Privacy policy

Nizro Platform is operated in the Sultanate of Oman by Musandam Waves Investment, CR 1598900. Dynacloud Ltd (United Kingdom) builds and maintains the software. Where this policy says "we", it means Musandam Waves Investment.

We write this policy in line with Oman's Personal Data Protection Law, issued by Royal Decree 6/2022, and its executive regulation.

Data about you as our customer or a visitor to the site: your account, your sign-up and your messages to us. We decide how this data is used, so we are its controller under the law.

The records your business keeps in Nizro: its customers, staff, patients or guests, its sales and its documents. Your business decides what it records and why, so it is the controller of that data. We keep it and process it on your business's behalf, only to run the service for it.

Nizro's operator may open your business's records to give it support, under the same duty of care this policy sets.

If your business keeps health data or other sensitive data in Nizro (for example a clinic's patient files), the law asks more of you as its controller. Ask your adviser what applies to you.

• When you sign up: your name, your business's name and trade, your Omani mobile number, your email address and your password. The password is stored scrambled by the sign-in service, and nobody at Nizro can read it.
• If you choose to sign in with Google: the name and email address Google shares with us.
• The internet address (IP) a sign-up comes from, to stop repeated attempts.
• While you use Nizro: the records your business enters (sales, invoices, customers, stock, staff, payroll and the files you upload, such as photos and documents); sales, returns, cancellations and till closes carry who made them and when.
• For billing: your subscription, its invoices and payments, and the Riyada card if you upload it for an offer.
• When you write to us (the contact form, WhatsApp or email): what you send, with the name, business, phone and email you give us.
• A few milestones of your account (for example the first sign-in and the first sale), kept in our own database to see where a new customer gets stuck.

The site sets only the cookies it needs: one remembers your language, and the sign-in cookies keep you signed in. There are no advertising or tracking cookies, except in one case, described below, that ends on 30 November 2026.

We count visits to the public pages and four steps (a trial started, a trial completed, a quote request sent, a WhatsApp button tapped) with Vercel Web Analytics. It sets no cookie and stores nothing in your browser, and each count carries only the page and the trade, never your name, number or email.

If you open the site from our advert in ChatGPT, the site uses OpenAI's measurement script until 30 November 2026, so we can tell what the advert brings:

• When it runs: on the public pages and the sign-up form only, on that visit and on your later visits in the same browser for 30 days after your click. It never runs on the sign-in page or inside Nizro, or if your browser asks not to be tracked (Global Privacy Control or Do Not Track).
• Before it loads: the site asks OpenAI for the script's settings, so OpenAI receives your internet address. The site loads the script only if OpenAI's automatic matching is switched off.
• What it keeps in your browser: two cookies, __oppref, the reference of your click on the advert, for 30 days, and __obref, a random reference, for up to a year, and a marker that is cleared when you close the tab.
• What it reports to OpenAI: the pages you open, and whether you sent the sign-up form (with the kind of business you chose), sent a quote request or tapped a WhatsApp button. Each report carries the address of the page and of the page you came from (never the part after a question mark), the two references, your internet address and your browser's details. OpenAI may also read or set its own cookies for openai.com.
• What it never sends: your name, email, phone or anything you type.
• After 30 November 2026: the site stops loading the script and deletes both cookies on the first public page you open after that; otherwise they expire on their own.

If you do not come from that advert, your browser loads nothing from OpenAI and sends it nothing.

• To run the service: sign you in, keep your records, print your documents and open your invoice links.
• To bill your subscription and send you its invoices and receipts.
• To answer your requests and support you.
• To keep the service safe: stop abuse, and find and fix errors.
• To meet the law, for example tax records.
• Until 30 November 2026: to measure what our advert in ChatGPT brings, only for visitors who come from it.

We do not sell your data, and we do not use it for advertising beyond that measurement.

Supabase keeps the data in its data centre in Mumbai, India, encrypted in transit and at rest. This means it is stored outside the Sultanate of Oman.

Each business sees only its own records, and inside a business each person sees what their role allows.

These companies process data for us, each for one job:

• Supabase: the database, the sign-in and the stored files (Mumbai, India).
• Vercel: hosts the website and the application and delivers each request, with your internet address, and counts visits to the public pages without cookies.
• OpenAI: until 30 November 2026, measures the visits, sign-ups, quote requests and WhatsApp taps our advert in ChatGPT brings, only for visitors who come from that advert (see Cookies above).
• Anthropic: an AI model that reads what you ask Nizro to read: a photo of a supplier's paper or bill, a photo of your commercial registration certificate, a question in the help panel that the written guides do not answer, a question in the law library search, and a spoken sale line at the gold till. The photo or the text leaves our servers to Anthropic for this.
• Microsoft Azure: turns speech into text at the gold till, when the voice line is used.
• Resend: sends you the emails Nizro writes, such as the confirmation of your request and your invoices.
• Sentry: tells us about errors in the application. It receives no names, internet addresses, cookies or form contents.
• A channel manager service, for a hotel that connects its rooms to booking platforms: it carries the rooms, the prices and the bookings, with the guest's name and dates.
• The online shop or books system a business connects itself (Salla, Zid, the Meta catalogue, Zoho Books, Odoo, Daftra): Nizro takes from it the orders and the data the business asks to import, sends the shop the stock count, and sends the books system the invoices and payments with the customer's name and phone or email.
• Google: if you choose to sign in with Google, and at sign-up: when you type your business's name, Nizro looks it up on Google Maps (the name and the country) to show you your business's card; nothing is taken from it unless you choose Yes, this is mine.
• Thawani: for a business in Oman that connects its account, it takes the customer's card payment for an invoice and receives the invoice's number and amount. The card details are typed on Thawani's page and never pass through Nizro.

Some of these companies handle data outside the Sultanate of Oman, under their own contracts and terms.

When you tap a WhatsApp button in Nizro, your own phone opens WhatsApp with the message: Nizro sends nothing through WhatsApp itself, unless Nizro's WhatsApp Business number is switched on: then a business's evening message also reaches its phone through WhatsApp. If you write to us on WhatsApp, the chat is carried by WhatsApp under its own terms.

• Your business's records stay for as long as its account exists.
• When the free trial (30 days) ends without a subscription, the account becomes read-only: you can still sign in, read, print and export, and nothing is deleted while you can sign in.
• For a hotel: the photo of a guest's identity document, and the details and signature on a signed registration card, are deleted 12 months after check-out, or earlier when the guest's details are erased. The files leave storage the next morning.
• Your messages to us stay with our customer records so we can follow up. Ask us and we delete them.
• What you type when you sign up also stays with our customer records, so we can help you start and follow up, even if you never confirm your email. Ask us and we delete it.
• Some records, such as tax invoices, must be kept for the period the law sets, even after a request to delete them.

The Business Owner can export the business's records of the last 60 days to an Excel file from the data export page. For anything more, write to us.

Under the law you may ask us:

• to tell you what data we hold about you and give you a copy of it;
• to correct it or bring it up to date;
• to delete it, once we no longer need it for the service or the law;
• to stop using it for a purpose you agreed to (to withdraw your consent);
• to stop sending you marketing messages.

If you are a customer, patient or guest of a business that uses Nizro, ask that business first: it holds your record. We help it answer you.

Write to us at info@nizro.app or on WhatsApp at +968 9874 2211. If you are not satisfied with our answer, you may complain to the Ministry of Transport, Communications and Information Technology.

• Data is encrypted in transit and at rest.
• Each business sees only its own records; the database itself refuses a read of another business's records.
• Every person signs in with their own account and role.
• Sales, returns, cancellations and till closes carry who made them and when; an issued invoice's number, date, customer and amounts cannot be changed, and cancelling it needs a manager and a written reason.

Nizro is a service for businesses, not for children.

When we change this policy, we publish the new version on this page with its date. The version on this page is the one in force.

info@nizro.app, or WhatsApp +968 9874 2211. Musandam Waves Investment, CR 1598900, Sultanate of Oman.