Version 1.0 · Effective 1 November 2026
tijariq Privacy Policy
Last updated: 1 November 2026
This policy explains how Cyberstream handles personal data in tijariq. It is written for the businesses that use tijariq, their staff, and the people those businesses serve.
This is the one privacy policy for tijariq. The waynak app and the cyberstreamsolutions.com site stay under Cyberstream's own privacy policy.
1. Who we are
tijariq is a brand of Cyberstream Solutions and Trading SPC, Commercial Registration No. 1664225, Al Sooq, Al Seeb Al Jadidah, Al Seeb, Muscat Governorate, P.O. Box 635, P.C. 112, Sultanate of Oman.
Privacy contact: support@tijariq.com (subject "Privacy") · +968 7103 7685 (WhatsApp) · Sunday to Thursday, 9:00–17:00 Muscat time. Post: P.O. Box 635, P.C. 112, Al Seeb, Muscat, Sultanate of Oman. We have not named a data protection officer; privacy questions go to this contact.
2. Two roles: controller and processor
When we are the controller. We decide how we use:
- the account details of people who sign up and use tijariq (owners, admins, staff users);
- billing and invoice records;
- support messages;
- data about visitors to tijariq.com and the sign-in pages.
When we are the processor. A business that uses tijariq keeps data about its own customers, patients, guests, leads, WhatsApp contacts and staff. That business is the controller of that data. We process it only on the business's behalf, under our Data Processing Addendum.
If a business keeps your data in tijariq (for example you booked an appointment, messaged a shop on WhatsApp, or received a quote), please contact that business first about your data. It can see, export, correct and delete it. We help the business answer you within 30 days. You can also write to us and we will pass your request to the business.
3. Data we collect as controller
Account data: name, email, phone, password (stored only as a secure hash by our sign-in provider), language, the business name, type and country, your role, and the module you started with.
Billing data: the business's legal name, billing contact, invoices, plan history, and bank-transfer references. We do not receive card numbers.
Records of acceptance: which version of our terms you accepted, who accepted, and when.
Usage and technical data: sign-in times, the device and browser, IP address, error reports, and security logs.
Support data: what you send us by email or WhatsApp.
Website data: tijariq.com and the sign-in pages record standard request data (IP address, browser, page, time) through our hosting and network providers. We use Cloudflare Web Analytics, which counts visits without cookies.
4. Data we process for businesses (as processor)
Depending on the modules a business uses:
- POS: customer names, phones, purchase history and receipts; staff names, roles and sign-in codes.
- Clients: client and lead details, quotes, documents, tasks, notes, enquiry-form answers and consent records, and whether a quote has been paid.
- Connect: WhatsApp numbers and profile names, messages, photos, documents, voice notes, labels and opt-out status.
- Bookings: names, phones, emails, appointment details and waiting-list entries.
- Team: staff names, phones, positions, Omani-national flag, date of birth, wages, shifts, clock-in times and leave.
- Business documents: licences, contracts and staff passports, visas and labour cards, with expiry dates.
- Builder: the business's website content and any form sent by a site visitor.
- iq: the data above, when a user of that business asks iq about it.
5. Why we use data, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Provide tijariq and each module | Account, business and module data | Our contract with the business |
| Bill and collect payment | Billing data | Contract; legal duty to keep financial records |
| Send service emails and WhatsApp messages (sign-up, invoices, renewal reminders, security notices) | Contact details | Contract |
| Keep tijariq secure and prevent abuse | Technical data, logs | Our legitimate interest in a secure service; legal duty |
| Answer support requests | Support data | Contract; your request |
| Improve tijariq | Usage data, aggregated where possible | Legitimate interest |
| Send news about tijariq | Email, WhatsApp | Your consent; you can opt out at any time |
| Meet legal duties and answer authorities | As required | Legal duty |
We do not sell personal data. We do not use it for third-party advertising.
6. AI features
iq and some module features use AI models to read a business's data in tijariq and draft answers, replies, website text and summaries, and to read photos of supplier invoices.
- iq reads only the signed-in user's own business data, under that user's own access, never another business's data.
- iq drafts; a person at the business approves before anything is sent, except automatic replies the business has switched on.
- Some AI features use outside providers: Google (Gemini), Groq, TypeSafe and OpenRouter, named in §8 and the Sub-processor List. We send them only the data the feature needs, under contract.
- The iq assistant reaches its AI model through OpenRouter, which passes each request to the company that hosts the model.
7. Messages to customers on WhatsApp
Connect sends and receives WhatsApp messages through Meta's WhatsApp Business Platform, for the business. Meta processes the messages to deliver them.
Some iq Pro businesses send WhatsApp messages from their own WhatsApp account linked as a device, not through the WhatsApp Business Platform.
If you reply STOP or opt out, the business can no longer send you business-initiated WhatsApp messages through tijariq. If the business later deletes your contact, we keep only a one-way keyed code of your number, never the number itself, so your opt-out still works.
8. Who we share data with
Service providers (sub-processors). We use the companies in the tijariq Sub-processor List to host, secure and run tijariq: Supabase, Vercel, Cloudflare, Resend, Meta, Google (Gemini, Maps, and our support email), Groq, TypeSafe, OpenRouter, Sentry, PowerSync and, for iq Pro only, Oracle Cloud. Each processes data only for us, under contract. The list gives what each does and where.
The business's own providers. When a business connects its own payment provider in Clients, its customers pay that provider directly. Cyberstream never holds those payments.
Authorities. When the law requires it, or to protect people's safety or our rights.
A buyer of our business. If Cyberstream is merged or sold, data may pass to the new owner under this policy.
9. Where data is stored and sent
- Stored in Frankfurt, Germany (European Union): the tijariq database and files (Supabase), and the apps (Vercel, region fra1).
- Email is sent and received through Ireland (European Union), by Resend.
- Also processed in the UAE (iq Pro only), the United States (some AI features through Google, Groq, TypeSafe and OpenRouter; support email through Google) and on global networks (Cloudflare, Meta, Google). Some providers may also process data in the EU or the United States, and the company that hosts the iq assistant's model may be in another country, as the Sub-processor List shows.
For each transfer outside Oman we use contract terms with the provider, encryption in transit, and we send only the data the feature needs. We meet any condition the law sets for these transfers, including any permit or notice the competent authority requires. You can ask us for details of the safeguards for a transfer.
10. How long we keep data
| Data | How long |
|---|---|
| Account and business data | While the account is open; after a plan ends, 90 days to export, then deleted within 30 more days |
| Module data a business keeps | Under the business's control while it uses tijariq; then as above |
| Invoices and billing records | As long as Omani tax and commercial law requires |
| Records of acceptance of terms | While the account exists, and for 5 years after it closes |
| Raw WhatsApp delivery copies from Meta | Emptied 30 days after the message is saved to the inbox |
| Hashed visitor IP on enquiry forms (anti-spam) | At most 1 hour, never linked to the enquiry |
| Opt-out codes | Kept so the opt-out keeps working |
| Security logs | Logs inside tijariq are kept with the account data and deleted with it. Logs at our hosting and network providers are kept for each provider's standard period, then deleted automatically |
| Backups | Overwritten on their normal cycle; kept for no more than 30 days |
11. Security
We protect data with measures that fit the risk, including: each business's data kept apart in the database; encryption in transit and at rest; connected-service keys stored encrypted in a vault; customer links with random tokens stored only as hashes; signed webhooks; network protection; and minimal logging. No system is perfectly secure.
12. If there is a data breach
If a personal-data breach affects data a business keeps in tijariq, we tell that business within 72 hours after we confirm the breach, so that it can meet its own duties. If a breach affects data we control and is likely to harm you, we notify you and the competent authority where the law requires.
13. Your rights
Under Oman's Personal Data Protection Law, you may, subject to its conditions:
- ask whether we hold your data and get a copy;
- correct data that is wrong or incomplete;
- ask us to delete your data;
- withdraw consent where we rely on it;
- object to processing, including direct marketing;
- complain to the competent authority (the Ministry of Transport, Communications and Information Technology).
How to ask: write to support@tijariq.com with the subject "Privacy". We may ask a question to check it is you. We answer within 30 days, or sooner if the law requires.
If a business keeps your data in tijariq: see §2.
14. Cookies
tijariq uses only cookies it needs to work:
- sign-in cookies, shared across *.tijariq.com so one sign-in covers every app;
- a language cookie (
tijariq_lang) that remembers English or Arabic; - short-lived cookies for security and sign-up steps.
We do not use advertising cookies. Our web analytics counts visits without cookies.
15. Children
tijariq is for businesses and is not meant for children. A business may keep data about children (for example a clinic's patients); the business is responsible for the consent of a parent or guardian where the law requires it.
16. Changes
We will change the "Last updated" date when we update this policy, and email account owners about important changes before they apply.
17. Contact
Cyberstream Solutions and Trading SPCAl Sooq, Al Seeb Al Jadidah, Al Seeb, Muscat Governorate, P.O. Box 635, P.C. 112, Sultanate of Omansupport@tijariq.com · +968 7103 7685 (WhatsApp)
This policy is governed by the laws of the Sultanate of Oman, including the Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulation.
This policy is written in English. The Arabic version is a translation provided for convenience. If they differ, the English version prevails.