This policy explains how the Masar platform collects, uses and protects your personal data, and what your rights are, in line with the Personal Data Protection Law of the Sultanate of Oman (Royal Decree 6/2022) and its executive regulations. It applies to the Masar rider app, the Masar Captain app and the website.
1. Who is responsible for your data
[Full trade name of the company, commercial registration number, registered address and privacy contact email], referred to in this policy as “Masar” or “we”.
2. The data we collect
From riders:
- The mobile number your account is based on, your name, your email and photo if you add them, and your preferred language.
- Rides: pickup and drop-off points, route, distance and duration, fare and payment method, ratings and tips, and chat messages with the captain during the ride.
- Saved places (home and work) and the emergency contacts you add, with their names and numbers.
- Wallet transactions and promo codes used, and reports and complaints with their attachments.
From captains:
- Mobile number, name, photo and civil ID or resident card number.
- Document photos: driving licence, vehicle registration (Mulkiya) and insurance with their expiry dates, plus car and plate details.
- Location while online and during rides, earnings and commissions, bank account details for payouts, and ratings.
From everyone:
- Verification codes, stored in an encrypted form that cannot be reversed, and IP address, device and app information, to protect accounts and prevent misuse.
- Your device’s notification token, if you turn on notifications.
- Your conversations with the AI assistant on the website, and your messages through the “Contact us” form.
3. Location data
- Riders: we use your device location when you open the app and allow it, to set your pickup point and show nearby cars. We do not track your location in the background, and you can always type your pickup point instead.
- Captains: we collect your device location while you are “online” in the app and throughout a ride, even when the app is in the background, to send you the nearest requests, show your approach to the rider and calculate the fare. Location collection stops when you switch to “offline”.
- We keep the latest location of online captains, and each ride’s points, route and distance with the ride record. When a captain account is deleted, its last recorded location is erased.
- Address searches and route calculations are processed through our servers with a maps provider (Google Maps Platform), without sending your name or number to it.
4. WhatsApp verification codes
- When you sign in or ask to delete your account, we send a 6-digit code to your number on WhatsApp through a messaging gateway provider [provider name]. Only your number and the message text reach the provider and then WhatsApp (Meta), whose processing is subject to their own policies.
- We do not store the code itself, only an encrypted fingerprint of it; it expires within 5 minutes and the records are deleted daily. We apply attempt and sending limits, and lock a number temporarily after repeated wrong attempts.
- We may also use WhatsApp for messages about your rides and account, and to send the tracking link to emergency contacts you set up for automatic sharing.
5. The trip-sharing link
- You can create a tracking link for your ride and share it with anyone you choose, or turn on automatic sharing so your emergency contacts receive the link on WhatsApp when each ride starts.
- Anyone with the link can see, without signing in: the ride status, the captain’s first name and rating, the car model, colour and plate, the captain’s live location, the pickup and drop-off points and route, and the estimated arrival time.
- The link never shows your phone number, the captain’s number, the pickup PIN or the payment method.
- The link is random and cannot be guessed, is not indexed by search engines, and stops working 60 minutes after the ride ends or is cancelled. Share it only with people you trust.
6. How we use your data
- To provide the service: creating your account and signing you in, dispatching rides, calculating and collecting fares, paying captains, and support. Basis: performing our contract with you.
- For safety and fraud prevention: verifying captains, the SOS button, investigating reports and enforcing attempt limits. Basis: our legitimate interest in protecting users, and legal obligations.
- For accounting, tax and responding to requests from competent authorities. Basis: legal obligation.
- To send ride notifications, and offers if you agree to them. You can turn off marketing notifications at any time in the app settings.
- We do not sell your personal data, and we do not use it to make automated decisions that significantly affect you without human review.
7. Who we share data with
- Between rider and captain during a ride: the captain sees the rider’s first name, rating and pickup and drop-off points; the rider sees the captain’s first name, photo, rating, car, plate and location. In-app chat does not reveal phone numbers.
- Service providers working on our behalf under contracts that require them to protect the data: hosting, maps (Google), the WhatsApp messaging gateway, mobile notifications (Expo, Apple and Google), and the AI assistant provider (Anthropic) for assistant conversations on the website.
- Government and judicial authorities when the law requires it, or to protect the safety of a person in danger.
8. Transfers outside the Sultanate of Oman
Some service providers process data outside Oman. We only transfer data in line with the safeguards set by the Personal Data Protection Law and its regulations [approved safeguards to be completed after legal review].
9. How long we keep data
- Verification codes: deleted daily.
- A captain’s last location: replaced continuously and erased on deletion.
- Ride, payment and invoice records: for the period required by commercial and tax laws [period to be set after legal review], kept without contact details after an account is deleted.
- Safety reports: for as long as needed to investigate and as the law requires.
- “Contact us” messages and AI assistant conversations: up to 12 months unless linked to an open complaint.
10. Your rights
Under the Personal Data Protection Law, you have the right to:
- Access your data and obtain a copy of it.
- Correct or update inaccurate data.
- Have your data deleted, subject to what we must keep by law.
- Object to processing, or withdraw your consent where it is the basis for processing.
- Complain to the authority responsible for personal data protection in the Sultanate of Oman (the Ministry of Transport, Communications and Information Technology).
To exercise your rights, contact us through the “Contact us” page; we reply within the period set by law.
11. Deleting your account
You can delete your account in the app (Account → Delete account) or on the website’s “Delete account” page with a code sent to you on WhatsApp. We delete your name, mobile number, email, photo, saved places, emergency contacts, notification tokens and sign-in sessions, as well as a captain’s civil ID number and last location. Ride and payment records are kept without contact details for accounting and dispute handling, as the law requires. An account with an active or scheduled ride cannot be deleted.
12. Children
The platform is not intended for people under 18, and we do not knowingly create accounts for them. If you learn that a minor has created an account, contact us so we can delete it.
13. Data security
We use encrypted connections (HTTPS), encrypt stored secrets, limit staff access with permissions and two-factor authentication, and log admin panel actions. No protection is absolute; we will notify you and the competent authority of any breach affecting your data as the law requires.
14. Cookies
The website only uses cookies that are necessary for it to work: the session, protection against forged requests, and remembering your conversation with the assistant. We do not use advertising cookies or third-party trackers.
15. Changes
We may update this policy and will notify you of material changes in the app before they take effect; the date of the last update appears above.
16. Contact
For any question about privacy or your data: the “Contact us” page on the website [dedicated privacy email].