Privacy Policy

DeepAstra LLC ("Company", "we", "us", or "our"), registered in the Sultanate of Oman, operates the DeepAstra platform ("Platform") and the website at deepastra.ai. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in accordance with the Personal Data Protection Law of Oman (Royal Decree No. 6/2022) and other applicable legislation.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our Services.

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under Omani law.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Subject" means the individual to whom the personal data relates.
• "Services" means the DeepAstra platform, website, APIs, and all related products and services.

Information You Provide

• Account information: name, email address, organization name, job title, and phone number when you register or contact us
• Communication data: messages, feedback, and inquiries submitted through contact forms, email, or support channels
• Payment information: billing details and transaction records (processed by secure, PCI-compliant payment providers)
• Service data: content, prompts, configurations, and files you submit through the Platform

Information Collected Automatically

• Device & browser data: IP address, browser type, operating system, device identifiers, and screen resolution
• Usage data: pages visited, features used, session duration, referral sources, and interaction patterns
• Log data: server logs, error reports, and API call metadata
• Cookies & similar technologies: we use essential and analytics cookies as described in Section 10

We process personal data based on one or more of the following legal grounds under Omani law:

• Consent: where you have given explicit consent for specific processing activities
• Contract performance: where processing is necessary to fulfil our contractual obligations to you
• Legitimate interest: where processing is necessary for our legitimate business interests, provided these do not override your fundamental rights
• Legal obligation: where processing is required to comply with Omani law or regulations

We use your personal data to:

• Provide, maintain, and improve the Services
• Process transactions and send related communications (invoices, receipts, support messages)
• Respond to your inquiries and provide technical support
• Send service announcements, security alerts, and product updates
• Analyse usage patterns to improve platform performance and user experience
• Ensure platform security and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations and regulatory requirements in the Sultanate of Oman
• Enforce our Terms of Service and protect our legal rights

We do not sell your personal data. We may share your data only in the following circumstances:

• Service providers: trusted third-party vendors who assist with hosting, analytics, payment processing, and customer support, bound by confidentiality obligations
• Legal requirements: when required by Omani law, court order, or request from competent governmental authorities
• Business transfers: in connection with a merger, acquisition, or sale of assets, with appropriate data protection safeguards
• With your consent: for any purpose you have explicitly authorized

DeepAstra is designed with data sovereignty as a core principle. We prioritize storing and processing data within the Sultanate of Oman. Where international transfer is necessary, we ensure:

• The receiving country provides an adequate level of data protection as recognized under Omani law
• Appropriate contractual safeguards are in place (such as standard data protection clauses)
• Explicit consent is obtained from the data subject where required
• Transfers comply with the requirements of the Personal Data Protection Law (Royal Decree No. 6/2022)

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by Omani law. Specifically:

• Account data: retained for the duration of your account and for a reasonable period thereafter for legal and audit purposes
• Transaction data: retained for the period required by Omani commercial and tax law
• Usage & log data: retained for up to 24 months for analytics and security purposes
• Communication records: retained for up to 36 months or as required for ongoing support or legal matters

When data is no longer needed, it is securely deleted or anonymized in accordance with industry best practices.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls, role-based permissions, and multi-factor authentication
• Regular security assessments and penetration testing
• Incident response procedures aligned with Omani cybersecurity standards
• Employee training on data protection and confidentiality

While we take all reasonable precautions, no system is completely secure. In the event of a data breach, we will notify affected individuals and relevant authorities as required by the Personal Data Protection Law.

We use the following categories of cookies:

• Essential cookies: required for the Platform to function properly (authentication, security, preferences)
• Analytics cookies: help us understand how visitors interact with our website to improve performance and user experience

We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

Under the Personal Data Protection Law of Oman, you have the following rights:

• Right of access: request a copy of your personal data that we hold
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data, subject to legal retention requirements
• Right to restrict processing: request that we limit how your data is used
• Right to data portability: receive your data in a structured, commonly used format
• Right to withdraw consent: withdraw previously given consent at any time, without affecting the lawfulness of prior processing
• Right to object: object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@deepastra.ai. We will respond within thirty (30) days as required by law.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will take steps to delete it promptly. If you believe a minor has provided us with personal data, please contact us at privacy@deepastra.ai.

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated through the Platform or via email at least thirty (30) days before they take effect. The "Effective date" at the top indicates the latest revision.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the competent authority in the Sultanate of Oman, including the Ministry of Transport, Communications and Information Technology (MTCIT), in addition to any other legal remedies available under Omani law.

For questions, concerns, or requests regarding this Privacy Policy or your personal data: