Privacy Policy
This Privacy Policy explains how Whm Trading ("BOUTIFY", "we") collects and uses personal data when you use the BOUTIFY website and apps, and your rights under the Personal Data Protection Law of the Sultanate of Oman (Royal Decree 6/2022) and its Executive Regulations. 1. Who is responsible
Whm Trading, Sultanate of Oman, is the controller of the personal data described here. Contact for privacy questions: privacy@boutify.app].
Boutiques that sell to you receive the order details they need to fulfil your order (see section 4) and are responsible for handling that information properly.
2. What we collect
Account data: email address, password (stored only as a secure one-way hash), first and last name, preferred language. If you sign in with Google or Apple we receive your email address and account identifier from them; with Apple you may choose a private relay email.
Contact and delivery data: delivery addresses (area, street, building, recipient name, delivery notes) and, if you add it, a contact phone number. The phone number is used only for delivery and support contact, never for signing in.
Orders and payments: items ordered, prices, discounts, delivery or pickup choice, order status, returns, exchanges and refunds. For payments we store the payment status, amount, payment method type (for example "Visa" or "Apple Pay") and our payment provider's reference. Your card number and security code are entered only on the payment provider's secure page — we never receive or store them.
Support: messages you send us, photos you attach to a return request, and our replies.
Device and notification data: if you allow notifications in the app, a device notification token (stored encrypted) and your platform (iOS or Android).
Security and technical data: IP address, browser or app information and timestamps of sign-ins and important account actions, kept to protect your account and the Platform against fraud and abuse.
We do not use advertising identifiers, we do not track you across other apps or websites, and we do not sell personal data.
3. Why we use it (purposes and legal basis)
To create and run your account, process your orders, payments, returns and refunds, and provide support — necessary to perform our contract with you.
To send service messages about your orders and account — necessary for the contract.
To send marketing messages — only with your consent, which you can withdraw at any time in your notification preferences.
To keep the Platform secure, prevent fraud and meet legal, accounting and tax obligations — legal obligation and our legitimate interest in a safe marketplace.
To improve the Platform using aggregated statistics that do not identify you.
4. Who we share it with
The Boutique you order from: your name, the items, delivery address and contact phone (for delivery orders) or pickup details, so it can fulfil the order. Boutiques see only their own orders.
Thawani (payment provider, Oman): the amount, order reference and your email for payment processing.
Authorities, when required by Omani law or to protect our rights and users.
5. How long we keep it
Account data: while your account exists. When you delete your account we erase your name, contact number, saved addresses, favourites, notification tokens and sign-in methods, and replace your email address with an anonymous value.
Orders, payments, refunds and invoices: kept for 3 years to meet accounting and tax obligations, without your contact details after account deletion.
Security logs: 12 months. Database backups: overwritten after 14 days.
6. Security
We use encrypted connections (HTTPS), store passwords only as secure hashes, encrypt sensitive fields such as notification tokens and boutique bank details, restrict staff access by role, and keep an audit trail of sensitive actions. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as required by law.
7. Your rights
Subject to the law, you can ask to access your personal data, correct it, receive a copy, restrict or object to certain processing, withdraw consent for marketing, and have your data erased. You can correct your profile and delete your account yourself in the app; for other requests contact PRIVACY@boutify.app. We may need to verify your identity before acting on a request. You can also complain to the competent authority in Oman.
8. Children
The Platform is not intended for children under 16 without the involvement of a parent or guardian. We do not knowingly collect data from children without that consent.
9. Changes
We will update this policy when our practices change. The version and date are shown at the bottom of this page; material changes will be announced in the app or by email.
10. Language
If there is any difference between the Arabic and English versions, the Arabic version prevails.
v2 · 01/10/2026