Privacy Policy

1.Our role

For your own account information — who signs in, their role, your billing records — we decide how the data is used and are the controller of it.

For the directory data we read from your Google Workspace tenants, you are the controller and we act as your processor: we handle it on your instructions, to provide the service, and for nothing else.

2.What we collect

• Account data: the name, email address, profile picture and role of each person you invite to the console, and the sign-in events associated with them.
• Directory data: contact records read from the Google Workspace tenants you link — typically names, email addresses, phone numbers, job titles and organisational details of the people in those tenants.
• Usage and audit data: a record of significant actions taken in the console, including who took them, when, and the originating IP address and browser agent.
• Payment data: the amount, currency, status, reference number and provider transaction identifier of each payment. We do not receive or store card numbers, expiry dates or security codes.

3.What we do not collect

Card details are entered on OMPAY’s own secure page and never reach our systems. Where a payment provider response contains card-related fields, they are stripped before anything is written to our records.

We do not sell personal data, share it for advertising, or use it to train machine learning models.

4.Why we handle it

• To provide the service you have subscribed to, including synchronising and consolidating your directory.
• To take payment for that service and to keep accurate financial records.
• To secure the service — detecting misuse, investigating incidents and maintaining an audit trail.
• To comply with legal and accounting obligations.

5.Who else is involved

We use a small number of providers to run the service. Each handles data only as needed to perform its function:

• Google — identity (sign-in), Workspace APIs from which directory data is read, and Google Cloud, where the service and its database are hosted.
• OMPAY — payment processing. They receive the payment amount, currency and reference, and the card details your payer enters directly with them.

6.Where data is held

The service and its database run on Google Cloud. Data may be processed in regions outside the Sultanate of Oman, protected by the safeguards those providers offer. Each customer’s data is separated at the database level so one customer cannot read another’s.

7.How long we keep it

• Directory data: for as long as your account is active. After termination it is retained briefly so you can export it, then deleted.
• Audit and payment records: retained after termination where we need them for security, accounting or legal reasons.
• Account data: deleted with the account, other than what is embedded in retained records.

8.Security

Access is restricted by role, every customer’s rows are isolated by database-level policy, connections are encrypted in transit, and significant actions are written to an append-only audit log. No system is perfectly secure, but we design for containment: a mistake in one place should not expose another customer’s data.

9.Your rights

You may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Where you are one of your organisation’s users, your organisation’s administrator can usually action these directly in the console.

Where the request concerns directory data, the controller is the organisation whose tenant it came from, and we will refer the request to them.

10.Cookies

We set only the cookies needed to keep you signed in and to remember your light or dark theme preference. We do not use advertising or third-party tracking cookies.

11.Changes

We may update this policy. The effective date above changes when we do, and material changes will be notified in the console before they take effect.

12.Contact

Questions, or to exercise any of the rights above: privacy@giadirectory.com. Postal: Gulf Infotech LLC, Muscat, Sultanate of Oman.