeps the data for 14 months; Google's processing is governed by Google's data processing terms for Google Analytics; the visitor can withdraw consent at any time and the cookies are then deleted. Conclusion: the transfer is acceptable with consent.

United Kingdom (United States for US buyers) — Paddle. Paddle takes subscription payments as Merchant of Record and receives the data described in Section 6.2 as a controller in its own right, not as our sub-processor, under a controller-to-controller data sharing agreement that applies Standard Contractual Clauses Module One. Mitigations: Paddle receives billing data only — no payroll, employee, identity document or project data — and it is itself subject to the data protection law of its own jurisdiction, which it applies under its own privacy notice.

3. Safeguards

• Written contracts with every recipient named in Sections 6.1 and 6.2 imposing obligations equivalent to the PDPL standard, breach notification, confidentiality, audit rights and restrictions on onward transfer
• TLS in transit; age encryption at rest for backups, with separated key custody
• Least-privilege access, and logging of administrative access
• The express consent of each account holder to the transfer, obtained before their first use of BinaFlo and recorded against the version and hash of the Privacy Policy then in force
• Notification to the account holder of any government demand, where not prohibited; a challenge to any unlawful or overbroad demand; and disclosure of the minimum compelled

4. Conclusion

Having assessed the legal framework in each destination and the safeguards in place, we conclude that these transfers provide a level of protection not less than that required by the Personal Data Protection Law. The principal residual risk is lawful access by public authorities in each destination. That risk is mitigated by the procedural safeguards in those jurisdictions, by the narrow categories of data reaching the United States and Paddle, and by the government-demand procedure above. This assessment will next be reviewed on or before 1 November 2027.

5. Review

Reviewed annually, and additionally on: any change of recipient or destination; any material change in a destination's law affecting government access or data protection; any government demand received; and any personal data breach.

BinaFlo is a product of Mivi Tech Labs L.L.C., Wyoming, USA. Version 1.4, effective 24 October 2026.