← Hasadak

Privacy notice

Version 0.1 · 2026-10-07

1. Who we are

Hasadak is a halal, goal-based investing service being prepared for Oman. Today it is a prototype: it is not licensed, it takes no money, and it makes no real investments. Until a company is registered, Hasadak is run by its founder, [name], in Muscat. Questions about your data: support@hasadak.net.

2. The short version

  • We collect only what we need to run your account, check who you are, and meet the law.
  • Your ID number, bank account numbers, investor number and the photo of your ID are encrypted. Staff can open them only through the back office, and every time they do is recorded with their name.
  • We never sell your data, and we do not use it for advertising.
  • For now your data is stored in the European Union. It moves to a server in Oman before Hasadak takes any real money.
  • You can ask to see, correct or delete your data at any time.

3. What we collect, and when

When you visit the site. Our host, Cloudflare, handles your network address and basic details of your browser to deliver the pages and keep them safe. We count visits with Cloudflare Web Analytics, which uses no cookies and does not identify you. The fonts load from Google Fonts, so Google sees your network address when they load. The demo keeps your answers and settings (language, theme) on your own device, in your browser's storage; we do not receive them until you create an account.

When you answer a survey. Only your answers, the language and the day. We do not ask for your name or email. To stop the same device sending hundreds of answers, we keep a scrambled code made from your network address for up to two hours; it cannot be turned back into the address.

When you create an account. Your email address and Omani mobile number. Sign-in codes are never stored as they are, only a scrambled form that cannot be reversed. A cookie keeps you signed in for up to 30 days, and a second cookie counts wrong codes from your browser so that guessing is stopped.

When you confirm who you are. Your full name, your ID type and number, its expiry date, your date of birth, nationality, employment, where your money comes from, whether you or your close family hold a senior public office, a photo of your ID, and, if you give it, your investor number at Muscat Clearing & Depository.

When you set up your plan. Your goal, its date, your answers about risk and experience, the amounts you choose, and the bank accounts the monthly plan collects from and withdrawals go to.

When you sign the client agreement. Which version you signed and when, the email the code went to, and the network address and browser you signed from.

When you withdraw or complain. The amounts, fees, dates and the account the money went to; what you tell us in a complaint or an email.

4. Why we use it

  • To open and run your account and your plan.
  • To check who you are and where your money comes from, as the anti-money-laundering law (Royal Decree 30/2016) requires.
  • To suggest a portfolio that suits your goal, your time and your answers. The suggestion is made by fixed rules; a person reviews your identity, and you approve every move.
  • To send you sign-in codes, decisions, reminders (for example, before your ID expires) and notices about your account.
  • To keep the service safe: stopping code guessing, spotting misuse.
  • To answer your questions and complaints.
  • To keep the records the law asks for.
  • To improve Hasadak, using survey answers that do not identify anyone.

We use your data because you agree to it when you create your account, and because the law requires some of it (identity checks and records).

5. Who can see it

  • Hasadak's staff, only what their work needs. Opening an ID number or a photo is recorded with the staff member's name and the time.
  • Our service providers, who handle data only on our instructions: Cloudflare (hosting, the database and staff sign-in), Resend (sending our emails, from its servers in Ireland) and Google (fonts only).
  • Once Hasadak handles real money, also: the licensed broker, the custodian that holds your investments in your name, the bank that collects your monthly amount, Muscat Clearing & Depository, and the national e-KYC service, each only for its part.
  • Authorities, when the law requires it: the Financial Services Authority, the Central Bank of Oman, and the National Centre for Financial Information. If we report a suspicion of money laundering, the law does not allow us to tell you.

We do not sell your data or give it to anyone for their own marketing.

6. Where it is kept

For now, in a database in the European Union (Cloudflare, held to the EU jurisdiction), and our emails are sent from Ireland. Sending data outside Oman needs your consent and proper protection; we ask for your consent when you create an account, and the data is protected as set out in section 8. Before Hasadak takes any real money, all customer data will move to a server in Oman.

7. How long we keep it

  • Sign-in codes: until used or 10 minutes, whichever is sooner.
  • Being signed in: up to 30 days, or until you sign out.
  • Survey answers: kept, but they never identify you.
  • Your account during the prototype: until the prototype ends, or until you ask us to delete it.
  • Once Hasadak is licensed: records of your investments and payments for 10 years after each one, as the Financial Services Authority requires; identity records for as long as the anti-money-laundering law requires. Anything the law does not require us to keep is deleted when you close your account.

8. How we protect it

Your ID number, bank account numbers, investor number, ID photo and signing details are encrypted. Sign-in codes and sessions are stored only in scrambled form. Only named staff can open the back office, through a separate protected sign-in, and every look at your file is recorded. The site sends strict security instructions to your browser so that only our own code runs on it. No system is perfectly safe, so we also plan for things going wrong (section 10).

9. Your rights

You can ask us to:

  • tell you what we hold about you, and give you a copy;
  • correct anything that is wrong or out of date;
  • delete your data, unless the law requires us to keep it (section 7);
  • stop using your data, by withdrawing your consent (this may mean closing your account);
  • tell you if your data has been exposed.

Email support@hasadak.net from the address on your account. We reply within [15] working days. If you are not satisfied, you can complain to the Ministry of Transport, Communications and Information Technology, which oversees the Personal Data Protection Law.

10. If something goes wrong

If your data is ever exposed, we tell the Ministry within 72 hours of finding out, and tell you without delay what happened and what to do.

11. Age

Hasadak is for people aged 18 or over. We do not knowingly collect data from anyone younger.

12. Cookies and storage on your device

Three small cookies, none for advertising or tracking: one keeps you signed in, one counts wrong codes from your browser, and one is for Hasadak's staff only. Your browser's storage keeps the demo's answers, your language and your theme on your own device; you can clear them in your browser's settings at any time.

13. Changes

When we change this notice, the version and date at the top change. If a change matters to how your data is used, we email you before it takes effect.