Privacy policy
Your privacy is part of your Awad experience. This policy explains the data we use, why we use it, and your choices in the customer app and website, business portal and administration portal.
1. Who is responsible for your data?
Awad is operated by THULLH TECHNOLOGY SERVICES in the Sultanate of Oman. For privacy questions and rights requests, contact [email protected] or +968 77344277, or use the in-app help centre. The business you visit handles the information needed to fulfil your transaction under its own legal responsibilities.
2. Information we process
Account information includes your sign-in identifier, name and profile information your sign-in provider makes available according to your choices, which may include email. We do not receive your Apple or Google password. We record confirmed purchases, product choices and notes, stamps, points, rewards, favourites and reviews. For gifts, we process the recipient’s name and phone number, message and sender-display choice. We also process support messages, order status, a notification device token when enabled, and session information such as selected country, device type, page and activity time. Business and administration accounts include user details, permissions and an action log; passwords are stored as verification hashes.
3. Location, camera and notifications
We request location permission while using the app to show nearby places and approximate distance. You can decline and browse businesses or choose a country manually. The current version uses coordinates on your device to sort places and does not include them in Awad session analytics. The map provider may receive your network address and the displayed area to load the map. Camera access is used, with permission, to scan transaction codes; we do not record a video of the scan. Promotional notifications are optional and can be disabled in your account or device settings; they are separate from order-readiness alerts. We do not request access to your contacts to send a gift.
4. Why we use information
We use information to authenticate and operate accounts, show your choices, administer transactions, rewards and gifts, communicate about them, provide support, prevent fraud and duplicate redemption, monitor and improve the service, and meet legal obligations. We rely on legally required consent and, where applicable, what is necessary to provide the service or comply with law. Allowing location or camera access does not constitute consent to advertising. Do not put payment-card numbers, passwords or unnecessary sensitive personal information in order notes or messages.
5. Sharing and service providers
We share information needed to fulfil transactions and support customers with the business and authorised staff. A gift recipient receives the gift content and sender name according to your choice. An anonymous sender display does not make the transaction anonymous to platform administrators: we retain its link to the sender account to prevent abuse. We use Supabase for authentication and data, DigitalOcean for hosting, with Railway temporarily continuing to serve earlier versions during the transition, and Expo and Apple or Google services for certain app functions and notifications. When payment or gift-message delivery is enabled, data shared with its provider is limited to what is needed for that service. We may disclose information to meet a legal obligation or binding official request. We do not sell your personal information.
6. Hosting outside Oman
Hosting, authentication and notification services may process information outside Oman. We undertake to assess applicable transfer requirements, safeguards, contracts and required consent under Omani law before approving the relevant processing. You can request details of service providers and processing locations relevant to your account using the privacy contact above.
7. Retention and protection
We retain account and transaction data as needed to provide the service, resolve requests and disputes, prevent fraud and meet applicable statutory retention requirements. On a deletion request, we identify what can be erased and what must be retained, explain why, and restrict retained data to that purpose. Backup copies may remain until their retention cycle ends. We use encrypted connections, role-based access, session and login-attempt controls, and sensitive-action logs. No technology can prevent every incident; reports and notifications are handled under applicable requirements.
8. Your rights and account deletion
You may request access to or a copy of your data, correction, withdrawal of optional consent, deletion of your account and data, or lodge a complaint, subject to applicable rights and exceptions. Start at Account → Privacy & my data or email [email protected]. We will request only what is necessary to verify account ownership, never your password or sign-in code. Opening the page does not delete your account: confirmation is required before submitting a request, and support follows through and explains the outcome and any required retention. You can disable notifications or location access in your settings. You may complain to the competent data-protection authority at the Ministry of Transport, Communications and Information Technology.
9. Children and policy updates
Awad does not target the collection of children’s data. Where processing concerns a child or requires guardian consent, applicable requirements must be met before use; contact us to request removal of information entered without necessary consent. We may update this policy as the service changes. Its version date remains visible, and we explain material changes and seek fresh consent where required. Nothing here reduces your statutory rights.